Cyber criminals have become stealthier and more intelligent, and as a result big companies are becoming increasingly susceptible to malicious online threats. In an effort to enhance their operations, businesses are adopting the latest technologies, and more of them – but this also means more vulnerabilities and points of entry for attack. Ultimately, these organisations are becoming highly attractive and viable prospects for criminals.
Knowingly or not, large enterprises have thrust themselves into an IT security war and the bad guys are gaining the upper edge. So – sticking with the language of warfare – would counterattack measures be a sensible option at this stage? Below are five reasons why they might not.
Companies often invest in one anti-virus software solution under the impression that it will address all security needs that occur, naively and recklessly putting all their eggs in one basket. This is a misconception that is not only dangerous but keeps companies at perpetual risk.
The reality is that cyber criminals innovate at a faster pace than security firms, and many anti-virus programs only detect threats that have already been discovered as opposed to zero-day exploits, attacks that target previously unknown vulnerabilities, have no signature written for them and pose the most danger. Organisations won’t truly be safe from cybercrime if their primary barrier allows the most nefarious tools to slip through the net.
Weak cross-border legislation
New cyber crime laws and the specialist police divisions that enforce them have been rendered mostly redundant. Due to the global nature of cybercrime, these laws are often stretched beyond their geographical jurisdiction, thus significantly undermining their ability to protect businesses against threats that often originate abroad.
Cybercrime legislation differs nationally and even regionally in some cases – what might be illegal in the victim’s location might be legal in the culprit’s location, and this lack of seamless cross-border legislation significantly benefits the criminals.
The fact that top governments struggle to convict cyber criminals means there is even less of a deterrent to cease their illicit activity. A universal agreement between governments about how to convict cyber criminals is a long way off, and the upper hand remains with them until this is achieved.
Black market resources
Cyber criminals have evolved into sophisticated planners and slick executors; the malicious processes that they deploy are supported by a wealth of easily accessed tools on the black market, making these individuals shockingly well-resourced to target businesses. For malware-authors, the emphasis is shifting from quantity to quality of infection.
One of the many ways the black market sustains this new ethos is by supplying exploit testing services. These quality assurance measures guarantee new malware will bypass popular anti-virus software by pre-scanning it against all of the most up-to-date malware signature databases. Cyber criminals are able to be strategic and efficient with the black market propping up their activity; it is one of the reasons why they are regularly a step ahead of large organisations.
Cyber criminals are faster than big companies
The defining characteristics of cybercrime are robustness and agility, whereas big companies with vast and complex hierarchical structures can be inert and sluggish in terms of decision making. Multiple layers of management delay how reactive firms can be during an attack on IT infrastructure, putting the loose and nimble criminal networks in a more advantageous position. To protect themselves at even half the speed that criminals move, corporations must re-arrange rigid internal arrangements to be more flexible.
Lack of collaboration
Companies tend to operate in isolation when it comes to cyber security. A problem shared is usually a problem halved – however, the business community still fails to properly collaborate in order to unite against its common enemy.
The benefits of collaboration can be gleaned from the financial sector, which in recent years implemented several simulated “cyber-drills” to bolster industry-wide safeguarding against what it acknowledges as one of its greatest dangers. The latest effort, Operation Waking Shark II, took place in mid-November 2013 when high street banks, financial institutions and regulators, the Bank of England and the Financial Conduct Authority came together to assess their collective security measures in a practical way.
Collaboration on this scale would equate to an overall higher standard of protection for commercial industries, yet the reluctance to share best practice will keep companies at the mercy of cybercrime.
Marcin Kleczynski is CEO of Malwarebytes