In a famous painting by French Post-Impressionist painter Paul Gauguin, he asked, “Where do we come from? What are we? Where are we going?” These three questions have always been relevant to us living in the modern world. For businesses in this digital and data-driven economy, these are the most pressing questions for cybersecurity, as cyberattacks such as ransomware, phishing, and data breaches have become a significant threat to businesses and individuals.
We looked back at some significant events of the past year to understand the state of cybersecurity and to draw some lessons moving forward in 2019.
Awareness is still the best security measure
Google may have eliminated phishing among its employees by replacing two-factor authentication (2FA) with a USB physical key, but phishing was still one of the biggest threats in 2018. A blatant example of this vulnerability was the $3 billion in intellectual property and 31 TB of data stolen and sold on Megapaper.ir and Gigapaper.ir following a series of phishing attacks on professors and staff from various universities.
Organizations were largely unprepared for ransomware
2018 was the year of ransomware, a malicious program that holds data hostage until money is paid. Ransomware caused unprecedented damage to several industries such as healthcare, transportation, state agencies, and businesses.
The most notable example is the NotPetya ransomware. Starting in Ukraine, it quickly spread worldwide, crippling infrastructure and services and causing billions of dollars in damage across Europe, Asia, and the Americas. Similar strains also emerged, proving that businesses were largely unprepared. Many of these attacks also go unreported, as companies would rather pay a ransom than risk reputation damage, halted operations, data loss, and fines.
Ransomware should not be underestimated. A ransomware attack that demanded $52,000 dollars caused damages of almost $10 million to the city of Atlanta.
Healthcare breaches such as those suffered by CarePartners highlighted that businesses still fail to update their software. CarePartner’s software was un-updated for two years, making them highly susceptible to ransomware attacks. However, important software updates have indispensable security patches that address some of the latest threats and vulnerabilities. MSPs take care of this so that their partners’ hardware and software have the necessary patches and updates.
Make sure your devices are safe
Securing hardware is also absolutely essential. Meltdown and Spectre were two major vulnerabilities found in Intel, AMD, and ARM computer chips. Meltdown lets hijackers access higher privileged parts in a computer’s memory, while Spectre lets hijackers access data from other apps. Patches were issued to address these, but those who were unaware of these threats were most likely affected.
Android operating systems also had many vulnerabilities, especially since several vendors neglected to install security patches to them and deliberately hid this lapse from consumers. In a time where bring your own device (BYOD) is the norm, this puts entire organizations at risk.
Don’t put your data in the hands of random companies
2018 saw major services that handle user’s unique personally identifiable information (PII) fall prey to data breaches. Equifax had 2.4 million records breached. Under Armour, 150 million accounts. MyHeritage, 92 million email addresses and passwords. Exactis, 340 million records with PII. Many of these services collect PII, such as names, date of birth, and Social Security numbers. Unlike credit card details and addresses, information like these cannot be changed and they can easily be used for identity theft, which is why it’s important for individuals and businesses to be cautious of whom they share their data with.
