12 Cybersecurity Threats for all businesses to be aware of
26 March 2021
Here are some of the main cybersecurity threats that affect businesses in 2021. During the ongoing Pandemic, cybercrime has been rising exponentially. Businesses of all sizes need to be aware of the threats so they can take the appropriate precautions.
Cybersecurity threats are not new, they’ve existed for as long as the World Wide Web itself, but they’re certainly becoming more sophisticated. Technology is constantly moving forward, but so are cybercriminals and hackers. Sadly, hackers are always trying to stay a step ahead of law enforcement and security professionals.
Knowledge and awareness of these issues can help prevent cybersecurity threats affecting your business. We’ve put together this list of common cybersecurity threats for you to refer to, as well as advice on how you can protect your organisation from cybercrime.
1. Phishing
We’ve all heard of phishing, but what does it actually mean?
Phishing emails aim to trick you into clicking on a malicious link by pretending to be a legitimate company such as your bank, PayPal or Amazon.
These emails are extremely sophisticated and are almost indistinguishable from genuine emails from these companies. However, you should always be on the lookout for certain ‘red flags’ when you’re browsing through your email inbox. Ask yourself:
- Is this an unexpected email?
- Does the from address contain any mistakes or misspellings? (Look closely)
- Is the email asking for personal information?
- Does the email contain alarming or unusual language?
If the answer is ‘yes’ to any of these, then it’s best to err on the side of caution and drag that email to the spam folder.
It’s also common for phishing emails to appear to come from friends, relatives or co-workers, asking for financial help or trying to trick you into downloading a file or clicking on a link.
Phishing attacks can cause devastating data breaches that could hard the reputation of your business. In late 2020, Twitter staff fell victim to a phishing attack that led to a security breach involving many high profile celebrities and entrepreneurs.
2. Brute Force Attacks
Put simply, a brute force attack is when an attacker tries to guess your password by trying hundreds of thousands of different combinations.
It’s like trying to crack a 4-digit code by trying 0000, 0001, 0002, etc, until you get the right one.
Except it’s not a person attempting all these passwords, it’s a computer programme that can guess thousands of passwords per second. It obviously starts with the list of top 100 most common passwords.
Weak passwords is why brute force attacks are often successful, as they rely on users who reuse and recycle their passwords everywhere so that they’re easier to remember.
You can avoid falling victim to brute force attacks by always using unique, randomly generated passwords and storing them in a password vault (NEVER write it down!)
There’s a great service called haveibeenpwned.com that will tell you if your email address or password if ever involved in a data breach.
3. Social Engineering
Social Engineering involves tricker the user into taking some action, much like phishing. Except social engineering attacks seem to be even more sophisticated and they’re so successful because they rely on the weakness of human nature and psychology. Social engineers are face-to-face con artists and actors as well as cyber criminals.
No one is perfect and no one ever will be. Social engineering relies of the fact that humans are emotional and naturally trusting of others.
A malicious social engineer could trick you into handing over your password via email or phone using convincing techniques. Social engineers could be posing as members of staff from your IT or HR department. Would you question someone who looked like a technician doing some work on a company computer, or would you assume that they’re supposed to be there?
Companies use secure firewalls, password policies, security procedures, email protection and encryption, but they don’t protect your business against social engineering attacks.
For a cybercriminal who is familiar with dealing with extremely sophisticated technology, it’s much easier to hack a person than it is to hack 256-bit encryption!
4. SQL Injection
SQL is Structured Query Language – it is used to query large databases used by businesses of all sizes.
You may have members of staff who enter various information into databases, SQL injection happens when malicious code is inserted into the database with the intention of destroying, corrupting or stealing the data within.
If an application is not built to be robust and secure, then it’s vulnerable to SQL injection. It’s highly important that you patch any software vulnerabilities to avoid risks like SQL injection.
It’s also possible for cybercriminals and hackers to inject malicious codes via some company websites. In the early days of the internet, even simply contact forms were vulnerable to SQL injection!
To avoid SQL injection, take incremental, real-time backups of your databases so you can restore any data that gets corrupted or destroyed.
5. Cross-Site-Scripting (XSS)
This cybersecurity threat specifically affects websites using vulnerable or out-of-date code. Older or poorly coded web applications may contain vulnerabilities that allow hackers to inject malicious code into the site from their web browser.
