Cyber threats - an introduction

Cyber-criminals may access your business’s data to:

• sell it to the highest bidder (or use it themselves)
• hold your business to ransom by preventing you from accessing your own data
• threaten to damage your technology
• threaten the business’s reputation by releasing sensitive commercial information.
• Cyber threats come from diverse sources including criminals, past or present clients, competitors, or current and former employees.
• Cyber-criminals look for access to information relating to your business, employees, and/or customers. Cyber-criminals will attack where they are likely to make money and will do whatever works.

Popular methods of attack cyber-criminals use include:

• theft or unauthorised access of hardware, computers, and mobile devices
• infecting computers with malware (such as viruses, ransomware, and spyware)
• attacking your technology or website
• attacking third party systems such as suppliers connected to your system
• spamming you with emails containing malware
• accessing your information through your employees or customers.

As well as attacks that exploit ineffective (or missing) technology, cyber-criminals might take advantage of other weaknesses in your cyber security preparations. Some cyber threats target weak processes or careless or naive employees or suppliers. Often the weakest link is not the technology but is instead the people and the processes they follow in using the technology.

Examples of cyber-attacks

Different types of cyber threats

Targeted threats

A targeted cyber threat aims at a specific, identifiable business. Traditionally, a targeted cyber threat is a direct attack on the business with the aim of obtaining immediate access to its systems. For example, a cyber-attack might start by scanning a particular business’s firewall to identify gaps in cyber defences and then install malicious software to compromise its information.

A Denial of Service attack might work in a comparable way but with the goal of disabling a specific business’s computers.

These attacks are tailored for a specific business and are based on technological weaknesses.

Targeted threats can also exploit mistakes made by people. Examples include a spear-phishing attack that might use scam emails tailored personally to the people that work in an organisation. Such emails might be sent to, for example, a finance officer and pretend to be from a major supplier. These emails aim to trick the finance officer into changing the banking details for future payments. In this way the cyber-criminal circumvents the technological barriers in place, but the effect is the same.

Another important category of targeted cyber-attacks are those businesses that are on a ‘sucker list’. When a ransomware attack is successful – for a cyber-criminal this means that the ransom was paid – the details of the company that paid the ransom may be circulated widely on the dark web. The victim becomes known as a target that pays up.

Untargeted threats

Many victims of cyber-crime are not targeted but rather are victims of opportunistic attacks. Malware, viruses, worms, trojans and phishing attacks are common approaches. In the case of a phishing attack, it is easy for someone receiving many emails during the day - or in an inattentive moment - to accidentally click on a malicious link. These attacks can be avoided with a little thought, but this requires positive acts by end users. Mistakes are easily made if the end user is under pressure and is not aware of the ‘red flags’ showing they are under attack.

This means that employees need to be aware of the potential for ‘scattergun’ phishing attacks, and to always be sure of any link before clicking. Developing a ‘don’t just click on that’ culture where employees are suspicious of emails from unknown senders is an important way of ensuring that cyber-attacks are unsuccessful.

Downloading software from unconfirmed developers and websites should similarly be avoided. Even though anti-virus software may be in place, it is best not to test its effectiveness on potential new threats if it can be avoided.

Unfortunately, users are not particularly good at correctly identifying phishing emails. Participants in a 2022 experiment correctly identified phishing attacks only 42 per cent of cases – but identified genuine emails as phishing attacks 31 per cent of the time.

Similarly, very few users looked to confirm that a URL in an email was valid even when they knew they could simply hover their mouse pointer over a suspicious link without fear of consequences.

Organisations should support end users by ensuring that all emails received are filtered for spam and that effective policies regarding the responsible use of email and internet are in place and enforced.

A key business objective should be to make it as difficult as possible for the cyber-attack to succeed, and as easy as possible to recover if it happens. Technological solutions are not enough on their own. Effective cyber security requires well-trained and engaged people across the business that securely use technologies to access the business’s data. At the centre of effective cyber security is the protection of business data.