Given the cybersecurity vulnerabilities in today's age, we want you to know how to be safe and understand the common ways cyber attacks can occur. We help law firms in Richmond and Vancouver solve digital forensics cases, and run cybersecurity tests to ensure your networks are secure.
Here are the top cybersecurity realities you should be aware of:
Use of Cloud Apps:
If your company is using a cloud app, you must invest in security tools for the cloud too. These tools are good for identifying known vulnerable dependencies, detecting misconfigurations, and other cybersecurity issues. However, experts say the new line of cloud security tools only address network security and infrastructure security, not application-layer security. So the public cloud may be secure, but may not what you build in-house is secure.
WAFs and gateways won't fully secure APIs:
Since APIs are the foundation of modern apps, they also make up a disproportionate share of risk of being attacked. Companies assume Web application firewalls (WAFs) and API gateways protect their APIs, but these cannot prevent most types of API attacks because of inherent design limitations, and they give organizations a false sense of security for their APIs and API-driven applications.
Awareness training falls short:
There has been a lot of dialogue surrounding cybersecurity training and awareness. Although a great deal of attention has been put into security training around ransomware attacks, phishing, and social engineering since these are common techniques employed by attackers, the training isn't enough.
Too many organizations simply give the training from a third party once or twice a year, ensuring employees have done this training, and then forgetting about it until it is due again. Training and awareness focused on application security is still lagging.
Simply buying new tools doesn't secure the company:
Companies like to think that once they buy the latest security tool, the organization is secure, but that is not true.
Often times, the new tools companies buy are managed improperly and the admins misconfigure them. You can't run a company alone on tools, you also need people with soft skills - people who can follow procedures, read the documentation, and communicate well.
Since June 2020, the new National Cybercrime Coordination Unit (NC3) has received over 1,000 requests for assistance from law enforcement partners (over 30 per cent related to ransomware). TCS Forensics works with law firms and enforcement in the Vancouver Area to solve cybersecurity and digital forensics cases.
Governments around the world are becoming more and more worried about ransomware, not only because attacks are increasing but also due to the lack of data. Canadian statistics are lacking because ransomware attacks are under-reported, with corporate victims reluctant to publicly acknowledged being hit.
Ransomware gangs demanded over $123 million from Canadian victims last year, said the Emsisoft report. Due to under-reporting, Emsisoft suspects the real number of attacks and ransom demands might be four times as high.
These stats should be a clear indication of the importance of having secure systems and networks, in addition to a strong team of cybersecurity professionals
Attacks could be happening to people and organizations around you, or where you work and you may not even be aware of it.
Whistler in British Columbia suffered a cyberattack at the hands of a new ransomware operation. The Resort Municipality of Whistler (RMOW) is a resort community with approximately 12,000 residents and over three million visitors annually, and is known for the ski resort.
The attack forced them to shut down their network, website, email, and phone systems. Whistler is currently working with the RCMP is investigate the attack
Another potential breach was on the City of Toronto from use of its Accellion FTA file transfer server in January that may have involved the health information of individuals. The breach is still being investigated.
“The City of Toronto successfully wards off cyber attacks on a daily basis and is committed to protecting the privacy and security of Torontonians whose information is in its care and control,” says the April 30 news release from the city.