By doing this, cyber criminals can bypass policies set by the domain or the browser. Cross site scripting can make user accounts vulnerable or allow hackers to hijack user’s sessions, amongst things.
Your website should be regularly tested for cybersecurity issues to avoid the risk being affected by cross site scripting.
6. Distributed Denial of Service Attacks (DDoS)
Have you ever tried to buy tickets to a really popular show only to find that the website is overloaded by others trying to do the same thing?
A DDoS attack essentially does the same thing, except a group of hackers coordinate the attack with the intention of taking down a website or service. They will often use automation to hit a website tens of thousands of times per second, increasing demand on the server and preventing it from loading at all.
DDoS attacks are always performed maliciously and with the intention of causing harm.
7. Ransomware
Ransomware encrypts the contents of your computer and demands a ransom if you want your files back. The ransom is almost always demanded in BitCoin or another cryptocurrency.
If you’re hit by ransomware, the best way to recover is to restore from a backup. Taking regular backups can protect you from ransomware and many other disasters.
8. Viruses and General Computer Malware
In addition to ransomware, good old fashioned computer viruses still exist, they affect Windows, Mac OS, iPhones and Android Phones.
Having a good antivirus software that’s regularly updated can help protect you from most known computer viruses out there.
9. Poor User Security Practices and Lack of Cyber Awareness
Sadly, many IT users in businesses just aren’t aware of these cyber security threats or they’re not taken seriously. It’s common to find:
- Passwords being reused or written down
- Insecure passwords that are easy to guess
- Passwords being shared verbally, by text message or email
- Data being stored without encryption
- Confidential or sensitive documents being sent in non-secure ways (e.g. email)
- Users leaving their phone or computer unlocked
- Connecting to unsecure public WiFi networks without taking any precaution
- Talking loudly on the phone in public places about confidential matters
The best way to combat these bad habits is through regular training and engagement.
10. Man in the Middle Attacks
The is the equivalent of having your ‘phone tapped’. Man in the middle attacks occur when a hacker is able to intercept communications in order to spy or gain valuable/sensitive information.
Man in the middle attacks can happen via email, phone, SMS, Social Media, website contact forms and other web applications.
You can prevent being caught in one of these attacks by using modern encryption methods when browsing the web and sending emails or other communication.
11. Domain Name System (DNS) Attacks
Where vulnerabilities exist in the DNS, it’s possible for malicious cybercriminals to redirect your company website and emails to a different website entirely.
If you manage your own DNS servers, then they should be securely configured and routinely checked and/or maintained. Most smaller businesses will use a standard DNS resolver and domain name registrar, so ensure that you have multi-factor authentication enabled for ALL logins related to your company domain name, website and IT administrative functions.
12. Zero Day Exploits
Zero Day Exploits happen when attacks strike between discovery of a vulnerability and its patch being released, usually on the same day. This relies on hackers and cybercriminals working quickly to exploit a hardware or software vulnerability that’s announced in cybersecurity forums.
Most software developers have a private and secure method to communicate potential security flaws like this, but sometimes they’re reported publicly on Social Media or online forums for anyone to see.
Unfortunately, if hackers get hold of this information at the right time, it gives them an opportunity to exploit it before the developers get a chance to release a patch – hence it being known as a zero-day exploit.
Protecting Yourself from Cybersecurity Threats
It’s important to note that many business owners don’t put enough emphasis on cybersecurity threats until it’s too late.
They say knowledge is power, and we say that you need to think like a hacker in order to stop a hacker. The ultimate goal of cyber security is to help make your business safer and more successful.
Our Cyber Security Kick Start Course is £24 and can be completed online in your own time.
Unlike other training companies our Kick Start courses are designed to provide a level of information that enables you to make informed decisions on the level and type of course you may wish to progress with (Try-Before-You-Buy). We also provide a discount on related qualification courses on final completion, so that you save money on chosen related courses from our portfolio.
We also offer a course to provide professionals with the necessary knowledge and skills to protect their information assets and protect themselves online. This course will immerse students into an interactive environment where they will acquire a fundamental understanding of various computer and network security threats such as identity theft, credit card fraud, online banking phishing scams, viruses, email hoaxes, loss of confidential information, hacking attacks and social engineering.
This self-study course is specifically designed for todays’ computer users who use the internet extensively to work, study and play.
