What The Latest Cybersecurity Trends Mean For Your SME 

It's open season for cybercriminals. Research from TWC highlights that the time between March and July is the peak period for cyber attacks targeting organisations, meaning that businesses of all shapes and sizes must remain vigilant. Comparing that with the uptick in cybersecurity incidents that hampered governments and global corporations alike this year already, it’s clear that smaller businesses must act quickly to avoid being caught out.

To stay safe in cyberspace, prevention is always better than the cure. Below, we’ll tackle emerging cybersecurity trends and how businesses can enhance their security and stay vigilant at a time when cybercriminals and fraudsters are growing ever more sophisticated.  

Playing Tricks With Packages 

Hackers will use many of the daily routine, mundane tasks we do to probe for weaknesses. That now includes targeting users as they download digital “packages” of files. There have been increasing incidents of package impersonation attacks via public repositories such as NPM, RubyGems, and PyPl. These play out as cybercriminals create fake packages that mimic legitimate ones in these repositories, and when developers unknowingly download one of these ‘packages’, they also install malware or other malicious code into their systems. The impact of such attacks can be serious as the information on a business’s servers is sensitive. 

To reduce the risk of these attacks, businesses must act to expand the verification and software composition analysis to identify potential threats.

Having verification measures in place checks a package's cryptographic signature and can authenticate the source, therefore ensuring the package is genuine. It can also verify the integrity and dependencies of the package, adding another layer of reassurance that it has not been tampered with. A final check is to run a software composition analysis, which can detect suspicious or malicious code within a package. 

 Multiplying Attacks From Multi-Factor Authentication

Most associate multi-factor authentication with an added layer of security. But even this can potentially be exploited. Businesses are seeing increasing incidents of push spam attacks, where an attacker will send countless push notifications demanding access, tricking an overwhelmed user into approving their entry into their system. The other increasingly common tactic is the ‘man in the middle attack’, which gives access to an account when an attacker intercepts the communication between the user and the server — thus obtaining authentication information. 

One obvious solution is improved employee education on the importance of not approving such requests, and increasing vigilance against unsolicited pop-ups or other suspicious activity. However, that will never fully eliminate the chance for human error.

So how can we bolster security? Hardware tokens could be a compelling solution to this threat. These tokens form an additional layer of security by generating a unique, one-time password that’s entered alongside regular login credentials. Since the password changes every time a user logs in, it’s much harder for attackers to access accounts.

Generating Security With AI

The rise of generative AI is offering many businesses opportunities to find new efficiencies. Unfortunately, cybercriminals are finding ways to benefit from this technology too. With tools like ChatGPT, cybercriminals have a powerful tool to craft more convincing phishing and smishing lures, even with limited technical skills of their own. 

Whether it’s phishing over email or text, companies must be on the front foot to tackle these incidents as they become more common. As before, employee education and training can form a crucial first step in helping with this, as well as staying vigilant against suspicious texts, emails and links. The second line of defense, as mentioned, is having resilient security measures in place, such as multi-factor authentication, as well as keeping device software up to date. 

Finally, don’t let the good name of your company be used against you. Some attackers may copy your domain name and impersonate a legitimate business in a homograph attack. It’s all too easy to overlook the small differences between characters that might be used to replicate a safe domain name with a malicious one — which is why it’s crucial to also consider choosing a domain name with built-in protection to guard against such vulnerabilities. Some domain providers are protecting their customers by automatically blocking all homographs of customers’ domain names at the time of purchase, effectively preventing any efforts to mimic legitimate websites.

API Attacks On The Rise

APIs have undoubtedly become the foundation of modern software development, given their data sharing capabilities and ease of integration. But this reliance on APIs comes at a risk. With attacks only getting more sophisticated–for instance, injection-based attacks, such as cross-site scripting (XSS) or SQL injection, or smarter social engineering tactics–hackers are getting better at getting users into divulging sensitive information. Thankfully, that risk can be mitigated.

