Hackers are ahead in the cyberwar – businesses need to wake up
Hackers are winning the cyberwar and businesses are all too often simply hoping for the best, according to many security experts. Among them is professor John Walker, who lectures in cyber security at Nottingham Trent University and has advised the House of Lords on the issue. He says the government, police and business community are far behind in the battle to thwart hackers and that “cybercrime as a service” (Caas) is big business. His message for businesses is stark: “Assume you’ve been hacked,” he says. “There are people that have been and know it and people who think they haven’t, but have.”
Figures for the cost of hacking to businesses vary from survey to survey. A 2013 National Audit Office report suggested the cost of cybercrime to the UK was between £18-27bn, though this has been disputed. But Walker says that cybercrime is often under-reported, both by the media and the police, as businesses fear a loss of reputation and credibility.
He also alleges that some financial institutions have been compromised and have lost millions, but have kept this information under wraps. “In the past 10 years there has been at least one UK-based building society, which no longer exists, which lost about £50m to what was called a ghost transaction.
“In another case, a UK bank with international connections lost another £50m to an unknown source,” he says. “When it comes to losing client data, there are multiple organisations which have lost unencrypted information assets relating to client accounts, which have never been made public or reported, providing rich pickings for the cyber criminals to further leverage and exploit to their end gain.”
Andy Crocker is the founder of cybersecurity firm Protect 2020 and was previously a senior police investigator in the National Hi-Tech Crime Unit. Crocker spent five years pursuing cybercriminals in Russia and helped to convict organised crime gangs there. He says the intention of such criminals is primarily profit, and that SMEs are often targeted as they are regarded as a softer target than their bigger partners.
“They are constantly looking for IP which they can copy and flood the market with. If you were doing that, would you go for BMW, or would you go for easy targets? You can put malware on a system for three, four years before it gets detected, so a small business that might become a big businesses is a potential target.”
Crocker says that, increasingly, hackers access a company’s network via its staff. He says techniques such as “spear-phishing” and “water-holing” have been used to compromise the most advanced and highly technical businesses. In each of these, human error is key to the hackers’ success. “If you go on LinkedIn, you can find the email addresses of entire companies. A spear phisher will send an email to an employee posing as a colleague. This email will contain a Trojan [a programme containing malicious code], the receiver will open it believing it to be safe and then the entire system will be compromised,” he says. “Businesses have advanced firewalls which are difficult for hackers to get through. So why go through the front door, when an employee can let you in the back?”
With water-holing, malware is placed on low security websites, such as a chat forum. It then enters a computer via a weak spot such as an out of date browser. If this computer then connects to a company network, it can spread freely. “A lot of computer coders use these sites and ask each other questions, so they are targeted by the hackers who want to get into these companies. They put malware on there, which looks for the easiest entry point.”
But perhaps the biggest threat to businesses is when staff use their own mobiles and laptops for work with “bring your own device” (BYOD) policies. “After Christmas is the best time for a hacker as there are all these new tablets and mobiles, and many of the apps are designed and created by criminals,” he says. “Businesses need to have policies which state what is and is not allowed.”
However, Walker goes further, saying BYOD should be avoided altogether. “BYOD is one of the biggest things that has played into the hands of criminals for years. I’ve been at the coalface and I have seen how companies just lose control of their data.”
The government has a number of initiatives underway to stem the tide of cybercrime, which it recognises is both an economic problem and a national security issue. The website Cyberstreetwise provides information on how to avoid being hacked. It also has links to anti-virus software – a must for all companies, regardless of size.
Read more – http://www.theguardian.com/small-business-network/2015/mar/24/hackers-cyberwar-businesses-cybercrime