This year your firm will be in more danger of falling victim to cybercrime than it was last year. But there are practical steps you can take right now to safeguard your firm from cyberattack.
Cybersecurity is a topic that has to some extent suffered from overexposure. While nothing is more important in your professional life than protecting your staff, firm and ambitions from cybercriminals, there is a deluge of information that can make it hard to know where to focus your efforts.
This blog gives you a snapshot of the cybersecurity landscape, we’ll also let you know where you’re most likely vulnerable, and the important things you can do right now to stay safe from cybercriminals.
Let’s start with a quick look at the main consequences of cybercrime:
- Stolen money
- Lost productivity
- Damage and destruction of data
- Theft of intellectual property
- Stolen personal and financial data
- Embezzlement and fraud
- Post-attack disruption to the normal course of business
- Forensic investigation
- Restoration and deletion of hacked data and systems
- Reputational harm
Cyberattacks at a glance
- Cyber risks were the #1 business concern worldwide in 20221.
- The consequential costs of cybercrime will increase by 15%2 every year for the next five years. By 2025, the estimated annual cost will reach $10.5 trillion globally.
- If the global cybercrime damages of $6 trillion3 in 2021 were measured as a country, they would constitute the third-largest economy after the U.S. and China.
- There has been a 300%4 increase in cybercrimes, including ransomware campaigns requiring payment in cryptocurrency since the start of the pandemic.
- A supervisory special agent with the FBI who investigates cyber intrusions told The Wall Street Journal5 that every U.S. citizen should expect that all the data that personally identifies them, has been stolen and is on the dark web, which is at least 5,000 times larger than the surface web.
- Cloud native development, along with the increased speed brought about by the adoption of DevOps processes, has made the challenges connected with securing software supply chains infinitely more complex – with 82%6 of CIOs saying that their software supply chains are vulnerable.
- 93%7 of company networks can be penetrated by cybercriminals.
- More than 50%8 of businesses do not have a cybersecurity risk plan despite another record year of breaches.
- In 2021, there were 3.5 million unfilled cybersecurity specialist jobs worldwide, which means the profession has a 0% unemployment rate, according to the Official Annual Cybersecurity Jobs Report.
The 5 biggest cybersecurity threats right now
The online environment is experiencing a perfect storm that sees a cyberattack happening somewhere in the world every 39 seconds, mainly driven by:
- The complexity of supply chains (44%)
- The fast pace of digital innovation (41%)
- Inadequate cybersecurity budgets and lack of executive support (28%)
- Convergence of digital and physical assets (25%)
- A shortage of talent (24%)9
There are five main types of attacks you’ll need to be aware of to avoid your firm becoming a cybercrime statistic.
1. Ransomware
Ransomware is a malicious software that blocks your company from accessing your systems. Criminals encrypt your files and demand a ransom payment for the decryption key. Firms often find that paying the ransom is the easiest and cheapest way to regain access to their files.
Digital Shadows monitors ransomware groups on a daily basis and has noted two important trends in quarters two through four of 202210, which point to what we can expect in 2023.
They found that ransomware groups were creating new tools and techniques, including the launch of LockBit, ransomware’s latest affiliate program “LockBit 3.0”, while also repurposing older ransomware tools. They’ve also noted a blurring of the lines between financially and politically motivated ransomware, with government entities and private companies suffering the consequences. Following the highly disruptive attacks on Montenegro and Albania in 2022, Digital Shadows noted that ransomware was becoming “not only the tool of cybercriminals but a potentially impactful political tool” with severe knock-on effects for firms and the average citizen.
2. Malware
This is the most common form of cyberattack using malicious software that gives unauthorised users access to sensitive and secure systems and data. Malware attacks have increased as more people work remotely on personal devices and unsecured networks.
These attacks often use phishing attempts to gain login data and user access. Once criminals have their hands on this information, they can disrupt or compromise key systems, which forces companies to shut down their websites and eCommerce platforms sometimes for an entire day, which results in significant financial loses and can cause reputational harm.
More cyberattacks in recent years have involved human error and the manipulation of user behaviour to exploit software flaws. This means combating malware attacks will remain one of the biggest influences of cybersecurity policies for businesses.
3. Compromised or stolen devices
As more connective features are added to our computers and mobile devices, there are an increasing number of places for data to slip through. Data breaches are caused mainly by weaknesses in technology or user behaviour. As connectivity has become an integral part of our personal and professional lives, we have tended to value convenience over security.
As many products and tools continue to be manufactured without encryption, when coupled with poor digital habits it takes just one person to compromise an entire network. Mobile devices and external hard drives should always be locked and encrypted and treated with the same vigilance as a bank card.
4. Social engineering
Socially engineered cyberattacks are becoming more frequent, sophisticated and difficult to detect. In May 2022, the FBI’s Internet Crime Complaint Center (IC3) shared updated statistics on Business Email Compromise (BEC) attacks using different social engineering. These attacks used phishing techniques to break into accounts and trick companies into transferring large sums of money into the accounts of cybercriminals. The combined domestic and international losses involving 241,206 incidents11 reported to law enforcement and banking institutions in a four-year period, amounted to US $43.31 billion.
