Alan Calder - The Cyber Security Handbook - Prepare for, Respond to and Recover from Cyber Attacks

We live in a world where technology and vast quantities of data play a considerable role in everyday life, personal and professional. For the foreseeable future (and perhaps beyond), their growth and prominence are showing no signs of slowing down, even if the technology in question will likely change in ways perhaps unimaginable today. Naturally, all this innovation brings huge opportunities and benefits to companies and individuals alike. However, these come at more than just a financial cost.

In the world as we know it, you can be attacked both physically and virtually. For todays organisations, which rely so heavily on technology particularly the Internet to do business, the latter is the far more threatening of the two. The cyber threat landscape is complex and constantly changing. For every vulnerability fixed, another pops up, ripe for exploitation. Worse, when a vulnerability is identified, a tool that can exploit it is often developed and used within hours faster than the time it normally takes for the vendor to release a patch, and certainly quicker than the time many organisations take to install that patch.

The fact that technology is involved gives attackers a huge advantage over the defenders not only can they attack anyone, anywhere, from the comfort of their home, they often have automated tools to identify their victims and their vulnerabilities for them. Moreover, from an attackers perspective, there is often a very good risk-to-reward ratio: for the victim, it can be hard enough to detect that the attack happened at all, never mind trace who was behind it. It is the very nature of the digital information that we are trying to protect that is easy to copy. In fact, stealing the information does not require removing it from its original location at all, meaning that the owner of that information may never realise that the theft happened.

Unfortunately for us, committing crimes over the Internet can also be very lucrative. Physical pickpocketing may earn a thief cash and credit cards (that will likely be blocked very quickly, and can probably only be used up to the contactless limit per transaction anyway), but digitally targeting someone gives them a chance to steal that persons identity and get credit cards issued in the victims name. Upscale that, and a criminal might think about targeting businesses that hold databases with thousands or even millions of credit card details and personal information about their owners. Whether they then directly use that information for themselves or sell it on the dark web (where you can buy virtually anything, from drugs and organs to hacking software and stolen credentials), the profits are certainly far greater than those of a physical crime conducted in the same timescale and with the same manpower.

Because virtually every organisation holds valuable information, often in huge quantities (even if you are a small business), everyone is a target. More often than not, organisations cannot do business if they lose access to that information making it one of their most important assets. At the same time, the fact that criminals can extract significant value from this information means that it is an asset to them too. There is good reason to refer to them as information assets by definition, someone else wants to get hold of them. Many a time, that someone is a business partner who will go through the proper channels but not everyone will take the legal route.

but even the simplest attack, if executed successfully, can wreak havoc if you are not prepared. Clearly, it is in your organisations best interests to protect itself. Although this might cost, it will certainly prove far cheaper than experiencing a breach and having to deal with the operational, financial and reputational damage that follows.

Yet, given the frequency of data breaches and cyber attacks in the press, many of them large-scale, you could be forgiven for thinking that it is impossible to defend your organisation against the predations of cyber attackers after all, if massive multinationals cannot stay secure, what hope is there for small businesses?