2022 saw two (2) of the largest cyber attacks and data breaches in Australia. Optus and Medibank, both suffered huge data breaches losing significant amounts of sensitive information including personal information as well as, in some instances, health information into the dark web and in general the public domain. These types of attacks are only going to worsen over time, not get better due to mindset issues with our Federal Government counterparts and industry wanting to be a compliance driven society.
Usually, we provide this type of article at the end of a year or beginning of the new year, but we have just been waiting to see what else has been in store for 2023. In 2023, we are going to continue down the path of more data breaches, and in the early parts of 2023, there have already been others reported, some of them which have had some negative consequences for the affected organisation.
2023 has a lot in store regarding the cyber security landscape. We are characterising it by a number of ongoing and emerging issues:
Ransomware: this type of attack is ongoing and will get worse. These types of attacks occur when systems are infected with malicious code and the system is encrypted and locked. The end user is ransomed for a sum of money/bitcoin to obtain an encryption key to decrypt the system. Doesn’t always happen like this and insurance companies, in some instances, are not providing cover for this type of attack (or the premiums have skyrocketed).
Supply chain attacks: why attack you directly when attacks to your downstream and upstream business partners could result in a hacker gaining access to your organisation. Supply chain relationships and security have never been more important. This includes your trusted IT partners and other technology providers.
Insider Threat: yes, your employees and contractors with access to systems and data! These have been, and always will be, a major concern to your business, whether the compromise is intentional or accidental. These people know the innermost workings of your business, along with having the privilege of direct access to information and data, in one form or another.
Cloud Security: we as business owners are adopting the Cloud more and more. Security and the protection of data in the Cloud is more important than ever, and the demarcation lines of accountability and responsibility for data and information in the Cloud are “cloudy” in some instances at best.
Cryptojacking: blockchain and cryptocurrencies are huge and they are a great haven for ransom payments. Cryptojacking is the act of a malicious actor taking control of your system through social engineering (and other means), and using your computer resources to mine for cryptocurrency. Using your computer in this manner may have data breach consequences, not to mention the amount of money spent for someone else’s fortune.
National State Attacks | Advanced Persistent Threats (APT): there have been recent accusations in the past and in present day of China and Russia attacking countries like the USA and Australia through means of a cyber attack and key attacks against critical infrastructure. These attacks are a long game and have many attack vectors such as social engineering, technology attacks and psychological warfare. These attacks are ever increasing and are going to become the norm as we head into a digital arms race.
Cybersecurity Workforce Shortage: the bane of every technology organisation’s existence. There is a shortage of good cyber security people (experienced), and a general skills shortage in the IT industry which makes delivery and response to cyber attacks difficult.
Overall the threat landscape, from a cyber security perspective, is constantly evolving. It is important for organisations to remain vigilant with their technology and ensure that they have had the appropriate (and independent) security assessments against their organisation to ensure they are able to react in a reasonable time to incidents occurring.
Legislation is being passed for data breaches now with increased fines/penalties for instances where the breach is not reported. Ignorance is not bliss and won’t be accepted as a defence.
Compliance just for the sake of compliance is only going to get you into more trouble. We will have more on this over time, but always remember, Cyber criminals don’t play by the rules, so compliance doesn’t work.
Happy 2023 and let’s move to start solving some of these problems this year.
Happy Cyber.