For many, Black Friday 2021 marks the official start to the Christmas shopping season and, excitingly, many retailers announce time-limited sales that promise huge savings to consumers. But it’s also the prime time for cyber criminals to cash in, too.

Some digital threats to watch out for on Black Friday 2021

Phishing attacks

While consumers rush to grab themselves a bargain, they may get caught out in a phishing scandal. Phishing links commonly lead to fake login pages, prompting victims to authenticate themselves on their web account. For instance, victims may think they are logging into their favourite retailer account, when, really, they are handing their username and password over to an attacker, who can use it to their advantage later. Although this affects users directly, it also negatively impacts the retailer’s reputation, which can be difficult to recover.

Malware  

Malware (as the portmanteau suggests) refers to any malicious software designed to harm a computer system by tracking user activity, hijacking functionality or stealing, deleting or encrypting data. Most malware enters your systems via email (96% of it in 2020, say CSO). According to research by Deep Instinct, malware saw a year-on-year increase of 358% in 2020. There’s no indication of that proliferation slowing, so this should be seen as a high-risk Black Friday cyber threat.

Formjacking

Formjacking is a form of ‘Magecart’ where malicious code is injected into the checkout forms of a website and can go undetected for a long time. Cyber criminals then hijack web forms to steal personal and payment information from shoppers.

Ransomware  

Ransomware encrypts files, so they are made inaccessible to the owner. The cyber criminal then demands a ransom payment in return for releasing the locked files. Ransomware occurs when legitimate ads are hacked (‘malvertising’), or through phishing emails and exploit kits. This will have consequential impact on consumers and retailers/businesses.

Not being prepared enough for cyber threats is a threat

A staggering 3 in 4 IT leaders expressed a lack of confidence in their company’s IT security posture and saw room for improvement. Despite this, just 57% of companies conducted a data security risk assessment in 2020 and businesses need to up their cyber security efforts to reduce these risks and minimise the impact of an attack.

How can you reduce the risk of cyber threats on Black Friday 2021? 

The above attacks take place daily and are not specific to the holiday season or large events like Black Friday, but the volume and frequency of these attacks significantly increase during these times, as more consumers make purchases online.

Being aware of these threats is a step closer to preventing cyber attacks on Black Friday 2021 and during the holiday season to come. Businesses should balance their investments in security awareness training for employees and putting robust security measures in place that can help to scan their systems for suspicious activity. Similarly, consumers need to be better educated and made aware of potential threats.

If you find yourself the victim of a cyber incident, ESA Risk can help you with your response to the attack and to make you cyber-secure in the future, through the design and execution of a strong cyber security plan. Reach out to us at advice@esarisk.com, on +44 (0)343 515 8686 or via our contact form to find out more.

 

Download: ESA Risk Special Report: The Cyber Threat Landscape 2022

However, increases in organisational mobility typically result in a higher number of mobile devices that are accessing your systems from a remote location. For your cyber security teams, this means a growing variety of endpoints and threats they need to secure to protect your organisation from a data breach.

Mobile malware has long been a common problem. As a result, businesses and individuals are usually aware of the potential threat and how to deal with it. However, as Verizon’s Mobile Security Index Report shows, new threats are constantly appearing and organisations need to consider these, as well, in order to ensure they’re protected.

Below are the most common and critical mobile security threats that organisations currently face.

4 different types of mobile phone security threats

Mobile phone security threats are commonly thought of as a single, all-encompassing threat. But, the truth is, there are 4 different types of threat that organisations need to take steps to protect themselves from:

Mobile application security threats

Application-based threats are present when people download apps that look legitimate but skim data from their device. Examples are spyware and malware that steal personal and business information without people realising it’s happening.

Web-based mobile security threats

Web-based threats are subtle and tend to go unnoticed. They happen when people visit affected sites that appear to be fine on the face of it, but automatically download malicious content onto devices.

Mobile network security threats

Network-based threats are especially common and risky because cyber criminals can steal unencrypted data while people use public Wi-Fi networks in places such as transport hubs and cafes.

Mobile device security threats

Physical threats to mobile phone security and other mobile devices most commonly refer to the loss or theft of a device. Because hackers have direct access to the hardware where private data is stored, this threat is especially dangerous to enterprises.

Mobile cyber security threat examples

Below are the most common examples of these threats, as well as steps organisations can take to protect themselves from them.

Social engineering

Social engineering attacks are when bad actors send fake emails (phishing attacks) or text messages (smishing attacks) to your employees in an effort to trick them into handing over private information like their passwords or downloading malware onto their devices. The best defence for phishing and other social engineering attacks is to teach employees how to spot phishing emails and SMS messages that look suspicious and avoid falling prey to them altogether.

Reducing the number of people who have access to sensitive data or systems can also help protect your organisation against social engineering attacks because it reduces the number of access points attackers have to gain access to critical systems or information.

