If you thought politics has been a rollercoaster over the past couple of months, it is nothing compared to the world of cyber security during the past couple of weeks.
To tap into my political reference repertoire, recent weeks in cyber haven’t been ‘strong and stable’ or the equivalent of ‘running through a field of wheat’. What we’ve seen is more akin to a ‘coalition of chaos’ between ransomware strands, poor system patching protocol and a trouble causing media jumping to conclusions.
While whipping up fear is a favourite of the media when it comes to cyber attacks, the scale of infections over the months of May and June has been unprecedented.
Have we finally been ushered into the era of hacks, breaches and infections that cyber security professionals have been warning about for years?
Cyber attacks are becoming bigger
WannaCry was the word on everyone’s lips back in May when the ransomware brought the NHS to its knees as computer systems were locked down by a strain of malware stolen from the NSA (National Security Agency) in the USA.
The most high profile of these cases was the NHS which saw a fifth of trusts brought to a standstill as computers were taken hostage by the malware.
Spanish telecommunications giant Telefónica and American courier service FedEx were victims of the cyber attack launched on Windows operating systems.
Now Petya is the word that is swarming around the sector like moths in your room on a hot summers night.
Petya is a strain of ransomware which has hit businesses all over the world in the past 48 hours, with the vast majority hitting systems in Ukraine – 60% of all systems affected were in the Ukraine. However, WPP and DLA Piper in the United Kingdom have reported infections too.
Similarly to WannaCry, Petya has had a massive impact on systems all over the world making cyber security headline news yet again.
Petya appears to be more of a statement of chaos rather than the systematic approach of decryption found in most strains of ransomware. In fact, theories have arisen that the malware isn’t actually ransomware and that it was masquerading as one to control the media narrative.
Considering the high number of systems infected in Ukraine alone, it could be argued that it was a cyber attack directly targeted at Ukrainian infrastructure as part of the Russia – Ukraine conflict.
Ukraine’s official Twitter feed made light of the situation at least.
The reach this particular strain of malware had, if its in fact a targeted attack, is worrying as it shows the increasing need to take cyber security seriously.
The increasing involvement of nation-states or rogue activist as part of cyber wars with the aim of bringing down national infrastructure could happen to any country.
As WannaCry hit the likes of Telefónica and FedEx due to unpatched systems, it seems that Petya has had a similar effect. Couple this will phishing emails, regardless of sophistication and untrained staff, you have a data breach just waiting to happen.
What’s makes Petya unique is it’s encryption technique, rendering the hard drive useless as it only encrypts a segment of the drive rather than the entire piece of hardware.
Ransomware can appear a terrifying prospect (and it is!) but at least it tells you that you’re infected rather than it silently festering on your device seeking out vulnerabilities.
To ensure that your organisation is not held to ransom follow Bob’s tips to prepare you for a potential attack.
- Make sure you have a backup of everything
- Check that you have the latest version of all your software
- Don’t open attachments sent via emails
- Make sure your policies are in line and that your staff are aware of procedures
- Secure your networks – ensure your router is protected
Human error accounts for 95% of data breaches, which is why our cyber security awareness training offers your employees a comprehensive round-up of basic information security that will safeguard your information.
Virus Vigilance has more details on ransomware and how best to protect your networks from other types of malware.
For SMEs, we recommend our Cyber Essentials module which will ensure that you have the minimum controls in place to protect yourself from unsophisticated cyber attacks.
It’s time to work together
Henry Ford once said, “Coming together is a beginning; keeping together is progress; working together is success”. As the man who introduced the assembly line into factories, he should know about working together.
Collaboration has always been the cornerstone to success and that has never been more true than in InfoSec. Current solutions are not the answer and if we aren’t careful we run the risk of running the industry into the ground, unless we work together.
Bob’s Business is launching it’s brand new Partner Programme with the aim of developing closer relationships with those organisations that wish to resell, recommend or integrate Bob’s Business end-user cyber security awareness training as part of their managed security services portfolio.
After being in beta testing for a few months ,we are opening up the Partner Portal to all resellers and MSPs that wish to work with Bob’s Business to develop secure cultures within their client base.
Bob’s Business believes that humans are our best assets but are let down by poor policies and poor marketing of engagement programmes. The human factor is down to employees, but to those who are responsible for the security in the organisation.
We want to work with those who believe that they can make a difference and change behavioural change within their organisations.
You can sign up for our Partner Programme here.
When you sign up you will have access to service definition documents, case studies, marketing collateral and demo modules.