What is a cyber attack?
A cyber attack is an assault against a network, computer system, or digital device. Cyber attacks are typically intentional attempts to steal, expose, alter, disable, or destroy data, applications, or other assets. Cyber criminals (ie those launching a cyber attack) may use a variety of methods to launch their attacks, including:
-
malware - this is malicious software that is intentionally harmful to a computer, network, or server
-
phishing - this involves sending fraudulent messages (especially emails and SMS (ie text) messages) pretending to be a reputable organisation (or person) to induce individuals to reveal personal information (eg passwords or bank details)
-
ransomware - this is a type of malware that is designed to deny a user or organisation access to files on their computer, typically until a certain sum is paid
The reason for cyber attacks can vary. However, they can generally be categorised as:
-
criminally motivated attacks - these tend to seek financial gain (eg through monetary theft, data theft, or business disruption)
-
politically motivated attacks - these tend to occur for propaganda reasons, to harm the image of a particular state or government or to leak sensitive intelligence
Who is affected by cyber attacks?
While anyone can be affected by cyber attacks, modern cyber criminals are increasingly commercially orientated. They will most certainly attack ‘hard targets’ if the potential reward justifies it. The fact that a whole host of seriously big names have fallen victim to cyber attacks shows that, frankly, bigger does not necessarily mean better cyber security.
That said, small and medium-sized enterprises (SMEs) are also prime targets for cyber criminals. They may not have the sort of data that the big names hold, but they can be easier targets. This means that SMEs have to take cyber security every bit as seriously as the big names. Fortunately, it is possible to have excellent cyber security even on a tight budget.
What are the worst-hit industries of 2023?
Generally speaking, the worst-hit industries of 2023 are those that tend to have valuable data. The 5 industries most targeted by cyber attacks in the last year have been:
-
public administration
-
healthcare and pharmaceuticals
-
finance and insurance
-
education and research, and
-
retail
Some of the industries on that list may seem obvious, for example, finance and healthcare. Others, perhaps, might be more surprising. For example, retail. The key point to note, however, is that all of these industries are known for storing confidential data. Bluntly, any data that should be kept secret probably has a commercial value.
What are the risks associated with cyber attacks?
There are many risks associated with cyber attacks, depending on who is being attacked and the nature of the attack. For business, examples of the risks of cyber attacks include:
-
loss of financial details
-
data breaches (ie the loss of customers’ personal data, like names, addresses, and financial details, and/or loss of sensitive personal data, like information about staff members’ health)
-
loss of customer lists and databases
-
disruption of IT services (eg websites going down, internal systems not operating, or not being able to accept online payments)
-
theft of intellectual property (eg trade secrets, patents, or product designs)
-
financial losses in general (eg due to fraud, theft, or business disruption)
-
reputational damage (eg as a result of the cyber attack)
The changing nature of cyber threats
The WannaCry attack of 2017 may go down in IT history as the last of the major ‘spray and pray’ attacks. These days, cyber attacks tend to be about discreet infiltration leading to data theft. After the attackers have accessed data they may, however, use the threat of exposure as leverage.
In principle, cyber attacks can be launched in a whole variety of ways. In practice, when cyber criminals attack SMEs they tend to do so through known and/or obvious vulnerabilities. Quite bluntly, if they had the resources to launch more sophisticated attacks, they would almost certainly deploy them against more lucrative targets.
This means that SMEs can head off a lot of cyber attacks just by implementing robust basic housekeeping. What this will mean in practice will depend on whether an SME is using cloud services, local services, or a combination of both.
With cloud services, the vendor (ie the cloud services supplier) takes care of external security. The client (ie the SME using the cloud services) only has to take care of security inside the cloud. With local services, the service owner (ie the SME) is responsible for everything. In either case, however, there are plenty of IT security businesses that can help to keep businesses safe.
Is your business fully prepared?
The fact that companies, even SMEs, have really been upping their IT security game has led to cyber criminals adopting new tactics. They are now relying less on technical IT skills and more on social-engineering skills. In other words, modern cyber criminals are adopting the sort of manipulative interpersonal tactics you’d associate with old-fashioned con artists.
You should do everything possible to implement robust policies and systems to protect against these tactics. Where relevant, this should involve adopting an Information security policy to outline how your business protects its information and systems. It should also involve training your staff on the threats they may face to increase cyber awareness and on what to do about these threats. It may even involve staff achieving certain accreditations, such as the Cyber Essentials accreditation, which is a government scheme that has helped to prevent many cyber attacks.
On the other hand, in the event of a cyber attack businesses do have the right to claim compensation for financial loss, privacy loss, and emotional distress. The usual route when you’ve been the victim of a cyber attack is to contact Action Fraud and provide as much information as possible about the attack.
There are, of course, further implications, especially in the case of an attack that impacts customers and their personal data. Such an attack may result in claims from the people who use your services. Seeking legal advice on how to handle such events (ie data breaches) will help you to navigate the necessary steps that must be taken to protect your business, its employees, and your customers.
Keep in mind that, if your business handles personal data that may be accessed via cyber attacks, ensuring that this data is handled with the utmost care is essential to avoiding any breaches of data protection laws. It is a good idea to have in place clear contingency plans outlining how your business will continue to operate in the event of a cyber attack. You can use a Business continuity plan to do this.
For more information, read Information security and cyber security and Data protection. If you have any questions, you can Ask a lawyer for assistance.
