Kathy Gibson reports from Kaspersky Labs’ Cybersecurity conference in Baku – South African companies are facing new and potentially lethal cyber-risks, as criminals become more determined to make money from their activities.
Money is the most popular reason that cybercriminals attack companies – they either demand money, or steal information that is worth money.
“Most criminals look for money,” says Amin Hasbini, senior security researcher at Kaspersky Lab. “Others might look for intelligence, which is also worth money.”
Enabling criminals to perform more attacks, digital certificates are a target when criminals want to steal credentials.
Political intentions are another reason we see attacks, says Hasbini, and cyber-mercenaries are a growing force.
Targets could include just about every company in the world. “Everyone has valuable data,” Hasbini says. “If you are using computers and the Internet, you are using them for a reason – and so there is value.”
The consequences could range from the cost of recovering from the attacks to losses from business disruption, to loss of competitive advantage, legal expenditure, reputational damage – and vulnerability.
d even going out of business.
On average, enterprises pay $551 000 to recover from a security breach, says Matvey Voytov, solution business lead: critical infrastructure protection business development at Kaspersky Lab. For SMEs this is at around $38 000, but large enterprises suffered an average of $600 000 per breach.
The biggest threat for corporates is internal vulnerabilities, with 23% of South African organisations suffering an attack. Other internal threats for local companies include accidental leaks by staff (18%), loss or theft of mobile devices (23%), security failure by a third-party supplier (11%), fraud by employees (21%) and intentional leaks by staff (9%).
South African enterprises fell victim to external attacks including spam (73%), viruses and other malware (44%), phishing (37%), network intrusion (14%), DDoS attacks (8%), theft of mobile devices (19%), cyber-espionage (7%) and targeted attacks (7%)
In fact, cyber incidents are now the number five top risk for business interruption – and is expected to rise to the top threat soon.
But why are companies not better prepared against cyber-risk? And Allianz study puts this down to lack of understanding, at 41%.
Voytov advises companies to protect themselves by educating people, implement technologies and establishing security processes.
