Main Takeaways for WISER. Intelligence gathered from the Case Studies: • Complex and fast-evolving landscape broadening the potential for damage across organisations of all types and sizes. The UK cyber threat to UK business – 2016/2017 report highlights several pivotal attacks that have changed the security landscape, with some attacks being “very persistent, adaptive and sophisticated”. The rapid exploitation of the connected device market to launch unprecedented, large and sustained attacks is a step change. Hackers are increasingly after monetary value. • The public availability of some types of malware has already led to a significant lowering of technical barriers to entry to launching large sustained DDoS attacks. • Attacks like the Talk Talk one show that vulnerabilities can persist, including widely known vulnerabilities, in even large, cyber-aware organisations with significant economic impacts (fines, reduced share price) and reputation damage leading to loss of customers. • Impacts: some financial costs and on society (tangible and intangible) impacts are immediately obvious, while other impacts can be long lasting. When dealing with socio- economic impacts, it may sometimes be difficult to extract real-world impacts as they tend to be a second or third order effect. In some cases, impact depends on successful follow-up phishing or fraud attempts. o The immediate impact is typically disruption to services, which varies according to the capability of a victim to detect and deflect an attack. In some instances, attacks have caused disruption to services regardless of DDoS mitigation in place. o Many organisations face significant challenges in determining the extent of damage caused by cyber intruders as several factors may be involved. Implications on risk management from the case studies • The very recent WannaCry attack shows that very few countries worldwide are immune to a cyber-attack, which means that businesses in all EU countries need to remain vigilant and ensure that everyone in an organization has responsibility for ensuring data is adequately protected. Recent attacks have generally also caused more extensive damage and higher impacts on society than previous attacks. • Risks and consequences of a cyber-attack are particularly high for critical infrastructures, healthcare facilities and financial institutions. This is also due to the value of the data they hold and further opportunities to scam customers, patients and medical staff. o In the healthcare sector...
Main Takeaways for WISER. The wide-ranging analysis made for D8.3 shows that: • Anyone can hire or be a cybercriminal and sophisticated attacks do not always require sophisticated cyber attackers. The impact of a cyber-attack (e.g. ransomware, DDoS) can be disproportionate to the technical skills of cybercriminals. UK examples include the Netspoof stresser that targeted gaming providers, government departments, internet hosting companies, schools and colleges, causing considerable disruption. • Sophisticated attacks don’t require sophisticated actors. For example, Carbanak malware exploiting old MS Office vulnerabilities do not require the same kind of sophisticated and high investments needed to uncover zero-exploits, or to develop advanced, modular cyber espionage platforms customised to attack targets. • Cybercrime is becoming more aggressive. In some areas, e.g. parts of the UK, cybercrime is now more prominent than traditional crime types. • Increase in cyber extortion through DDoS attacks, ransomware and data extortion. • Ransomware remains the most common cyber extortion method. • More ransomware incorporating locker techniques to counter mitigation efforts, such as preventing the downloading decryption tools. • As the ransomware market matures, new strains will increasingly have unusual features to attract media attention. • Higher ransoms are usually (but not exclusively) linked to the means to pay or particularly valuable data to the victim. • Shift towards targeting specific businesses with high rewards. • All digital businesses are potentially vulnerable as attack targets, whether they are a Fortune 500 company, a family-run business or a utility company. They will therefore need much more focused approaches to cyber risk management. • Innovative FinTech firms with high market value can also benefit from new business partnerships. At the same time, they are potential attack targets and therefore need to protect their business assets and increase their security posture. • Hospitals are an increasingly popular attack target either as a source of revenue by encrypting crucial data and demanding xxxxxx for its release or as a source of valuable personal data of patients.
Main Takeaways for WISER. The sources analysed by WISER show that SMEs are facing increasing cyber threats, highlighting the need for practical approaches to risk management, also in view of the GDPR. However, most SMEs remain unprepared for many of the potential new dangers of the cyber world, and are not ready for the GDPR. Instead of seeing security measures as a burden, it is vital SMEs treat them as an indispensable necessity64.
