Posted on November 5, 2023March 22, 2024

Gone are the days of thieves chasing cash locked away in safes and bank account numbers stored on secure office servers. With the rise of powerful technologies like cloud services, e-mail, and online accounting software, our most valuable information has been scattered across platforms and services. While these tools have boosted our efficiency, they have unfortunately expanded our vulnerabilities and deteriorated our cyber safety.

The evolution of these digital tools has added complexity to the theft process, making it difficult to track and even more challenging to understand. You probably wouldn’t click on an article entitled “What Do Pickpockets Do Once They Steal Your Wallet?”. Yet, with cyber theft, understanding is crucial to being able to fight cybersecurity threats. 

So here, we’ll explore the mindset of a cybercriminal to shed light on their tactics and give you some valuable cybersecurity best practices you can implement to prevent cyber attacks.

What Do Cybercriminals Steal?

In order to prevent cyber attacks, first you need to understand what motivates criminals. While hackers are ultimately after money, many other valuable assets can simplify their path to financial gain, including:

Personal Identification Information (PII): Names, Social Security numbers, dates of birth, etc. These can be used for identity fraud, blackmail, doxxing, or uncovering answers to security questions on personal accounts.

Financial Information: Credit card numbers, bank account details, and investment account information. This data can be exploited for direct theft, unauthorized purchases, or sold on the dark web to other interested parties.

Login Credentials: Usernames and passwords. They offer a gateway into personal and business accounts, leading to data breaches, financial theft, or even business espionage. Once inside, cybercriminals can also impersonate the account holder.

Business Intellectual Property: Trade secrets, patents, business strategies, and proprietary software code. These can be sold to the highest bidder, held for ransom, or used by an untrustworthy competitor.

Employee Information: Employee IDs, tax details, payroll data, and other HR-related information. These can be used for identity fraud, impersonating staff members, and as a stepping stone to access more critical business data.

Government Secrets: Classified information, strategies, and sensitive communication. If you work as a government contractor, cybercriminals can target this info to sell to the highest bidder, hold it for ransom, or use it for foreign espionage purposes.   

How Do Hackers Gain Access?

Step two to prevent cyber attacks requires you to understand the different methods hackers use to find ways into your systems, including:

Phishing: Hackers send you e-mails that appear legitimate to get you to reveal login credentials. Typical phishing schemes include impersonating banks, tech support, or even people within your own organization. These will usually be urgent in nature and ask you to input or “change” passwords. 

Exploiting Weak Passwords: If employees use personal information, popular phrases, or easy number combinations in their passwords, hackers have the time and the experience to crack these in no time. 

Malware: Malicious software can be covertly installed on a user’s computer, allowing cybercriminals to access your systems. These attacks can come hidden within seemingly innocent downloads, email links, or from employees visiting suspect websites (adult content, torrents, free content, online gambling, etc.).

Software Vulnerabilities: When developers create software, they sometimes inadvertently introduce weaknesses or mistakes in their code. If you fail to install security updates that correct these, hackers can exploit them. They do so by writing code that allows them to execute their own commands, access restricted data, or give themselves privileges within a system.

What Do Cybercriminals Do Once They Have Access?

In the majority of cases, immediately after they’ve entered your systems, attackers do…nothing.

Yes. You read that right. Hackers do this because they know that making significant changes too early will draw unwanted attention. So, they often operate in the shadows, observing and gathering as much information about your organization as possible. In fact, studies from various firms suggest that the average time cyber attackers will sit in your systems is anywhere from 11 to 24 days before taking action. 

What happens next depends on the systems or information cyber attackers have accessed. So, to prevent cyber attacks, let’s explore this general outline of how they might proceed:

Monitoring Phase: Cybercriminals will closely watch your organization’s activities to identify key personnel, find out where sensitive data is stored, make minor security changes, or set up inbox rules that forward all your future e-mails. These help set the stage for more significant cyber incidents to come.

