Cyber Crime Costs Britain $27 Billion
The British government says the cost of cybercime to the national economy, currenty estimated at £27bn, is already significant and is likely to continue growing. A new UK Cabinet Office Study reveals that the average annual cost to organisations of cybercrime has been escalatinging for all types of cyberattacks. A single malware attack that take place in 2018 cost more than $2.6 million, while ransomware costs rose the most between 2017–2018, from $533,000 to $646,000 (a 21% increase).
The ease of access to and relative anonymity provided by information and communications technology (ICT) lowers the risk of being caught, while making crimes straightforward to conduct.
The impact of cybercrime does not fall equally across industry sectors. The results also challenge the conventional wisdom that cybercrime is solely a matter of concern for the Government and critical national infrastructure, suggesting that much larger sectors of industry are at risk.
Businesses need to look again at their defences to determine whether their information is indeed well protected. Without urgent measures to prevent the losing controlof valuable intellectual property the cost of cybercrime is likely to rise even further in the future as UK businesses increase their reliance on ICT.
Encouraging companies in all sectors to make investments in improved cyber security, based on improved risk assessments, is likely to considerably reduce the economic impact of cybercrime on the UK.
Although the existence of cybercrime in the UK economy appears endemic, efforts to tackle it seems to be more tactical than strategic. The problem is compounded by the lack of a clear reporting mechanism and the perception that, even if crimes were reported, little can be done. Additional efforts by the Government and businesses to build awareness, share insights and measure cybercrime would allow responses to be targeted more effectively.
- Scareware–cybercriminals mislead individuals into downloading software onto their computer, for example, fake anti-virus software, by using fear tactics or other unethical marketing practices. The software downloaded is often ineffective or may appear to deal with certain types of virus before infecting the computer with its own viruses. Individuals may then have to pay the cyber criminals to remove the viruses and their impacts.
- Fiscal fraud–cybercriminals can withhold taxes due or make fraudulent claims for benefits by attacking official online channels (such as online self-assessment forms). The loss of tax revenue directly affects public- sector spending and the Government’s ability to invest in UK infrastructure.
- Theft from business–cybercriminals steal revenue online directly from businesses, which usually involves fraudulently obtaining access and looting company accounts and monetary reserves. In some instances, this cybercriminal activity is greatly assisted by an ‘insider’.
- Extortion–cybercriminals hold a company to ransom often through deliberate denial of service(for example, by using malware to flood a company server with erroneous internet traffic) or by manipulating company website links, which can lead to extensive brand damage (for example, by redirecting links for a retailer website to an online pornography website).
- Customer data loss–cybercriminals steal sensitive customer data from a company such as customer financial, medical or criminal record details) with the purpose of selling the data on to other criminal networks or using it themselves for blackmail attempts. Industrial espionage–this takes many forms, such as arrival organisation (or associated third party) illegally accessing confidential information to gain competitive or strategic advantage (for example, by finding out a rival’s bid price) or to gain insider knowledge for financial gain (for example, by becoming aware at an early stage of a business transactions.
- IP theft–cybercriminals, often sponsored by rival organisations or nation states, steal ideas, designs, product specifications, trade secrets, process information or methodologies, which can greatly erode competitive advantage or even the operational or technological advantage prized by nation states over potential adversaries.
- Money laundering–cybercriminals use online means to launder the proceeds of criminal acts, for example, through complex, internet-enabled transfers between global or offshore bank accounts. This type of activity is usually associated with organised criminal networks that have a wide or international reach.
Many cybercrime patterns appear to be fairly stable, but there are some interesting changes appearing.
Payment fraud, for example, has more than doubled in value but has fallen slightly as a proportion of payment value; the payment system has simply become bigger, and slightly more efficient.
The move to the cloud means that system misconfiguration may now be responsible for as many breaches as phishing. Some companies have suffered large losses as a side-effect of denial-of-service worms released by state actors, such as NotPetya; we have to take a view on whether they count as cybercrime.
The infrastructure supporting cybercrime, such as botnets, continues to evolve, and specific crimes such as premium-rate phone scams have evolved some interesting variants. Therefore, it would be economically rational to spend less in anticipation of cybercrime (on antivirus, firewalls, etc.) and more on response.
The growing realisation among policymakers that cybercrime has been growing signifcantly in the past decade might reasonably lead to for better funded and coordinated police activity.
Three Steps To Unlocking The Value In Cybersecurity
1. Prioritise training and protecting people-based attacks: Countering internal threats is still one of the biggest challenges with a rise in phishing and ransomware attacks, as well as malicious insiders. Ensure you use effective cyber security training as this is a very effective method of reducing an organisations cyber security risks.
2. Invest to limit information loss and business disruption: Already the most expensive consequence of cyberattacks, this is a growing concern with new privacy regulations such as GDPR and CCPA.
3. Target technologies that reduce rising costs: Use automation, advanced analytics and security intelligence to manage the rising cost of discovering attacks, which is the largest component of spending.
Please contact Cyber Security Intelligence for more information and effective training for cyber security.
You Might Also Read:
