The Biggest Security Threats You Need to Know About in 2019

Security continues to dominate the IT landscape as businesses face an ever-growing and faster-moving range of threats to their infrastructure and data. While 2018 hasn’t seen quite as dramatic headlines as in recent years, that’s no reason to start getting complacent.

2017’s NotPetya attack crippled the IT systems of businesses around the world. Although there are fewer scary news stories, the pace of attacks has not let up and the threat to businesses remains alarmingly high, even though no single event has quite hit that level of destruction or press interest in 2018.

As we approach 2019, now is a perfect time to revisit your IT security awareness, features and make all workers aware of the risks. While big attacks grab all the headlines, a range of threats lie in wait for any business that isn’t 100% on its game when it comes to IT protection. Trends include a growing range of polymorphic attacks that change to take advantage of a range of weaknesses to more sophisticated phishing attacks, ransomware and digital heists.

The lack of headlines is likely down to hardened criminals reigning in the spectacular but financially ineffective attacks, taking a quieter approach to their crimes or leaping on board the new scam of crypto-jacking, stealing digital currencies from the online wallets of individuals or groups. And, as they go quietly about their work, the complexity of the terminology can confuse many businesses trying to defend themselves.

The rise of zero-day vulnerabilities

In 2018, and into 2019, the most popular types of attacks are zero-day vulnerabilities. Growing in notoriety since the early 2000s and the rise of all-networked machines, these exploit undisclosed or new vulnerabilities that many antivirus vendors won’t have patched. Even AI-based defensive tools that track intent might not spot them.

These are often combined with fileless attacks that don’t use the traditional email attachment, Office document or another method of attack. Instead, they take over part of the operating system to carry out their attack, so there is no file for traditional security tools to inspect.

Polymorphic attacks and DDoS

Adding to the complexity is polymorphism where the attack code changes on a regular basis to confuse and bypass defenses. Distributed Denial of Service Attacks remain a threat, even though the headlines have dropped off due to improved internet resilience. Still, any business could find its websites and services knocked offline at critical times.

The volume of security threats in the business landscape

To highlight the scale of the attacks, Kaspersky detected over three-quarters of a billion attacks in the first quarter of this year. A sharp rise on the 2 billion recognized attacks across all of 2017. Almost 400,000 of the first quarter 2018 attacks were money theft or ransomware types, while others are focused on data theft, using compromised machines to spread other attacks.

Increasingly mobile is the target for attacks, with rapid growth in Android malware and attacks on iOS services. While most business Android devices have enterprise security features like Samsung’s Knox and Google’s Enterprise Security, many users bring their own device for work (BYOD) and may share business files or download insecure apps that increase the risk to the business.

Politics and espionage are also the reasons behind a growing number of attacks. ZooPark targets North African businesses for extortion and to spread political turmoil, while bot accounts on social media are wreaking havoc on public perception, causing growing extremism that could indirectly affect any business.

All of these are part of the growing trend toward cyber warfare, financial hacks and other electronic crimes that businesses need to be aware of and actively countering.

Defending against cyber attacks

Businesses need active measures to defend against threats like zero-day attacks. The least any business can do is have all systems automatically patching the latest OS and security files. Whilst remote and offline backups of data will help the business recover against data loss or a ransomware attack.

Employee weakness in business security

All staff must be trained in how to spot and react to threats, as an attack could hit any piece of hardware across the company. Phishing attacks that specifically target staff to try to give out passwords or bank details remain another key threat at the individual level. Increasingly convincing emails or letters see people passing out bank codes and credit information, putting a business at massive risk.

Strengthening a business’ defense

Businesses must also fortify any networks, especially the Internet of Things and remote networks that can be easily identified and attacked. In the era of GDPR, the cost to business if personal or other data is lost or stolen means that nothing should be left to chance.

Deploying current-generation tools that use statistical, signature-based, behavioral and other techniques that can spot zero-day attacks by their actions is now essential. Most vendors offer these tools as subscription services, low cost and always updating, even if another business is attacked, your defenses will be informed and updated.

Whatever the size of the business, an all-around cybersecurity strategy and awareness at the individual level is key to protecting the business. Hackers’ tools are at work 24 hours every day, and improve week after week to exploit any weakness within a business. Your company might get away with it this week, next month or all of 2019, but at some point, a hacker will find a way in and could cause massive damage to the business.

Staying informed and up to date about the threats and solutions that can defeat them is the main way to help the business remain secure. As companies rely more on automated networking in the future, there is still plenty of time for personal knowledge and awareness to help keep networks and data safe.