The cyber risks and threats that businesses and organizations must address to safeguard proprietary, confidential and personal information in their custody and control is staggering. According to Accenture Security’s “Cost of Cybercrime” report, there continues to be a steady increase in the average number of security breaches per year, average amount of time required by businesses to resolve data incidents and breaches, and total cost of cybercrime that businesses incur. The report found malware continues to be the most frequent — and, in many instances, the most costly — type of cyberattack facing organizations, and the total “number of organizations experiencing ransomware attacks increased by 15% over one year and have more than tripled in frequency over two years.” The report also noted 85% of organizations are subject to phishing and social engineering attacks from malicious actors.

In addition to these more common cyber risks, businesses and organizations may face cyber threats from other countries.

On Jan. 6, the Cybersecurity and Infrastructure Security Agency, an office within the U.S. Department of Homeland Security, issued a cyber alert to U.S. businesses and the cybersecurity community in light of the “current tensions” between Iran and the U.S. In particular, the alert describes several of Iran’s previous cyber operations that targeted a variety of industries and organizations in the U.S., including the financial services sector, the energy and chemical sectors, government facilities, health care organizations, the manufacturing sector, organizations involved in communications, and the defense industrial base. For example, the alert identifies the following cyber activities attributed to Iran:

• A distributed-denial-of-service attack targeted the U.S. financial sector between 2011 and 2013, which resulted in the Department of Justice indicting seven Iranians.
• A cyber operation against the IT systems of the Bowman Dam in New York led to the unauthorized access to information regarding the status and operation of the dam. This resulted in the March 2016 indictment of an Iranian actor “performing work on behalf of the (Islamic Revolutionary Guard Corps).”
• A cyberattack at the Sands Las Vegas Corporation involved the theft of customer data and sensitive personal information (e.g., credit card data, Social Security numbers and driver’s license numbers).
• A cyber theft campaign between 2013 and 2017 that targeted certain academic and intellectual property data. In 2018, the DOJ indicted nine Iranian actors associated with these cyber operations.

The CISA concluded Iran has a history of leveraging asymmetric tactics, such as cyber operations, to pursue its “national interests beyond its conventional capabilities” and has “continuously improved (its) offensive cyber capabilities.”

The cyber alert also sets forth the following “actionable technical recommendations for IT professionals and providers” that are intended to reduce their overall vulnerability to a cyberattack:

1. Disable all unnecessary ports and protocols. Review network security device logs and determine whether to shut off unnecessary ports and protocols. Monitor common ports and protocols for command and control activity.
2. Enhance monitoring of network and email traffic. Review network signatures and indicators for focused operations activities, monitor for new phishing themes and adjust email rules accordingly, and follow best practices of restricting attachments via email or other mechanisms.
3. Patch externally facing equipment. Focus on patching critical and high vulnerabilities that allow for remote code execution or denial of service on externally facing equipment.
4. Log and limit usage of PowerShell. Limit the usage of PowerShell to only users and accounts that need it, enable code signing of PowerShell scripts, and enable logging of all PowerShell commands.
5. Ensure backups are up to date and stored in an easily retrievable location that is air-gapped from the organizational network.

According to the CISA, these recommendations are not exhaustive, and are intended to describe the actions that “will likely have the highest return on investment.”

Notwithstanding the increase in cyberattacks in 2019, businesses and organizations are still not fully prepared to address the cyber threat landscape. According to the “2019 Security Threats and Trends Survey” published by KnowBe4, “Despite the well-documented increase in cyber threats, 43% of [its] survey participants still don’t allocate a significant portion of their IT budgets towards security expenditures.” Perhaps the warning issued by the CISA will serve as a catalyst for businesses and organizations to reconsider how they can improve their cybersecurity defenses and controls to both defend their businesses and the personal and sensitive information they retain.

Photo by John Salvino on Unsplash