Data leakage via malicious apps

Enterprises face a far greater threat from the millions of generally available apps on their employees’ devices than from mobile malware, because 85% of mobile apps today are largely unsecured.

Hackers can easily find an unprotected mobile app and use that to design larger attacks or steal data, digital wallets, backend details and other information directly from the app.

For example, when your employees visit Google Play or the App Store to download apps that look innocent enough, the apps ask for a list of permissions before people are allowed to download them. These permissions generally require access to files or folders on the mobile device, and most people just glance at the list of permissions and agree without reviewing them in detail.

However, this lack of scrutiny can leave devices and enterprises vulnerable. Even if the app works the way it’s supposed to, it still has the potential to mine corporate data and send it to a third party, such as a competitor, and expose sensitive product or business information.

The best way to protect your organisation against data leakage through malicious or unsecured applications is by using mobile application management (MAM) tools. These tools allow IT admins to manage corporate apps (wipe or control access permissions) on their employees’ devices without disrupting employees’ personal apps or data.

Unsecured public Wi-Fi

Public Wi-Fi networks are generally less secure than private networks because there’s no way to know who set the network up, how (or if) it’s secured with encryption, or who is currently accessing the network or monitoring it.

As more companies offer remote work options, the increasing number of public Wi-Fi networks your employees use to access your servers (e.g. from coffee shops or cafes) could present a risk to your organisation. Cyber criminals often set up Wi-Fi networks that look authentic (by ‘cloning’ them), but are actually a front to capture data that passes through their system (a ‘man in the middle’ attack).

The best way for you to protect your organisation against threats over public Wi-Fi networks is by requiring employees to use a VPN to access company systems or files. This will ensure that their session stays private and secure, even if they use a public network to access your systems.

End-to-end encryption gaps

An encryption gap is like a water pipe with a hole in it. While the point where the water enters the pipe (your users’ mobile devices) and the point where the water exits the pipe (your systems) might be secure, the hole in the middle lets bad actors access the water flow in between. Unencrypted public Wi-Fi networks are one of the most common examples of an encryption gap (and it’s why they’re a huge risk to organisations). Since the network isn’t secured, it leaves an opening in the connection for cyber criminals to access the information your employees are sharing between their devices and your systems.

However, Wi-Fi networks aren’t the only thing that pose a threat – any application or service that’s unencrypted could potentially provide cyber criminals with access to sensitive company information. For example, any unencrypted mobile messaging apps your employees use to discuss work information could present an access point for a bad actor.

For any sensitive work information, end-to-end encryption is a must. This includes ensuring any service providers you work with encrypt their services to prevent unauthorised access, as well as ensuring your users’ devices and your systems are encrypted, as well.

Internet of Things (IoT) devices

The types of digital device that access your organisation’s systems are branching out from laptops, mobile phones and tablets to include wearable tech (like the Apple Watch) and physical devices (like Google Home or Amazon’s Alexa). And since many of the latest IoT mobile devices have IP addresses, it means bad actors can use them to gain access to your organisation’s network over the internet, if those devices are connected to your systems.

Spyware

Spyware is used to survey or collect data and is most commonly installed on a mobile device when users click on a malicious advertisement or through scams that trick users into downloading it unintentionally. Whether your employees have an iOS or Android device, their devices are targets ripe for data mining with spyware, which could include your private corporate data, if that device is connected to your systems.

Dedicated mobile security apps can help your employees detect and eliminate spyware that might be installed on their devices and be used to access company data. Ensuring your employees keep their device operating systems (and applications) up to date also helps ensure that their devices and your data are protected against the latest spyware threats.

Poor password habits

The 20 most common passwords in 2020, according to NordPass.

Position	Password	Time to crack	Times exposed
1	123456	Less than a second	23,597,311
2	123456789	Less than a second	7,870,694
3	picture1 (new entry on 2020’s list)	3 hours	11,190
4	password	Less than a second	3,759,315
5	12345678	Less than a second	2,944,615
6	111111	Less than a second	3,124,368
7	123123	Less than a second	2,238,694
8	12345	Less than a second	2,389,787
9	1234567890	Less than a second	2,264,884
10	senha (new entry)	10 seconds	8,213
11	1234567	Less than a second	2,516,606
12	qwerty	Less than a second	3,946,737
13	abc123	Less than a second	2,877,689
14	Million 2 (new entry)	3 hours	162,609
15	000000	Less than a second	1,959,780
16	1234	Less than a second	1,296,186
17	iloveyou	Less than a second	1,645,337
18	aaron431 (new entry)	3 hours	30,576
19	password1	Less than a second	2,418,984
20	qqww1122 (new entry)	52 minutes	122,481

There’s not much more to say on this topic. These bad password habits present a threat to organisations whose employees use their personal devices to access company systems. Since both personal and work accounts are often accessible from the same device with the same password, it simplifies the work a bad actor has to do in order to breach your systems.

If you use any of the passwords in this list, I strongly suggest you change them now.