Social Engineering Attacks: Once they’ve settled in, attackers will use their new knowledge and control to launch sophisticated social engineering attacks aimed at or posing as key personnel. One popular example is posing as a CFO and asking a subordinate to purchase several gift cards for a supposed client rewards program. 

Changing Administrative Credentials: If they can make small changes, larger-scale modifications are likely coming. Hackers might lock out other high-level users, giving them sole control over whichever platform they have breached. This scenario poses a significant challenge for organizations, as regaining control without the proper credentials can be complex, often requiring external expert assistance.

Monetization Schemes: Finally, the hackers make moves to achieve their ultimate goal, profit. One popular method includes anticipating an upcoming payment from a client and then rerouting it to an account the hackers control. Or they may simply sell your stolen information on the dark web to the highest bidder. 

Blackmail or Reputational Damage: If the attackers have valuable data, they may also leverage the potential damage they could cause to your reputation and legal standing by holding your data for ransom. Many companies, fearing the repercussions, pay up. However, this doesn’t guarantee closure. Once the ransom is paid, hackers often still sell the data for further profit or leave themselves a backdoor exploit so they can return months or even years later. The results are costly. IBM’s 2022 Data Breach report revealed an average ransom payment of $812,360 and the average total cost of the fallout of an attack at a whopping $4.5 million.

Cybersecurity Tips to Prevent Cyber Attacks?

If you weren’t sure before, the previous figures should drive home the point. When it comes to cybersecurity, the stakes are high. Fortunately, fairly simple measures can greatly impact whether hackers gain access. Here are some cyber security basics for protecting key entry points from hackers:

Email Security: E-mails are a crucial aspect of your business to protect. They can give hackers insights into everything from organizational structure to pay schedules and personal habits. Keep them out with:

• Strong Passwords: Always use best practices when creating passwords, and consider using a password manager. 

• Geofencing: If your business operates only in specific regions, geofencing can block unauthorized access attempts from outside those regions.

• Multi-Factor Authentication (MFA): Require multiple forms of identity to make unauthorized access harder. MFA is a particularly crucial deterrent.

• Regular Training: Stay vigilant by ensuring staff are constantly reminded and updated on how to detect the latest phishing scams.

Application Security: Applications have become the lifeblood of modern businesses, but their power comes with many potential risks. Safeguard these platforms with these techniques and concepts:

• Zero Trust Model: Introduce this principle, which states that no entity, whether inside or outside the organization, should be implicitly trusted. Continuously validate user identities, scrutinize access requests, and ensure that every action is authorized and verified, no matter how trivial.

• Regular Permissions Audits: Periodically review app permissions. Over time, legacy permissions can accumulate and provide unnecessary access to users who no longer need them.

• Built-In Security Features: Use every built-in security option offered to your advantage. These should include MFA, conditional access, Microsoft 365’s identity protection feature, and alerts for suspicious activities. 

Internal Systems Security: Even though your internal systems aren’t exposed the same way third-party cloud apps are, they may be vulnerable in other ways, such as being extremely interconnected. Protecting this backbone is paramount, as these systems often house the most sensitive company data.

• Segmentation: Divide your network into segments, ensuring sensitive data isn’t accessible from every part of the network. This prevents a breach in one area from compromising the entirety.

• Regular Patching: Implement a system to ensure all software is updated promptly when patches are released. This will eliminate known vulnerabilities that hackers can exploit.

• Least Privilege Principle: Institute this principle that states employees only have access to the information they absolutely need. This minimizes exposure in the event their credentials are compromised.

• Backup Strategy: Maintain regular backups and ensure they are stored securely, both on-premises and in the cloud. Make sure to test your recovery procedures regularly.

Armed with this knowledge and these actionable steps, you should be well on your way to developing a vigilant strategy to prevent cyber attacks. If you have further questions about the trends we’re seeing in cyber security threats or need small business cybersecurity solutions, don’t hesitate to contact me at lenny@reliabletechnology.co.