Through 2022, there has been an increase not only in the frequency of socially engineered attacks, but in their sophistication. BEC attacks12 that appear legitimate, involve accessing a target’s business email, impersonating an employee, then using their identity to create rapport with victims to get their hands on their money.
5. Insider attacks
Every business should be aware of the potential danger of insider cyberattacks from malicious employees. This usually involves a person who intentionally accesses or shares data to cause harm to an individual or company. While this type of threat may not be as numerous as other attacks, the potential fallout can be significant because the person has legitimate authorisation to use the data but may intend selling the information to cybercrime syndicates or simply causing disruption to a business.
5 Steps you can take now to guard your firm’s future
Instead of treating the issue as a technology shortcoming, more firms are directing funds into cybersecurity through additional secure technology, third-party auditing and staff training. If you don’t already have a cybersecurity plan, here are five things you can do right now to mitigate the risk to your firm.
1. Cyber liability insurance
About 47% of businesses have cyber liability insurance designed to minimise the costs to businesses if they do experience an attack. Insurance typically covers, in the case of a data breach for example; credit monitoring and repair, legal fees including forensic analysis, legal representation and fines, as well as loss of revenue and even replacement of equipment.
Purchasing cyber liability insurance gives your firm important protection against rising attacks that even the best-protected businesses can fall victim to. It will give you the opportunity to recover from your losses and act in the best interests of your clients who may be affected by an attack.
2. Security training
A staggering 88% of all data breaches are a direct result of employee error13, whether intentional or accidental. Giving your people access to mandatory cybersecurity training is your best and first line of defence.
At TOA Global, we make sure every team member has a deep understanding of the latest information in online safety by completing the TOA Global Compliance: Data and Privacy course through our learning division, the Ab2 Institute of Accounting.
Training includes:
- An understanding of the latest cyberthreats to companies and individuals.
- Cybersecurity best practices to help prevent attacks.
- A ‘clean desk policy’ that instills the habit of securing devices, locking away mobile phones and storing documents during and after office hours.
- The importance of restricting access to computers and files, keeping devices updated with the latest software and using strong passphrases.
3. Firewalls and antivirus software
With the move in recent years to remote or hybrid work models, which has seen more employees working outside the confines of secured networks, firms are relying more on firewalls and antivirus software. Firewalls help you block unauthorised web traffic but allow the flow of outgoing communications from authorised sources. Antivirus software scans for and isolates malicious software so it can’t infect other systems on the network or reach company assets.
4. Passphrases
About 71% of companies are breached using compromised credentials, usually simple passwords. It takes cybercriminals just two days on average14 to penetrate a firm’s internal network.
TOA Global Executive VP Information Technology, Charles Wardzinski, advises firms to use passphrases over passwords. He says, “A passphrase is a combination of words that’s longer than eight characters using a mix of capital and lowercase letters, numbers and special characters. A complex passphrase of 10 or more characters will take hundreds of years to crack. But anything less than that can be cracked in a matter of hours.”
One of the most effective tools to protect your system is multifactor authentication that uses knowledge and a possession to authenticate a user. Knowledge would be your unique username and passphrase, and the possession is your unique device. Charles says, “Enterprise-grade protection and redundancy are built in to ensure we control traffic in and out of the TOA Global network. We use a cloud security tool that geo-locks cloud data to our facility and hides passphrases from other users. And all our clients receive an Offshore Technology Assessment as part of the onboarding process with TOA Global as a starting point along with the added assurance that their global outsourced accounting talent has the latest cybersecurity training.”
5. Partner alert
As many as 44% of executives15 believe their growing use of partners and suppliers exposes them to significant security risks. It is becoming increasingly important to take a careful look at your supply-chain security so you’re in a position to detect, respond to and mitigate security threats.
Alarmingly, about 60% of businesses16 admit they don’t have full visibility of supply chain cybersecurity risks. This means your firm may be vulnerable to a supply chain attack despite having shored up your own cyber defences – criminals may be able to access your firm through your partners and suppliers.
If you haven’t already, consider creating a third-party risk management program (TPRM)17 for your firm. For smaller firms or micro practices, if you’re not sure where to begin, use a licensed third-party auditor to certify potential partners.
Meeting challenges, heading off danger
Despite firms increasing their security budgets and adopting more advanced defences, staying a step ahead of cybercrime and minimising the fallout when attacks do occur will continue to be a challenge.
If you’re concerned about the safety of your business, start with a risk assessment including partners and suppliers. This will give you a quick view of the immediate threats to your business and allow you to prioritise cyber vulnerabilities so you can put measures in place to increase your operational cybersecurity and safeguard the future of your firm.
As the leading global talent solutions provider for the accounting industry, we ensure the protection of our clients by using the latest security protocols, platforms guarded by 24/7 enterprise-grade security, and advanced training for your global team members so you’re free to focus on reaping the benefits of elite outsourced accounting talent.
Contact us today to talk about how we can help you increase your efficiency and profitability with dedicated outsourced accountants, bookkeepers and executive assistants.