Lost or stolen mobile devices

Lost and stolen devices aren’t a new threat for organisations. But with more people working from home or in public places like cafes or coffee shops and accessing your systems with a wider range of devices, lost and stolen devices pose a growing risk. First and foremost, you’ll want to ensure employees know what steps to take if they lose their device. Since most devices come with remote access to delete or transfer information, that should include asking employees to make sure those services are activated.

Out-of-date operating systems

Like other operating systems, mobile security requires continuous work to find and patch vulnerabilities that bad actors use to gain unauthorised access to your systems and data. Companies like Apple and Google address a lot of these vulnerabilities with operating system updates, so updating/patching is critical.

Cyber security support from ESA Risk

For advice and support to secure your business against cyber threats – including mobile phone security – look no further than ESA Risk. From staff training to software and process recommendations, we’ll work with you to meet your cyber security needs.

Contact us at advice@esarisk.com, on +44 (0)343 515 8686 or via our contact form.

With increased cyber crime comes higher demands and stakes, meaning there is more need for cyber insurance. Not only has the ask of ransoms skyrocketed, but the average ransomware payment has also increased by over 40% and reached over £150,000.

A ransom of this size could easily push some small and medium-sized businesses to the brink of insolvency or lead to a halt of operations that they simply cannot afford. Therefore, many businesses are turning to cyber insurance for protection against cyber risk.

Cyber insurance is typically meant for businesses that depend heavily on their IT systems to be functional 24/7. Today, that covers almost all businesses, especially healthcare, critical infrastructure, municipalities, manufacturing, and transport and logistics industries. However, some companies that purchase a full-coverage plan start to let down their guard and may simply pay out a ransom because they know the insurance company will later cover it.

The original purpose of cyber insurance was to cover the extortion losses of a business in the event of a successful ransomware attack, if the business had no other option but to pay the ransom demand for business continuity or to mitigate future losses. But a growing lack of vigilance and responsibility from some insured companies is tilting the balance of the cyber insurance market, forcing insurance companies to raise the premium price and adjust the underwriting standards to lower their own risks of loss.

The average global cyber insurance premium rate has increased by 32% year-on-year. Additionally, the insurers now require third-party IT companies to conduct a field examination on the insured company’s cyber security protocols to see if they reach a set standard. The checking process used to be mainly conducted via a self-assessment sheet; now, if the company doesn’t meet the standards, the vendor the insurers hire will tell the applicant company what they need to add, and the insurer won’t sign the contract until everything is in place.

Smaller enterprises are now faced with a dilemma: on 1 side there is the risk of rapidly growing malicious attacks, on the other side is the expensive premium packages with complex prerequisites and clauses that might not necessarily cover all their losses. If this vicious cycle continues, the only beneficiary will be the criminals.

What companies should know about cyber insurance

Every company owner should be aware of what they are looking for when it comes to cyber insurance. They should always read the fine print and understand the specifics of coverage, deductibles and exclusions. This safety net can be highly effective if the policy is correctly written, and the business is fully aware of its coverage and its likelihood of facing cyber risk.

Cyber insurance typically doesn’t cover 3 types of losses: potential future lost profits, loss of value due to the theft of intellectual property, and betterment (i.e., the cost to improve internal technology systems after the attack, such as IT upgrades after a cyber event). That said, losses other than the initial ransom are not likely to be covered by insurance.

Today, most ransomware attacks do not stop at the initial breach. Take the SolarWinds incident as an example. Instead of locking SolarWind’s IT systems, attackers planted malicious code into the company’s Orion technology platform, which is used by more than 30,000 customers, including the U.S. Department of Energy, Department of Homeland Security, and other national agencies. In this case, hackers didn’t even ask for a high amount of ransom, but the damage and potential vulnerabilities this attack caused is immeasurable and cannot possibly be covered by insurance.

Ransomware insurance alone is not enough. A well-written policy should also cover data breach liability, regulatory compliance, and other cyber risk-related threats. There are also firms that specialise in cyber insurance and understand the risks related to specific organisations. The simplest way for business owners to find an insurance plan that best fits their company is to start with the current business liability insurance provider and ask if they have experts who deal with cyber insurance.

Lastly, business owners should never let their guard down. Putting an employee cyber security training programme in place and implementing robust cyber security tools and processes should always be the priority, as this helps to mitigate the risks from the root. Conduct regular IT checks and system updates to ensure all patches are implemented, eliminating backdoors for attackers. Training, education and awareness are absolutely vital.

Conclusion

With the ever-changing cyber attack landscape, businesses should be extra cautious. While cyber insurance can be a smart move, businesses should also learn to utilise other tools to protect themselves, including a robust training regime and a fit-for-purpose policy that meets the company’s situation.

If you require advice on cyber risk or would like to know more about cyber insurance, contact us at advice@esarisk.com, on +44 (0)343 515 8686 or via our contact form.