The Threat Landscape Never Sits Still: Four new risks organisations face in 2022

Risk 3: Impact of Remote Working 

When employees are working outside of office space, the usual network protections are no longer adequate. Bring Your Own Device (BYOD) and remote working can force many organisations into a less-than-secure position, with employees accessing sensitive information through unsecured networks and devices.

The cyber security risks that have increased due to remote working include:

• Brute force attacks: An attack that seeks to overwhelm your defences with repeated and automated attempts to guess password combinations correctly.  
• Phishing attacks: A specific subset of social engineering attacks that uses fraudulent messages to trick users.  
• Malware: Software that’s designed to disrupt, damage or gain unauthorised access. This might be uploaded to your system through any number of strategies including both phishing and malicious insiders. 
• Ransomware: A specific type of malware that seeks to block access to computer systems until a ransom is paid. 
• Business email compromise (BEC): This is a type of social engineering attack in which a compromised internal email is used to impersonate official communications and extract information or access. 

Realistically, hybrid working is here to stay. It’s critical that the risks of remote working are accommodated rather than ignored, and effective solutions put in place. Fundamentally, organisations need to find new ways to secure and embrace new, flexible working patterns.

Strategies to Combat This Threat

Overcoming remote working challenges requires creating agile and responsive security systems that are able to accommodate new devices and applications while minimising risk. Fundamentally, this hinges on your ability to achieve defence-in-depth by employing a combination of technology and people-led processes to contain remote threats before they impact your system at large.  

Managed Detection and Response (MDR) is an incredibly effective way to overcome the challenges of remote working. If you’re unfamiliar, MDR delivers active threat monitoring and response as a service — creating a flexible and effective cyber security solution. Although similar outcomes can be achieved using in-house monitoring, the expertise and efficiency of MDR simplifies execution and brings benefits including: 

• Economies of scale: MDR providers deliver more efficient access to expertise and technology by delivering access to larger operations and existing infrastructure. 
• On-demand access: It’s more resource intensive to respond to an incident than monitor activity. MDR providers enable you to have access to the resources you need, when you need them — without the need to employ specialists full time. 
• Side-stepping the skills shortage: More than a quarter of UK businesses have an incident response skills gap, and that’s on top of the established cyber security skills shortage. MDR lets you avoid this problem and access the skills you need, when you need them.  

Suggested reading: If you want to learn more about the impact of remote working on cyber security, take a look at our blog — Has Remote Working Created a Massive Cyber Security Threat? And what to do about it

Risk 4: Attacks on Cloud Services 

The increase in remote working has led to more cloud-based infrastructure and services being used. As a result, cloud services are now a prime target for cyber criminals, creating new cyber risks and avenues for attack. 

Data breaches, human error, malicious insiders, account hijacking, and DDoS attacks all present challenges to cloud services and cyber security more generally. Relying on third-party service providers introduces additional compliance considerations — making it critical that you appraise both your partner’s’ and your internal operations. Research shows that an average of 51% of organisations have been exposed to at least one cloud storage service to attack.

Strategies to Combat This Threat

• Be aware and act on new cloud security intelligence: Have access to cyber intelligence reports and conduct regular risk assessments.

• Ensure access control in place: Using a password manager to create and use unique and strong passwords across your organisation and accounts is critical. You also need to ensure that joiners apply best practices and leaver accounts are removed.

• Balance between efficient operation with security optimisation: Everything cannot be locked down — there will always be a balance to be struck between operational, legal and IT considerations. To get everyone on the same page, a risk assessment is the best place to start.

• Implement network segmentation: Segmenting the network to protect sensitive information makes it difficult for hackers to move about — even once they have access.

• Build-in data encryption: When your data is encrypted, even if an unauthorised person gains access to it, they will not be able to read it. Look to create and implement a policy for encryption-at-rest for storage and endpoint encryption between devices and servers.

Avoid Complacency and Invest in Planning 

In 2021, we saw an increase in the variety of cyber-attacks. Cyber security is a journey, not a destination, and has to be an ongoing, iterative process that adapts to new threats.

As a result, even with the context of budget and skills constraints, it’s crucial to build on existing knowledge and make investments in the right areas in order to mitigate cyber security risks.   

A practical cyber assessment approach, and partnering with a managed security provider, will be crucial for organisations in overcoming these threats. 

Here at Six Degrees, we can provide the knowledge and expertise to help deliver a range of flexible, on-demand services to combat the cyber security risks facing organisations in 2022. Ready to begin your cyber security journey? Get in touch today.