Magazine menu Close Magazine menu

phishing

Latest stories

cybersecurity predictions

What a year of changing cyberthreats can tell business

  • min read
    • For business leaders, knowing what's changing in cybersecurity helps you recruit the right people with the right skills today for what you'll soon need. Kaspersky's 2022 Security Bulletin (free download) analyzes which attacks their global cloud service Kaspersky Security Network (KSN) has detected, blocked and disabled over the past year. There are some numbers your business will want to know about. 15 percent of users had a malware attack Kaspersky Security Network blocked malware-class attacks on some 15 percent of users in 2022, or around 1 in 7. This shows just how common malware is. The malware class of attacks covers familiar cybercrime tools like viruses, trojans and ransomware. The countries where Kaspersky's software blocked the most malware attacks in 2022 were Tunisia, Taiwan and Algeria. 506 million web-based attacks Web-based attacks result from users downloading files that then trigger a cyberattack. These might come from websites made by cybercriminals, infected online resources within user-created content (like online forums) or legitimate resources that cybercriminals have hacked. Cybersecurity education can be a powerful tool in preventing web-based attacks. Heathrow Airport has a novel staff cybersecurity education that carefully targets those needing it most with 10-minute online learning modules. 1.4 million cryptocurrency mining attempts Cryptocurrency mining is very much on the rise. Kaspersky Security Network detected around 1.4 million attempts to install mining software in the past year. Mining means digitally solving complex mathematical problems that verify cryptocurrency transactions, which also earns cryptocurrency. It slows devices and uses much electricity. In November 2022, Kaspersky announced they'd seen a 230 percent growth in cryptocurrency mining in the third quarter of 2022 compared with the same period in the year before. 102 million attempts to visit malicious URLs Malicious URLs are a common tool in 'phishing' attacks – when cybercriminals send emails inducing recipients to click on links, downloading malware. Endpoint security is vital in protecting against phishing, as is employee cyber-awareness. 377,000 attempts to steal money These attacks were often in the form of 'banking Trojans'. In early 2022 a particularly sophisticated money-stealing Trojan popped up that masquerades as a banking app and imitates phone conversations with bank employees. The app fooled many, highlighting the need to teach employees 'cyber hygiene' – like remembering to pause and think before downloading anything. Those who provide legitimate apps or financial services might also reflect on how they can show customers their products are trustworthy. These big numbers in cybersecurity over the past year show how threats to business are growing and changing. Cybercriminals always find new ways to get through consumers' and employees' defenses. By combining hiring the right people with robust cybersecurity education and strong security solutions, your business will greatly reduce its chances of a serious attack succeeding. Then, you can spend your time on what you do best.
behind screen heathrow airport

Why cybersecurity education is taking off at Heathrow Airport

  • min read
    • You might not think of cybersecurity first when it comes to airport safety, but Jasvinder Pham, Head of Cyber Development and Assurance and Matthew Bourne, Cyber Security Manager, believes it's at the heart of London Heathrow's safety practice. And education is their most important protective gear against cybercriminals that use psychological tricks, also known as social engineering, on their staff. In Tomorrow Unlocked's video Next Departure: Fighting Cybercrime, Pham and Bourne outline how they're helping Heathrow staff see through cybercriminals' mind games. What is social engineering? And Pham says it's a common tactic. "Nine out of ten breaches are done through social engineering. At Heathrow, we tend to get scattergun emails across the whole estate. We call that phishing. They'll ask a user to enter login and password details or click a link." Learning to recognize the mind tricks Where phishing emails are a scattergun approach, the Heathrow cybersecurity team responds with carefully targeted cybersecurity education. They use internal advertising to raise staff awareness of social engineering techniques, then send out their own phishing-style test emails to see who takes the bait. It's part of a wider cybersecurity education program based on identifying those who can benefit most from the learning. Bourne says, "We've turned training courses on their head by asking the questions first. If you answer them all correctly, you don't need the training. If you don't, you can sometimes complete training in less than 10 minutes." Bourne believes cybersecurity training should resemble real-world cyberthreat situations. "We've started using live actors to get a bigger impact and bring it to the context of the airport." Customers are ready for better security Pham says Heathrow wants to be on the cutting edge of security technology, but it's not always easy. "We want to stay one step ahead, but I feel like we're one step behind." But Pham believes one thing on their side is staff and customer readiness to embrace the latest security features. "People use services like WhatsApp and multi-factor authentication in their home. They want more, so we need to make sure we don't miss out."
picking right tech

When there’s too much choice in tech, get your focus right

  • min read
    • We have too much tech and too much choice. Many of tech's challenges are in choosing the product, and only afterward realizing its limitations and the consequences of our choice. I understood this only recently, after working in tech nearly 40 years. I don't know why it's taken me so long to make this brilliant deduction. I enjoy helping others make these choices. Almost every day, I'm either writing, researching or discussing tech choices for others. But just as the shoemaker's children go barefoot, my own tech choices are often fraught with indecision, or worse, no decision. It all rests on human foibles Yesterday, I was on a phone call with a friend who is as technical as they come. He helped create some of the internet's early protocols – ways transferring data between networks that more or less create the internet. We were commiserating about the quirkiness of the video conferencing application Webex when trying to support a hundred-person conference call. It's fine for the video conference itself. The video and audio quality are usually solid. But the 'soft support' rests on the foibles of how humans use tech, like holding a practice session for the conference, notifying everyone of the call and sending out the slide deck. It's real work to explain what to do to organizers and how to create standards to make the call go smoothly. Learn from the 1980s' portable PC wars Let's draw a dotted line back to when I worked in the bowels of the end-user IT support department of Gigantic Insurance in the early 1980s. We bought PCs by the truckload to place on the desks of thousands of IT staff who, until then, had a telephone and, if they were lucky, a mainframe terminal. We bought IBM PCs because back then because that was the only choice for corporate USA. Then Compaq came along with something IBM didn't yet have: a portable PC. Well, sort of portable. It was enormous. It weighed about 30 pounds (14 kilograms) and didn't quite fit into airplane overhead lockers. When Compaq announced their portable PC, selling for more than $5000, our executives felt conflicted. Our IBM sales reps, who had invested many years in golf games with them, were trying to convince us to wait for a year until the IBM portable PC would come to market. But once we got our hands on the IBM prototype, we could see the Compaq was superior. It was already available. It was lighter, smaller and ran the same apps. We recommended Compaq and started buying them in droves. That was the start of the 'clone wars' that unleashed a new era of technology choices on the corporate world. By the time IBM finally came out with their portable PC, Compaq had improved theirs again, so they kept ahead of IBM. It's why we get frustrated when we finally choose our technology and then live with the consequences. Knowing which questions to ask How does this apply to buying business cybersecurity products? Many of us are still looking at the wrong things when deciding what to buy, or don't know which questions to ask. Know what problem you want to solve, and you'll choose your tech differently. Here are some common examples. Have you picked an email encryption product or VPN based on something other than ease of use? Don't be surprised when your staff rebel against using them. Are you running regular phishing awareness programs and cybersecurity training across your business? Phishing is one of the most destructive attacks, and getting users to understand their behavior is risky is the best prevention. Have you recently tested your disaster recovery procedures to find out why your backups don't protect key data elements? Don't wait until you have a ransomware situation to find out you missed a collection of files. Spend the time now to find these and ensure they're well protected. Can you find out if your cloud storage is secure enough? Do you even know which clouds you're using? Do the hard work now rather than waiting for something bad to happen. Have you examined your whole software supply chain? It's easy to overlook a few spots and then suffer data loss, ransomware or denial of service attacks. You might find personal Github pages, or resellers running tools whose security you can't easily verify. The time to work this out is now. Going beyond the specs means taking a step back and throwing out assumptions. Before you start looking at solutions, do the hard work of understanding the problem you really need to solve. This article reflects the opinion of the author.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries