C2 Fall 2020

$10.5 trillion. That’s what cybercrime is estimated to cost the world economy by 2025.

$10.5 trillion…with a ‘T’. That’s roughly a 75% increase from the $6 trillion that cybercriminals and hacker organizations are already costing us in 2021. Hence why cybersecurity, unpleasant a topic of conversation as it may be, needs to be discussed and dealt with in every boardroom across the country.

James Morrison

We couldn’t think of anyone better to talk about the growing threat to our digital security than James Morrison. A self-taught programmer in the early days of computer technology, James went on to a stellar 22-year career with the FBI, seven of which were spent as a senior computer scientist. Now a cybersecurity technologist and consultant with Hewlett-Packard Enterprise, James possesses an intimate knowledge of the cybercrimes that are affecting an increasing number of businesses and individuals worldwide.

He recently joined us for a webinar turned podcast to discuss the current state of cybersecurity, where companies are most prone to attack and how to mitigate the risk of a data breach. We’re pleased to share three primary takeaways from James’ perspective on where cybersecurity stands in 2021.

1. Ransomware is the current biggest threat to our cybersecurity, and EVERYONE is a target.

Unsurprisingly, ransomware poses a major risk to our most sensitive data. What is essentially digital extortion is becoming increasingly common.

Not two months ago, we all watched as the Colonial Pipeline fell victim to a ransomware attack that cost it $5 million in ransom and all but halted our domestic oil industry. Although the ransom was paid, only a fraction of the data from the breach has been recovered. In fact, on average, hackers only restore 65% of encrypted data after a ransom has been paid, and only 8% of organizations surveyed globally ever see all of their data restored.

Colonial Pipeline’s experience serves as a sobering reminder that ransomware is on the rise. In the past year alone, the average ransomware payment has more than doubled from $761,106 in early 2020 to $1.85 million in 2021. It isn’t just major corporations or organizations that are affected. Many smaller companies are being extorted to the tune of $10,000+ dollars. Further, with workers now shifting to hybrid or fully remote environments, data security has become all the more important to companies of every size.

2. Cybercriminals are becoming increasingly sophisticated.

There are more than 300 different cybercriminal groups operating today, and with cybercrime becoming more lucrative, that number is only going to go up. Like any burgeoning “industry,” the processes and operating procedures of cybercriminals have evolved over time.

In the last year, we’ve seen considerably more sophisticated attacks. Standard data breaches have now turned into double and triple extortion in which hackers not only encrypt your data but also steal it. As many as 75% of attacks in 2021 have included some degree of data theft. Data directly equates to dollars for cybercriminals, so they’ll use any coercive actions necessary to ensure ransom payment.

Mandiant, a prominent American cybersecurity firm, released a 2021 report detailing the multifaceted extortion techniques used by many modern cybercriminals. Frequently, hackers will steal a company’s sensitive data (i.e. client info) and threaten to put it out on a “name and shame” website, where they directly attribute the data breach to the company they stole from. It’s an obvious attempt to solicit more money from the business, which fears the backlash (and erosion of trust/brand equity) that would inevitably result from public exposure of a breach.

Ultimately, as cybercriminals and their means of extortion evolve, so must our methods of security and protection from data breaches.

3. You Risk More by Not Making an Investment into Cybersecurity.

From the perspective of a board of directors or executive team, the issue of cybersecurity is going to come back to budget. They’ll ask themselves: Do we have the capital to devote a portion of our resources to preventative security measures?

What James suggests, when confronted with the budget issue, is to determine how much the risk of a data breach is worth to your company. You may think the investment isn’t worthwhile because insurance will cover you in the event of a breach; however, bear in mind that insurance companies are much less likely to provide restitution for cybercrimes because of their increasing frequency.

Furthermore, you must think critically about what the total cost of a cybersecurity incident would be for your business. That includes not only the ransom paid but also the loss of productivity as the breach is dealt with and your security is being restored. Just look at this chart depicting how much downtime a ransomware attack causes:

This graphic doesn’t even account for the loss of business that will result from a public data exposure.

It’s human nature to want to avoid thinking about the worst-case scenario, but when by James’s estimation roughly three quarters of attacks occur from weak spots in software that could have been patched, the issue has to be addressed.

In Closing…

Click here to watch our full conversation with James.

We’d also love the opportunity to talk with you about transforming your approach to cybersecurity and protecting yourself from an attack. Together, we’ll find the solution you need. Until then, check out the NSA’s top ten security mitigation strategies to keep yourself and your business safe.