Threats Layered Cybersecurity and Objective-based Pentests

When it comes to protecting an organization’s assets, the best solution is taking a layered security or defense approach. Using a layered approach, when planning any organizations cyber security strategy ensures that even if an attacker successfully penetrates one layer of defense, they may be stopped by a successive layer. Rather than waiting for a cyberattack to hit endpoints, layered security takes a holistic view of cyber security accounting for a multitude of attack vectors in which cyber attackers may recognize in their pursuit of sensitive data.

43% of Employees Do Not Undergo Regular Cybersecurity Training

A survey conducted by GetApp reports that 43% of employees do not receive regular cybersecurity training and another 8% report never receiving any training at all. The statistics do well to highlight the sheer level of exposure businesses across industries have towards cyber-attacks including ransomware and phishing attacks.

For SMBs, cybersecurity remains of the most difficult challenges to approach. Small businesses account for close to 50% of all cyberattacks, leaving them open to massive liabilities, including complete business closure. In fact, according to the U.S’ National Cyber Security Alliance, 60% of those small businesses are unable to sustain business operations within six months of a cyberattack.

Among small business cyberattacks, web-based attacks, social engineering and malware, including ransomware, are among the top three culprits. Understandably, as cyber attackers develop new techniques to exploit cybersecurity vulnerabilities, businesses must bolster their own security efforts in parallel, in order to maintain their security posture

Social Engineering

One of the key attack vectors where employees are consistently targeted is social engineering, which can summed up as ‘the act of manipulating an individual into divulging confidential information.’ Through the use of carefully campaigned phishing attacks, hacks utilize social media and research to establish a relationship with an organization’s employees. Once established, a cyber attacker will then exploit the relationship to gain the victims trust with the end goal of eventually stealing the information required, often in the form of credentials. For example, obtaining a password might allow an attacker to infiltrate an organizations infrastructure.

Frequently, unsuspecting employees are tricked into providing an attacker access to sensitive company data. An attacker will typically investigate an individual or it’s organization before carrying out planned attacks such as business email compromise and spear phishing. Phishing is the practise of sending emails appearing to come from a well-known, trusted organization asking recipients sensitive information including passwords, account numbers, ID credentials or otherwise.

Cybersecurity Definitions:

Business Email Compromise (BEC): Business email compromise is a form of cyber attack which uses email fraud to attack organizations to achieve a specific outcome that negatively affects the target organization.

Spear Phishing: The fraudulent practice of sending emails purportedly from a known or trusted sender in order to induce targeted individuals to reveal confidential information.

In spite of these daunting threats, only 27% of companies deliver social engineering awareness training of any kind for their staff according to the survey. As well, nearly 75% of businesses are vulnerable, threatening customer, employee and company data. With these two statistics alone, it goes without saying that the need for more substantial cybersecurity practises and systems is critical.

Layered Cybersecurity

Small businesses are just as much of a target for cybercrime as large organizations. For small businesses, as well as large enterprise organizations, investing in cybersecurity needs to take a layered approach. It is not enough to invest in cybersecurity infrastructure, technology and staffing alone; businesses must invest in on-going training for all level of staffing in order to completely address the threat. This methodology adds an additional layer of protection to sensitive company data.

It is imperative to assess the knowledge breadth of your employees when it comes to cybersecurity threats. Reason being is employees are often the “low-hanging fruit” that attackers will utilize to access your organization. Many employees leave their workstations online overnight, or may even have mobile devices they use to work from home; this translates to round the clock internet connectivity leaving businesses wide open to attack.

See Also:

• Employees: Your Organization’s Greatest Threat

• Employees: Your Organizations Greatest Threat: Part 2

Routine, up-to-date cyber security training will help to arm your employees with the required tools to prevent or reduce the threat of an attack. This translates to a heightened security posture for the overall environment of the business. When employees are aware of the characteristics of cyberattacks, they are far less likely to fall for an attack scheme. One way for organizations to assess their overall security posture and awareness of their organization is carrying out objective-based penetration testing.

Conclusion

An objective-based penetration test (OBPT) goes a long way in assessing the true vulnerability of your business to cyber-attack. In addition to standard web application and infrastructure penetration testing, an OBPT can assess staff knowledge of phishing techniques, basic physical security measures, password policy, adherence to security policy and overall employee awareness and compliance. A well-executed OBPT will highlight the gaps allowing a business to prioritize and strengthen their security.