What The Latest Cybersecurity Trends Mean For Your SME 

It's open season for cybercriminals. Research from TWC highlights that the time between March and July is the peak period for cyber attacks targeting organisations, meaning that businesses of all shapes and sizes must remain vigilant. Comparing that with the uptick in cybersecurity incidents that hampered governments and global corporations alike this year already, it’s clear that smaller businesses must act quickly to avoid being caught out.

To stay safe in cyberspace, prevention is always better than the cure. Below, we’ll tackle emerging cybersecurity trends and how businesses can enhance their security and stay vigilant at a time when cybercriminals and fraudsters are growing ever more sophisticated.  

Playing Tricks With Packages 

Hackers will use many of the daily routine, mundane tasks we do to probe for weaknesses. That now includes targeting users as they download digital “packages” of files. There have been increasing incidents of package impersonation attacks via public repositories such as NPM, RubyGems, and PyPl. These play out as cybercriminals create fake packages that mimic legitimate ones in these repositories, and when developers unknowingly download one of these ‘packages’, they also install malware or other malicious code into their systems. The impact of such attacks can be serious as the information on a business’s servers is sensitive. 

To reduce the risk of these attacks, businesses must act to expand the verification and software composition analysis to identify potential threats.

Having verification measures in place checks a package's cryptographic signature and can authenticate the source, therefore ensuring the package is genuine. It can also verify the integrity and dependencies of the package, adding another layer of reassurance that it has not been tampered with. A final check is to run a software composition analysis, which can detect suspicious or malicious code within a package. 

 Multiplying Attacks From Multi-Factor Authentication

Most associate multi-factor authentication with an added layer of security. But even this can potentially be exploited. Businesses are seeing increasing incidents of push spam attacks, where an attacker will send countless push notifications demanding access, tricking an overwhelmed user into approving their entry into their system. The other increasingly common tactic is the ‘man in the middle attack’, which gives access to an account when an attacker intercepts the communication between the user and the server — thus obtaining authentication information. 

One obvious solution is improved employee education on the importance of not approving such requests, and increasing vigilance against unsolicited pop-ups or other suspicious activity. However, that will never fully eliminate the chance for human error.

So how can we bolster security? Hardware tokens could be a compelling solution to this threat. These tokens form an additional layer of security by generating a unique, one-time password that’s entered alongside regular login credentials. Since the password changes every time a user logs in, it’s much harder for attackers to access accounts.

Generating Security With AI

The rise of generative AI is offering many businesses opportunities to find new efficiencies. Unfortunately, cybercriminals are finding ways to benefit from this technology too. With tools like ChatGPT, cybercriminals have a powerful tool to craft more convincing phishing and smishing lures, even with limited technical skills of their own. 

Whether it’s phishing over email or text, companies must be on the front foot to tackle these incidents as they become more common. As before, employee education and training can form a crucial first step in helping with this, as well as staying vigilant against suspicious texts, emails and links. The second line of defense, as mentioned, is having resilient security measures in place, such as multi-factor authentication, as well as keeping device software up to date. 

Finally, don’t let the good name of your company be used against you. Some attackers may copy your domain name and impersonate a legitimate business in a homograph attack. It’s all too easy to overlook the small differences between characters that might be used to replicate a safe domain name with a malicious one — which is why it’s crucial to also consider choosing a domain name with built-in protection to guard against such vulnerabilities. Some domain providers are protecting their customers by automatically blocking all homographs of customers’ domain names at the time of purchase, effectively preventing any efforts to mimic legitimate websites.

API Attacks On The Rise

APIs have undoubtedly become the foundation of modern software development, given their data sharing capabilities and ease of integration. But this reliance on APIs comes at a risk. With attacks only getting more sophisticated–for instance, injection-based attacks, such as cross-site scripting (XSS) or SQL injection, or smarter social engineering tactics–hackers are getting better at getting users into divulging sensitive information. Thankfully, that risk can be mitigated.

While cybercriminals can exploit vulnerabilities in APIs to steal data, compromise systems or launch attacks on other applications or networks, implementing authentication protocols can reduce the likelihood of this threat. Tools like these can help businesses control access to their APIs, review access controls lists and ensure only authorised users can access APIs. Proper encryption of API data can also go a long way in helping protect sensitive data in transit, so data gets to where it needs to be safely. 

But this isn’t a checkbox exercise - instead, businesses must perform regular penetration testing to identify and address any vulnerabilities before it's too late. 

Securing The Path Ahead

Businesses must be vigilant that new technologies bringing them new efficiencies are not also working against them. After all, cybercriminals are just as invested in utilising the latest and greatest trends in technology.

But by having strong awareness and security-savvy employees, a protected domain name, as well as strong authentication protocols across the board, businesses can rise above the risks in 2023 and beyond. 

By Alexander Falatovich, Senior Cyber Security Threat Analyst at Identity Digital

You Might Also Read:

The Reality Check For Small & Medium Businesses:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« NSA Warning: China Is Stealing AI Technology
What Is The Difference Between Phishing, Smishing & Vishing?  »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Applause

Applause

Applause provides real-world software testing for functionality, usability, accessibility, load, localization and security.

Bayshore Networks

Bayshore Networks

Bayshore Networks was founded to safely and securely protect Industrial IoT (IIoT) networks, applications, machines and workers from cyber threats.

JPCERT/CC

JPCERT/CC

JPCERT/CC is the first Computer Security Incident Response Team (CSIRT) established in Japan.

Redicom

Redicom

Redicom is an independent consulting agency focusing on identity management, strong authentication and single-sign-on.

Cybernetic Global Intelligence (CGI)

Cybernetic Global Intelligence (CGI)

CGI is a global IT Security firm that helps companies protect their data and minimize their vulnerability to cyber threats through a range of services such as Security Audits and Managed Services.

SITA

SITA

SITA is a multinational information technology company providing IT and telecommunication services to the air transport industry including vulnerability assessments and managed security services.

HACKNER Security Intelligence

HACKNER Security Intelligence

HACKNER Security Intelligence is an independent security consultancy delivering comprehensive security assessments across IT security, physical security, and social engineering.

LGMS - LE Global Services

LGMS - LE Global Services

LGMS is a leading cyber security penetration testing and assessment firm in the Asia Pacific region.

Zilla Security

Zilla Security

Zilla combines identity governance with cloud security to deliver comprehensive access visibility, reviews, lifecycle management, and policy-based security remediation.

LayerX Security

LayerX Security

LayerX's user-first browser security platform turns any browser into the most protected & manageable workspace, by providing real-time monitoring and governance over users’ activities on the web.

Protect AI

Protect AI

Protect AI is a cybersecurity company focused on AI & ML systems. Through innovative security products and thought leadership in MLSecOps, we help our customers build a safer AI powered world.

Data Pie Cybersecurity

Data Pie Cybersecurity

The Data Pie Cybersecurity Consulting offers a 360° around protection for your IT security. Security awareness solutions and consulting.

Cybernatics

Cybernatics

Cybernatics is inspired by bringing together best-in-class innovations around Cybersecurity and Analytics. We offer tailored enterprise solutions to safeguard your organisations best interests.

Security Compliance Associates (SCA)

Security Compliance Associates (SCA)

The sole focus of SCA is safeguarding critical information and complying with information security regulations.

Professional Labs

Professional Labs

Professional Labs specialize in simplifying complex problems for our customers with Cloud Services, Managed Services and Cyber Security.

RIoT Secure

RIoT Secure

RIoT Secure AB is a technology enabler within the IoT industry - created with a vision to ensure security technology exists in the foundations of software development for IoT solutions.