By Niall McConachie (pictured), regional director (UK & Ireland) at Yubico
The past twelve months has proved a challenging time for IT security teams, with several high-profile public and private sector organisations – from the NHS to Uber and Twitter – hit by sophisticated and targeted cyber attacks. In 2023, hackers are continuing to utilise phishing-as-a-service and other sophisticated tools and tactics in order to break through poor cybersecurity defences. As a result, it’s essential that all businesses remain alert to the ever-evolving cybersecurity landscape, particularly for those delivering critical public services.
Cyber adversaries make the most of low-effort tactics
It’s important to remember that hackers do not always use highly sophisticated methods to infiltrate a target organisation’s corporate network. Indeed, the majority will take the path of least resistance, opting for low-effort and low-resource tactics instead. Hackers may simply purchase attack deployment services and phishing kits via the dark web. And in some cases, rogue former employees have been known to sell legitimate corporate information to cyber criminals themselves.
Despite the fact that the availability of such resources have significantly lowered the bar for attackers looking to infiltrate corporate networks, there appears to be a lag in organisations’ countermeasures when it comes to implementing phishing-resistant multi-factor authentication (MFA), in order to safeguard access to critical data and systems.
In fact, our own research has found that 59 percent of employees still rely on the traditional combination of usernames and passwords to authenticate into their online accounts. What’s more, almost 54 percent of employees admit to writing down or sharing a password, which increases the chances of a data breach occurring. With the cyber threats facing organisations continuing to evolve and increase, it’s now imperative to consider deploying modern phishing-resistant MFA solutions as well as delivering comprehensive – and ongoing – security awareness training to all staff.
Safeguarding critical infrastructure and the public sector
Cyber criminals will always be attracted to those organisations where they can create the greatest amount of disruption possible. As a result, those operating within the public sector and critical national infrastructure (CNI) – healthcare, education, utilities, and other key sectors – will continue to face targeted attacks throughout 2023 and beyond.
It goes without saying that a loss of availability or significant disruption to the services offered by these crucial organisations has the potential to impact a significant portion of the population, potentially placing lives in danger. Cyber adversaries take this into account, often seeking to profit from ransom pay-outs as victim organisations grapple to restore vital services. Yet we’ve seen time and again that accepting to pay a ransom can lead to further problems down the line, by inviting hackers to repeat attempts on networks.
We’re also seeing an increased level of attacks against CNI, largely due to the general adoption of connected sensors at industrial sites and the rise of IoT monitoring devices at power stations. The increase in the number of attack vectors has introduced new ways for hackers to circumvent existing cyber mitigation defences. As a result, CNI and public sector leaders must ensure they are responding by continually evaluating the effectiveness of their highest-priority baseline measures.
Prioritise the Zero Trust method
The Zero Trust architecture (ZTA) is one of the most effective threat mitigation measures that organisations can implement, with many businesses opting to move certain business-critical applications over to ZTA in recent years. As a result, ZTA is set to remain an ongoing priority for organisations in 2023. Yet achieving this is largely reliant on back-office applications and services that require either ZTA support – which don’t quite exist yet – or a migration strategy. What’s more, organisations in the financial services sector have been slow adopters of the framework, given many still rely on mainframe technology for their ledger.
That being said, more and more organisations are prioritising the use of advanced cyber security defences, from phishing-resistant MFA to ZTA, in order to protect their critical data and digital assets. However, the most robust security measures in the world can only be fully effective with the cooperation of internal staff, which relies on them having an up-to-date understanding of the threat landscape, which is where cyber security awareness training comes in. Only by committing to enforcing advanced cyber security methods and educating the workforce on cyber best practices, can businesses put themselves in the strongest possible position to mitigate the risks posed by the evolving cyber threat landscape.
Author bio
Niall’s dedicated 10+ years working within the cybersecurity and software space. At Yubico, he advocates for better authentication technology initiatives.
