Businesses must prioritise prevention to lock out online threats

The Scottish Government has made a point of alerting Scottish businesses to the threat posed by cybercriminals. Back in February 2021, it published its “Cyber Resilient Scotland: Strategic Framework”, which was an update on its previous strategic framework. 

The foreword by MSP John Swinney, then the Cabinet Secretary for Education and Skills, pointed out that cyber resilience is “the very backbone to every public service, to every business and to every community in Scotland.”

Jai Aenugu, Founder and CEO of the Aberdeen-based, cyber security specialist, TechForce Cyber points out that some of the most successful ‘hacks’ of businesses, both large and small, are not at all sophisticated. These ‘hacks’, which cause very significant losses to businesses virtually on a daily basis, are basic. They can be prevented by the adoption of straightforward, sensible measures. 

“An example of one of the leading cyber-breaches is the email hack. It is really basic and involves very little more than some social engineering and possibly some very basic hacking,” Aenugu says.  

Although this is a basic ‘hack’ that can be readily defended against if businesses take the appropriate preventative measures, it continues to net criminals the equivalent of many hundreds of millions of pounds around the world. 

Aenugu points out that in last year’s FBI report on cybercrime, the FBI estimated that email attacks alone netted criminals in excess of $3 billion that year. This year’s figure is likely to be even higher.

CEO Jai Aenugu 

On top of this, in last year’s report, the FBI said that cyber attacks on businesses in the US had grown by between 40 and 50 per cent. The estimate is not precise because a lot of cybercrime and the associated losses, go unreported. 

“What happens in an email attack is that the criminals use any of several tactics for gaining access to someone in the organisation’s email,” he explains. 

“They may do this through a phishing attack or through social engineering, going through the organisation’s waste and so on. Then, once they are in the mail system they pick a target such as someone in the finance department. They change the system’s forwarding rules to have that person’s emails sent to an address operated by the hackers. 

“Then, from that email traffic, the bad actors identify a large customer that transacts regularly with the business. The person in the finance department stops seeing emails from that customer. The criminals contact the customer saying the business is having some issues with its current bank and the customer should stop payments until the matter is resolved. After a few days, the customer is provided with a new bank account.” 

“Of course, if the customer is diligent and aware, they may contact the business to check on the change of bank account, and the swindle will fail. But on many occasions, they take the change at face value and pay their invoices to the new bank account.

"This may go on for weeks or even months before the business wakes up to the fact that the customer appears to be in arrears. Only then does the business realise that it is in trouble and has lost money.”

Aenugu points out that even when the fraud is discovered the attackers sometimes simply shift the attack since they still control the company’s 
email system. 

“Strong passwords and two-factor authentication of users would block this kind of attack and save the UK and Scottish economies hundreds of millions if they were universally adopted,” he notes.

Aenugu explains there are various levels of bad actors. At the top of the food chain, as it were are those countries who sponsor cyber attacks or who turn a blind eye to externally directed cyber crime. These countries include Russia, and North Korea. 

“These bad actors are very highly skilled and go after very specific targets. The Scottish government is very aware of the dangers of potential attacks on the country’s infrastructure, but these attacks are few and far between. By way of comparison, low-skilled hacks on small to medium-sized businesses are very common and are increasing all the time,” he notes.

His company, TechForce Cyber, is now in its seventh year and specialises in helping businesses become aware of cyber vulnerabilities across their organisations. 

“No organisation can ever make itself one hundred percent secure and still continue to run effectively. But there is so much you can and should do to protect the company, its employees and customers,” he says. Businesses and even individuals can take the sting out of ransomware attacks, for example, by ensuring that they back up all their data and systems to the cloud or to a third-party disaster recovery site. 

Aenugu adds that while many businesses do, in fact, have a policy of carrying out data backups, it is very often the case that the policy is not supported by regular testing of the integrity of these backups. 

“What we see happening, again and again, is that when the business is actually subjected to a ransomware attack that locks up its systems, the backups either don’t work or have critical gaps in the data. It is important to point out that the vast majority of businesses of all sizes that lose access to their data, go out of business within six months,” he warns. 

He urges companies to reach out to specialist cyber security firms such as TechForce Cyber to have their systems audited. 

“We will sit down with the business and analyse what they have and where they are vulnerable. We’ll provide them with a roadmap of what they do to make their business more secure. 

“You can get a long way towards cyber resilience by taking sensible measures that will cost a tiny fraction of what the average business stands to lose if they are the subject of a serious hack,” he concludes. 

www.techforce.co.uk