Cyber security: What's important for your IT security

The importance of cyber security is increasing with the ever-growing threat of cyber attacks. In Germany alone, the number of companies targeted by a cyber attack was around 17.7 million in 2019 (published by Statista Research Department, 15.12.2022). In the Allianz Risk Barometer, the threat of cyber risks has also taken first place for several years. So there is no question that cyber security has become a massively important issue.

It is also important to understand that cyber attacks and technologies are constantly evolving. While basic concepts such as phishing, social engineering and the likes are perennial favorites, new “phishing scams” or targeted attacks that make use of technological advances, for example in artificial intelligence (AI), are constantly evolving. Vishing, deep fakes and phishing emails generated via ChatGPT are just the beginning.

In this article, we look at the basics of cyber security as well as important developments and focus topics.

Cyber Security, IT Security, or Information Security?

IT Security 

IT security protects digital information in technical systems, in other words "everything that has a plug". Typical protective measures include virus scanners, firewalls, backups, e-mail encryption or multi-factor authentication. All these technical measures are designed to ensure that sensitive information does not fall into the wrong hands (confidentiality) and that IT systems are available when they are needed (availability).

Information Security

IT security is a subset of information security because, unlike IT security, information security is concerned not only with digital information but with all types of information including physical information (e.g., prototypes or printed documents) as well as the "spoken word" (in meetings, telephone calls, etc.). Information security is also more of a comprehensive risk management: Sensitive information is identified, potential threats are determined, and then the appropriate protective measures are derived and written down in security policies. The implementation of these measures in the technical IT systems is the ensuing task of IT security.

Cyber Security

And cyber security? This is where it gets exciting. Cyber security is actually just a new word for IT security, but many people now equate it with information security, because a large proportion of attacks on information originate in cyberspace... and because it simply sounds much cooler. :-)

Attack Vectors in Cyber Security: People

Most of the attack vectors in cyber security mentioned below rely on humans as the gateway.

This is because even if a system is optimally protected (which it rarely is in practice), attackers can still penetrate systems by deliberately deceiving, manipulating or exploiting human vulnerabilities and spread ever further there by lateral movement.

That is why cyber security trainings and general awareness through security awareness campaigns are an elementary component of a security strategy.

Most Common Attack Vectors via People:

Malware: 

'Malicious software' is the generic term for all malware written by hackers to penetrate and damage and/or spy on other people's computers. 

Viruses: 

A virus is malware that can infect a computer system and make changes to it on its own. Computer viruses, like real viruses, can spread to other systems without the user's intervention and thus cause enormous damage very quickly. 

Trojan: 

A malware that disguises itself as useful software. When installed, the malware is secretly installed in the background. Most Trojans have a very broad set of hacking capabilities: they can steal or modify files, read messages and chats, turn on webcams and record all keyboard strokes to capture passwords, for example. Unlike viruses, Trojans do not replicate automatically. 

Ransomware: 

A made-up word from the English 'ransom' and software. This malware encrypts computer systems and then extorts a ransom from victims to obtain the key. Ransomware is currently the biggest threat to virtually all businesses, especially APT Ransomware attacks.

APT Ransomware:

A ransomware attack by highly professional criminals. They infect their victims with malware, then penetrate further into the network step by step until, within a few weeks, they have control over all of a company's important IT systems: Databases, backups, email systems, domain controllers. During this time, they steal data from these systems in parallel. When all important systems are under control, they encrypt them and ransom the company with sums in the millions. If they don't want to pay, the criminals additionally threaten to publish all captured data. 

Social Engineering: 

Social engineering is the generic term for manipulating and deceiving people in order to obtain confidential data and information. Attackers pretend to be someone they are not in order to trigger actions in their victims, such as entering passwords, opening an attachment, or transferring money to a specific account.

Phishing: 

Phishing is a made-up word from "password" and "fishing", i.e. "fishing for passwords". This refers to all the fake websites, e-mails, text messages or the like that criminals use to impersonate a specific person in order to obtain a victim's personal information. Phishing is therefore a variant of social engineering.

Vishing: 

Vishing is a further development of the made-up word phishing when it comes to telephone calls, i.e. "voice phishing". Here, too, the aim is to obtain confidential information, but this time via the telephone. 

Smishing: 

Smishing originates from "SMS phishing", i.e. phishing via SMS. So it's basically phishing, only that the communication channel is a text message instead of an email. Here, too, the victims end up on fake websites or triggered to install malware.

Most of the attack vectors in cyber security mentioned so far rely on people as the gateway. That is why cyber security training and general training through security awareness campaigns are an elementary component of a security strategy.

Attack Vectors in Cyber Security: Systems

Another attack vector in cyber security is attacks on IT systems, i.e. servers or applications, for example by hacking or exploiting zero-day vulnerabilities.

However, the widespread division into "attacks on people and systems" is misleading, since the systems are also developed and operated by people.

