How do cyberattacks work and how can you prevent them?
News reports increasingly feature businesses that have been hacked*, had data stolen or had their operations brought to a standstill by ransomware. The existence of these risks is clear, but what are cybercriminals trying to achieve and how do they do it? More importantly, how can you use this knowledge to avoid becoming their next victim?
“All the software we use consists of tens of thousands of lines of code. These inevitably contain dozens, or perhaps hundreds, of errors. Hackers use automated scripts to find and exploit these vulnerabilities.”
Jan Jaarsma, founder of SBL Cyber Monitoring
How do cybercriminals carry out a cyberattack?
The days when hackers attacked companies for ideological reasons, excitement or recognition of their hacking skills are largely over. Today, the ultimate objective is usually financial gain.
Hackers are no longer necessarily individuals working alone from an attic while wearing a hoodie. In some cases, we are dealing with organised groups that operate cybercrime as a business and are based in countries where prosecution is difficult.
Their business models involve different activities that often pursue the same objective:
- Stealing valuable data to sell it. This may include personal information or login credentials that can be used to attack other organisations.
- Stealing sensitive data and threatening to publish it unless a ransom is paid.
- Deploying ransomware and only restoring access to the IT or operational environment after a ransom has been paid.
- Sending fraudulent invoices.
- Conducting espionage on behalf of other organisations to steal trade secrets or technologies.
Cybercriminals continuously attempt to gain access to corporate IT environments. They use automated scripts to scan internet-facing servers for known vulnerabilities. For example, if a vulnerability is discovered in Apache server software, attackers can use automated tools to search the internet for vulnerable systems.
Once access has been gained, attackers may download data stored on the server. This can include sensitive information such as payroll records or lists of email addresses.
Another method is to use stolen credentials to access systems such as Microsoft 365. Many people reuse the same password across different services. When credentials are stolen from one online platform, cybercriminals test them against other important systems. They then try to move as widely as possible through the IT network. When ransomware is eventually deployed, they may also attempt to block access to backups.
How do phishing and CEO fraud work?
Phishing emails are among the best-known methods used to gain access to IT systems. The recipient is encouraged to open a malicious attachment or visit a fraudulent website, which may result in malware or ransomware being installed on the device.
Security solutions such as Microsoft Defender can detect and block many of these attacks. However, phishing techniques and malicious files continuously change, which means some attacks may evade existing security controls.
Smaller-scale scams are often similar to phishing attacks. Examples include fraudulent emails that appear to come from a CEO or supplier. The sender’s email address or the wording of the message may reveal that it is fraudulent, but recipients must remain alert. Attacks in which criminals impersonate senior executives are commonly referred to as CEO fraud or business email compromise.
Some criminals develop software that automatically scans servers for known vulnerabilities and missing security updates. They then sell these tools or services to other criminal organisations. Some ransomware groups operate so professionally that they even provide support to victims during cryptocurrency ransom payments.
The potential consequences include reputational damage, financial losses caused by production downtime and the theft of technologies or trade secrets.
How can you prevent a cyberattack?
It is impossible to protect an IT environment against every possible threat. Cybercriminals monitor newly discovered vulnerabilities and use automated tools to scan organisations from the outside.
Although you cannot eliminate every risk, you can make it considerably more difficult for attackers to gain access:
- Keep your IT environment as simple as possible. The fewer connections an organisation has to the outside world, the fewer potential entry points attackers can exploit. One SBL customer, for example, primarily uses a firewall and a VPN connection. The VPN is frequently targeted, but defending one external connection is easier than defending ten. Keep your IT and production environments as simple as possible and avoid unnecessary external connections.
- Keep systems up to date. Cybercriminals frequently gain access through known software vulnerabilities. Install security updates promptly, as these updates often contain fixes for recently discovered vulnerabilities.
- Use multi-factor authentication. Cybercriminals can buy or obtain databases containing stolen credentials. Because many people reuse passwords, attackers may have the correct email address and password. SBL regularly sees sign-in attempts that are stopped by multi-factor authentication. Entering an additional verification code or using an authentication app requires an extra step, but significantly reduces the risk of account compromise.
- Improve employee awareness: people can be your strongest line of defence. It is impossible to prevent every phishing email from reaching an inbox, but employees can learn how to recognise and handle suspicious messages. This includes checking the sender’s email address, links, attachments and unusual requests.
“The most common alerts we see at SBL Cyber Monitoring are related to systems that have not been updated on time. Many of these cyber risks can therefore be prevented.”
Jan Jaarsma, founder of SBL Cyber Monitoring
Protect your business against cyberattacks
Cyber risks are a growing concern for businesses, while cybercriminals are using increasingly sophisticated methods to gain access to sensitive information. Although it is impossible to protect an IT or operational environment against every threat, organisations can take effective measures to reduce the likelihood and impact of a successful attack.
Simplifying the IT infrastructure, installing security updates promptly, implementing multi-factor authentication and improving employee awareness are essential steps towards strengthening an organisation’s protection against cyberattacks.
Would you like an external specialist to assess your organisation’s cyber resilience? Our experts can work with you and your team to conduct an assessment and discuss security measures tailored to your organisation.
* A hacker is someone with advanced computer skills who can manipulate systems. These skills can be used for legitimate purposes, as with ethical hackers, or for criminal activities. Although “cybercriminal” is the more precise term for someone carrying out illegal activities, this article occasionally uses both terms. This reflects common usage, in which hacking is often associated with cybercrime despite the broader meaning of the word.