While cybercriminals can exploit vulnerabilities in APIs to steal data, compromise systems or launch attacks on other applications or networks, implementing authentication protocols can reduce the likelihood of this threat. Tools like these can help businesses control access to their APIs, review access controls lists and ensure only authorised users can access APIs. Proper encryption of API data can also go a long way in helping protect sensitive data in transit, so data gets to where it needs to be safely. 

But this isn’t a checkbox exercise - instead, businesses must perform regular penetration testing to identify and address any vulnerabilities before it's too late. 

Securing The Path Ahead

Businesses must be vigilant that new technologies bringing them new efficiencies are not also working against them. After all, cybercriminals are just as invested in utilising the latest and greatest trends in technology.

But by having strong awareness and security-savvy employees, a protected domain name, as well as strong authentication protocols across the board, businesses can rise above the risks in 2023 and beyond. 

By Alexander Falatovich, Senior Cyber Security Threat Analyst at Identity Digital

You Might Also Read:

The Reality Check For Small & Medium Businesses:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« NSA Warning: China Is Stealing AI Technology
What Is The Difference Between Phishing, Smishing & Vishing?  »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

2|SEC Consulting (2-SEC)

2|SEC Consulting (2-SEC)

At 2|SEC Consulting, we deliver an end-to-end service of cyber and information security solutions which are tailored to each client’s exact security needs.

Backup Technology

Backup Technology

Backup Technology is a world leader in the Online Cloud Backup, Disaster Recovery and Business Continuity market.

Brit

Brit

Brit PLC is a market-leading global specialty insurer and reinsurer, focused on underwriting complex risks including cyber, privacy and technology.

Cybereason

Cybereason

Cybereason provides attack protection with cutting edge EDR and XDR, and industry recognized consulting services to support organizations throughout any stage of the incident lifecycle.

Anomali

Anomali

Anomali delivers intelligence-driven cybersecurity solutions to enhance threat visibility, automate threat processing and detection, and accelerate threat investigation, response, and remediation.

Secude

Secude

SECUDE is an established global security solutions provider offering innovative data protection for SAP users.

Hexnode MDM

Hexnode MDM

Hexnode MDM is an award winning Enterprise Mobility Management vendor which helps businesses to secure and manage BYOD, COPE, apps and content.

Belden

Belden

Belden is a global leader in signal transmission and security solutions for mission-critical applications in enterprise and industrial markets. Belden brands include Hirschmann and Tofino Security.

Cylus

Cylus

Cylus, a global leader in rail cybersecurity, helps rail and metro companies avoid safety incidents and service disruptions caused by cyber-attacks.

e5 Lab

e5 Lab

e5 Lab seeks to develop solutions to challenges faced by the shipping industry including digital transformation, autonomous technologies and big data in order to promote safe and efficient operations.

Entara

Entara

Entara (formerly YJT Solutions) is an eXtended Service Provider (XSP) focused on providing cutting edge technology and cyber security solutions to companies in regulated industries.

Rolls-Royce Cybersecurity Technology Research Network

Rolls-Royce Cybersecurity Technology Research Network

Rolls-Royce has partnered with Purdue University and Carnegie Mellon University to create the Rolls-Royce Cybersecurity Technology Research Network.

Lodestone

Lodestone

Lodestone partners with clients to help them mitigate business and reputational risk, through our human-based, approach to cyber security, digital forensics and incident response.

V2X

V2X

V2X delivers IT support, networking, and cybersecurity solutions that ensure optimal mission support and performance.

Capzul

Capzul

Capzul are transforming the network security landscape with a new approach; creating virtually impenetrable networks, precluding cybercriminal attacks on your network ecosystem.

Odaseva

Odaseva

Odaseva delivers the strongest data security solution for enterprises running on Salesforce, safeguarding confidentiality and integrity of critical business information.