Cybercriminals’ state-sponsored attacks on government agencies
India suffered more than US$15 billion due to cybercrime, cyber fraud, and identity theft in 2019 compared to the US$9.3 billion investment secured during the year.
What is gravely concerning is that while these are publicly affirmed numbers, the reality could be much worse, warned Cyble which has observed a significant uptick in cybercriminal activities, including a number of threat actors actively targeting the nation in the last 12 months.
The motives of cybercriminals range from state-sponsored attacks on government agencies to organized cybercriminals syphoning off confidential data or sensitive user information from businesses.
Here’s why Indian companies are turning into soft targets of cybercriminals, cautioned Cyble in a report on 17 Nov 2020.
• Volume matters: India has one of the top 10 highest Internet users in the world. From students to government officials, most individuals are using Z-generation apps whether it is for making digital payments, paying mortgages, online banking, purchasing groceries, etc.
• Inadequate regulatory framework: The data privacy and regulatory frameworks are significantly weaker and still in their infancy as compared with most other nations where laws are considerably matured and well in their implementation process. Presently, companies in India are not required to notify a breach by any mandate, thereby often leaving room for autonomy on the security measures around the data they are collecting. The impact of this is even magnified when the data pertains to personal information (PI) for a sizeable group of individuals.
• Virtually Nonexistent Security Contact: Companies that have been a victim of cybercrime almost always have one thing in common – they do not have a designated CISO in place. Interestingly, organizations often enlist the help of the existing internal IT professionals for managing enterprise security issues. However, these individuals may not possess the requisite experience for performing a risk assessment and implementing strategic measures to combat the threat. They may also be burdened with bandwidth issues alongside inexperience on the security domain.
• Poor Technical Measures: Factors such as the insufficient understanding of the need for an effective information security program coupled with inadequate attention towards a basic security hygiene have fostered malicious cyber activities.
“Most victims have a few common attributes such as a non-existent security awareness culture; Cloud Access Tokens that haven’t been changed for months and in some cases, for years; developers embedding credentials in their code repositories; and compromises due to phishing campaigns and credential stuffing,” said Cyble CEO Beenu Arora.
“Such lapses in the defense infrastructure are fueling the issues further,” he warned.
At an individual user lever, one of the most common security shortcomings is that of reusing the same login credentials and passwords across multiple sites or apps. This is one of the primary reasons for Credential stuffing. Considered one of the most common types of cyberattacks, Credential stuffing is the theft and misuse of login credentials, typically comprising usernames and email addresses and their corresponding passwords to gain unauthorized access to user accounts. Lately, credential stuffing has emerged as more prominent due to a rise in the number of high-profile breaches.
• Lack of Accountability: Recent incidents have highlighted that organizations are yet to take cybersecurity issues seriously and give it due importance as part of their corporate social responsibility. Upon analyzing several high-profile breaches, Cyble noted that the diversity of personal information collected by organizations after a breach is considerably distressing. Corporations need to take stock of the grim reality of the cybersecurity space and acknowledge that adequate disclosure is the right move towards establishing customer trust and confidence in the long run.
This brings us to the question of where the company is heading. Public reports have clearly stated that India is an attractive target for cybercriminals for a host of reasons ranging from motives of financial gain to geopolitical agendas. Here are five essential things Cyble recommends technology-based companies to consider.
• Appoint a CISO – Without a clear vision and accountability on protecting customers’ information and intellectual property, it would be a nightmare to manage the risks posed by the ever-evolving threat landscape.
• Implement a Basic Security Hygiene – The Australian Signal Directorate has released strategies to mitigate cybersecurity incidents. In Cyble’s opinion, The Essential Eight, when implemented and governed correctly, can help thwart the majority of the cyberattacks.
• Bolster Security Awareness Initiatives – Over 80% of cyberattacks originate via phishing and water-holing attacks. Organizations are increasingly using SSO to connect to their code repositories or third-party apps. Once a privileged account is compromised, the attacks can gain access to a large part of the company’s infrastructure, including customer records. Irrespective of how secure an enterprise’s IT security structure is, the company is only as protected as its user base. To improve awareness about phishing, organizations should conduct routine tests on the employees with fake phishing emails to educate them and help them learn how to recognize a real phishing attack.
• Implement multi-factor authentication where possible. Ensure access token and secret keys are changed and accounted for regularly. This builds an additional layer of security for protecting highly sensitive user-PI.
• Implement Robust Security Monitoring capabilities – As the landscape of an organization evolves, it is prudent to maintain situational awareness of the threats, risks, and vulnerabilities. #cybercrime #technologies #internet #online #economy #security #data /fiinews.com