Our day-to-day experiences often show us:

• Systems that have vulnerabilities because they are not up to date (= patched).
• Administrators who use the same password for different systems
• Developers who do not check their software code for typical attacks like SQL injection
   

The exploited vulnerabilities in the systems are only rarely "unavoidable", such as when there is simply is no update (security patch) for a vulnerability yet. Much more frequently, hackers exploit vulnerabilities that could have been avoided, if developers and IT-Admins were more aware of security best practices.

Cyber security awareness is urgently needed in IT, perhaps even more urgently than for "normal users", because IT usually works with privileged rights and an attack can therefore cause significantly more damage than would be the case for a user with restricted rights.

Administrators and developers, however, require completely different content on the subject of cyber security. That is why there are two special training courses, Cyber LABs for Administrators and Cyber LABs for Developers, which address precisely these requirements and contents.

👉 Here you can find out more about the often forgotten target group of IT professionals.

IS-FOX Cyber Security Trainings

Our IS-FOX Cyber Security trainings have been developed by our in-house Cyber Security specialists. And this difference can be seen in the content. At least, that's what our customers say.

Our e-learning courses are suitable for small, medium and large companies and can be integrated into your own learning management system (LMS) or operated via our IS-FOX Cloud. Adapted to your company's guidelines and corporate design, of course.

Laws & Regulations in The Cyber Security Sector

The Cyber Resilience Act (CRA) - What's it all about?

Technical and digital products used or manufactured by companies and distributed to end customers are part of supply chains. These, in turn, are popular and frequent targets of various types of cyberattacks, as it is not uncommon to be able to harm multiple parties simultaneously and thus capture more. Imagine tampered or insecure chips that end up being built into company computers and cell phones ... pretty nasty outcome.

For these products, the draft requires that appropriate cyber security measures, appropriate to the risk involved, be implemented as early as the design, development, production phases and also during commissioning and use. A distinction is made here between so-called low-risk and high-risk categories. However, we are still in the implementation phase here. The success of the CRA depends not only on its specifications being practicable and implementable, but also on whether a company is aware of its vulnerabilities and has the appropriately trained personnel available - including the indispensable cyber security awareness.

Cyber security Trends of growing relevance to businesses

Social Engineering

People are clearly at the center of this ever-increasing, though not new, threat. As the interface between private and professional information, they often offer a direct route to a multitude of data. This presents companies with a huge challenge, because it is not only systems and devices that need to be up to date with the latest security standards, but also their employees.

Cybersecurity and Remote Work

The Covid 19 pandemic in particular has spurred a tremendous increase in remote working. Many businesses and households are challenged to bring their premises and equipment up to a cybersecurity level as quickly as possible to sufficiently protect them from internal and external attacks. As the trend of remote working continues, this protection must be provided not only in the short term, but also in the long term. This is often not so easy, especially when working from different locations with third-party Wi-Fi networks and the like.

A few tips:

Always keep your system and anti-virus scanner up to date and do not store any work-related information on private devices or networks. Also make sure you always lock your computer, lock sensitive documents in a filing cabinet and avoid theft of your devices and insecure public Wi-Fi networks when working remotely.

Infrastructures as a target of attack

As cyber criminals become more specialized and do not back down from virtual aggression, a stable and protected infrastructure is becoming increasingly important. This is not only the case in highly sensitive sectors such as medicine, healthcare and aviation security.

Politicians are largely aware of this and are working on new laws and regulations that companies must adhere to. In Germany, there is also the KRITIS umbrella law, which sets minimum requirements for critical infrastructure providers to make the overall system more resilient. For companies that want to have their information security certified, there is ISO 27001, for example.

Multi-Factor Authentication (MFA)

This is technology that companies can actively use to protect themselves and their employees, as it is currently considered the highest authentication standard. But even here, caution is advised: not all methods of MFA are equally secure. Program-based tools such as security keys and app-based variants have a higher level of protection than phone-based ones, as criminal actors can sneak in relatively quickly and easily here. This can have troublesome consequences, especially in online banking or cloud service sharing. Besides, a second factor also does not protect against social engineering or targeted phishing attacks. Here again, it is a matter of awareness among employees.

Rise of Phishing Attacks and New Phishing Verticals

Speaking of phishing: With an all-time high of around 300,000 attacks - in 2019 alone - phishing has become one of the most common forms of cyberattacks. So, it was only a matter of time before new variants would emerge here.

Smishing, for example, involves sending convincingly authentic-looking SMS and text messages from alleged postal services, for example, in order to trick potential victims into disclosing private information. Another new variant is vishing ('voice phishing'), in which automated telephone calls are made in an attempt to persuade the recipient to hand over access data, etc.

Even more perfidious: in spear phishing, cybercriminals even go so far as to enrich their email scam with publicly available information (e.g., from social media) in order to specifically target certain individuals for deception. This can even go as far as becoming a social engineering attack. The scams are on the rise, and so is the threat to all users.