Cybersecurity Awareness Month – Part 2: The Threats and Challenges Businesses are Now Facing 20 Years On

By Robin Campbell-Burt, CEO at Code Red

One of the key focuses around this year’s Cybersecurity Awareness Month is passwords and how to secure them. Whilst this has been an on-going issue (for more than the last 20 years), there are also plenty of new cyber threats and challenges facing businesses when it comes to cybersecurity.

When Cybersecurity Awareness Month first started back in 2003, businesses were faced with the likes of phishing scams, computer viruses and Nigerian 419 scams. However, they now also must contend with a wave of ransomware attacks and the rise of generative AI, which all bring new challenges to organisations when it comes to securing networks and protecting users.

So, with this mind, it is a perfect opportunity to think about some of the biggest threats outside the world of passwords.

For Darren Williams, CEO and Founder at BlackFog, ransomware is one of the most pressing cybersecurity issues – particularly against Small and Medium Businesses (SMBs), with 61% of SMBs having been hit with a cyberattack in the last year, facing detrimental consequences such as business downtime and data loss.

“Cybercriminals typically view SMBs as an easy target, as they have a lower level of protection. Clearly, these findings reflect that businesses do not know how to properly navigate the cybersecurity landscape and need a hand in doing so.”

It is not just SMBs that have been hit by ransomware, but large enterprises too. The likes of the Royal Mail, JD Sport and Greater Manchester Police have all been victims to a ransomware attack in 2023. “Newer and more potent variants of ransomware are emerging, written and run by increasingly more practiced evildoers,” said Aaron Kiemele, CISO at Jamf.

“These can not only encrypt data but also exfiltrate it, leading to combined threats of data encryption and potential data leaks. Whilst there are many vectors for a critical issue to occur, the sheer speed and completeness with which new ransomware can wreck your day cannot be underestimated.”

Ransomware is not the only major threat facing businesses in today’s modern cyber threat landscape. Aaron Kiemele believes that with the rise of advanced AI, threats such as phishing are becoming more sophisticated.

“With the advancements in large language models for machine learning, such as ChatGPT, cybercriminals are leveraging AI to automate attacks, analyse vast amounts of data, and craft more effective phishing emails or malware to achieve their nefarious ends. We can no longer rely on bad spelling or sketchy formatting.”

Whilst new challenges have risen in the last 20 years, organisations are still facing some of the same old challenges. Sylvain Cortes, VP of Strategy at Hackuity, points towards the issue of patching.

“Although we’ve seen enormous changes over the past two decades, from operating systems to software – the importance of regular patching to provide protection from a range of key vulnerabilities has not changed. Yet patching continues to be a big challenge for many organisations.”

Sylvain Cortes believes that to address this issue, organisations need to establish a strong and comprehensive patch management system: “With ever increasing numbers of vulnerabilities to manage, taking steps to contextualise and prioritise risks has never been more important.

“Building on the routine practice of patching, organisations must focus on vulnerability prioritisation to home in on the threats that really matter to their business.”

It is important to realise that the goal of Cybersecurity Awareness Month is to improve the cyber resilience of enterprises. However, doing the basics such as strong passwords, is not enough on its own. Organisations should be building cybersecurity strategies that not only meet the basics but go above and beyond.

This is no better said than by James Hadley, CEO and co-founder of Immersive Labs, who argues that awareness is no longer enough and that businesses need to ensure that when an attack inevitably happens, their organisation is prepared to respond.

“Resilience means knowing that your entire organisation has the knowledge, skills, and judgment to respond to emerging threats, backed by data.

Continuous, measurable exercising across your entire workforce — from the storeroom to the board room — provides businesses with the insights they need to understand the current state of their cyber resilience and where their weak points lie.

It also creates a more positive cybersecurity culture that encourages reporting rather than punishing employees when a breach does happen. With top-to-bottom cybersecurity education, organisations are moving beyond awareness and can ensure that their data is secure."

Christer Swartz, Solutions Marketing Director at Illumio, also believes that testing your security stack and business is extremely important. He argues that businesses should also consider pen testing services to improve resilience.

“There are professional pen test companies which will perform testing for customers to ensure the most skilled personnel are able to provide real data against a chosen security solution.

“While there is no solution that will be 100 percent perfect, professional pen testing will reveal if a solution or security stack is robust enough that any breach attempts will be detected – or that cybercriminal will give up and put their efforts elsewhere when a breach is too difficult to continue.”

Going above and beyond is a sentiment also echoed by Darren Williams: “CISA taking the initiative and offering a four-step advisory can help businesses thwart attackers. But to take it even further, here are our suggestions.

Businesses must do everything they can to secure their data and prevent ransomware attacks leading to extortion by adopting next-generation preventative cybersecurity tools, such as anti-data exfiltration (ADX),” said Darren Williams. “This will ensure that when the inevitable attack does occur, any data loss will be prevented.

Avoid delay when it comes to reporting a cyberattack. The sooner organisations announce a data breach, the faster law enforcement and external help can respond and work toward a resolution. Organisations with good communication can limit damage and prevent reputational damage.”

Cybersecurity has become critically important to not only businesses but also their customers. With the holiday season fast approaching, Tyson Whitten, VP of Global Marketing at Jscrambler, says that fortifying the integrity of payment pages is a great way to build trust among customers.

“Online businesses should proactively take steps to ensure the security of their payment pages, recognising the vulnerabilities posed by both 1st and 3rd party JavaScript exposure. This includes safeguarding 1st party JavaScript, the backbone of your website's functionality, and meticulously monitoring all 3rd party JavaScript partners to ensure each integration is backed by a well-documented business rationale.

Moreover, equipping yourself with the tools to control and monitor these scripts and enabling the detection and mitigation of malicious actors will foster a secure and trusted experience for your customers.”