Here’s a look at some of the biggest cybercrime trends in four different industries and how you can prepare for them.
1. Education
Last year, a few distinct patterns of attack contributed to the majority of data breaches in the education sector, according to the Verizon Data Breach Investigations Report. These vectors included social engineering, web application attacks, and human error.
In particular, social engineering attacks against educational institutions saw a big increase. The W-2 scam, for instance, hammered educational organizations with spoofed email requests to HR and payroll asking for the release of employee W-2 forms. The hackers using this technique aimed to use the information within those forms to steal identities and evade taxes.
Schools are particularly vulnerable to social engineering, because they’re forthcoming with information about their employees. Many institutions publish the full names and contact information of staff online, which makes reconnaissance activity for a clever phishing attack easy. The best way to avoid these attacks is to double down on training employees to detect suspicious emails.
While you’re at it, reinforce the need to keep software and digital textbooks up to date to avoid web application attacks targeting students. As schools adopt more tech for digital learning, the FBI has warned about the emerging data security risks. Education IT teams must take steps to mitigate those risks and limit what programs can run on students’ devices.
2. Healthcare
Healthcare is the only industry where employees are more likely to cause security incidents than hackers, according to DBIR data. Fifty-six percent of incidents last year were caused by internal actor error or data misuse, compared to 43 percent attributed to external actors. The second most common threat was malware, particularly ransomware, which accounts for 85 percent of malware attacks in healthcare.
Why are healthcare employees so likely to leak data? It probably isn’t malicious intent. These cybersecurity risks are more likely caused by the growing role of data in healthcare, alongside strict regulatory requirements, such as HIPAA and HITECH.
Privilege misuse, like “I’m just using Bob’s credentials to log into that database” or accidentally emailing a file to the wrong person, can have a particularly nasty impact on data security in healthcare. In addition to educating employees about the importance of adhering to compliance rules, you can put some safeguards in place that prevent data leakage, such as requiring authentication to collect sensitive print jobs.
3. Retail
If you can count on hackers to do anything, it’s to follow the money—and retail has a lot of moving money. Trends in retail business security threats confirm that threat actors are focused on taking down e-commerce websites, as well as skimming customer card data from brick-and-mortar retail stores.
DBIR data shows that 75 percent of all attacks against retail organizations follow three dominant vectors:
- Distributed denial-of-service, or DDoS, attacks
- Payment card skimming
- Web application attacks
As more retailers go digital, the threat vectors targeting websites are worth noting. DDoS threats can take a costly toll on e-commerce profits. Meanwhile, input validation weaknesses, like OS commanding and SQLI, are frequently used as web application attacks that allow hackers to steal customer payment card data in real time. DDoS mitigation plans and web application safeguards aren’t optional for retailers with a web presence.
Additionally, the old-fashioned point-of-sale skimmer is alive and well. IT professionals in retail must take steps to ensure endpoint security across all devices is locked down in each store location.
4. Finance
It probably doesn’t come as a surprise that a large proportion of profit-motivated hackers are continuing to target the financial sector. Last year, organizations in finance and banking faced nearly 40,000 distinct examples of Trojan botnets. This is a worrisome trend, especially considering that DDoS attacks have also grown dramatically in size and frequency in recent months. There’s a clear need for web application specialists in finance to plan for and prevent these attacks.
Banks also face physical tampering risks, such as payment card skimmers installed on ATMs. Recently, a new threat called ATM jackpotting has used malware and specialized electronics to cause ATMs to uncontrollably spit money at a hacker. Even as you work to protect against sophisticated digital attacks, don’t forget to protect your easily overlooked endpoints, as well.
0 comments:
Post a Comment