“In this world, nothing can be said to be certain, except death and taxes,” wrote Ben Franklin 1789, nearly 200 years before the arrival of the internet in 1983. If Franklin was alive today, it is a safe bet he would add cybercrime to his list of certainties.
Cybercriminals are constantly evolving their attacks and innovating new ways to breach increasingly sophisticated cybersecurity defenses. Much like a game of whack-a-mole, CPA firms need to be equally diligent to identify and thwart these schemes wherever they pop up.
A good place to start is with this list of what we consider the top five cybersecurity threats in 2023:
1. Business Email Compromise Attacks
Responsible for nearly $2.4 billion in losses in 2021 alone, according to the FBI’s Internet Crime Complaint Center, business email compromise (or BEC) is a form of phishing attack where cyber criminals attempt to trick someone into transferring funds or revealing sensitive information. Unlike standard phishing emails that are sent randomly to millions of people, BEC attacks are crafted to appeal to specific individuals such as bank or credit card customers, making them even harder to detect. The National Cyber Security Centre recommends verifying important email requests using another method, such as a phone call or logging into an account, and being suspicious of urgent emails that contain a veiled threat such as “send these details within 24 hours” or “you have been a victim of crime, click here immediately.”
2. Malware and Ransomware Threats
Expect to see more of this type of activity, particularly related to the conflict in Ukraine and the associated sanctions, according to Forbes Advisor. “Russian state-sponsored organized crime teams that excel at ransomware will help sustain the war efforts.”
Due to the evolving and pervasive nature of malware and ransomware attacks, prevention must start with a cybersecurity risk assessment, according to BDO Digital, along with implementation of the following preventative measures:
- Security software: Advanced anti-virus and anti-malware software is a must for all employee devices.
- System updates: As malware attacks change daily, ensuring system software is always up-to-date and able to handle new challenges can protect against evolving threats.
- Network security: Networks must be assessed regularly to identify weak points and scan for malware, and security must be upgraded regularly for maximum threat mitigation.
- Employee security training: Data security breaches are often the result of human error. Educating employees about malware and how it enters computer systems can help them understand the risks and recognize malware attempts.
3. Zero-Day Attacks
A zero-day attack exploits a previously unknown hardware, firmware or software vulnerability before the vendor becomes aware of it. Since no patch exists yet, these attacks are more likely to succeed. Financial institutions are common targets for stealing sensitive financial information or carrying out fraudulent transactions.
Zero-day vulnerabilities can be challenging to detect. Telltale signs to look for include unexpected traffic or suspicious scanning activity originating from a client or service.
One recent example of a zero-day attack involved a vulnerability found in the popular video conferencing platform Zoom. Hackers used it to remotely access the PCs of users running an older version of Windows and, if the target was an administrator, they could completely take over their computer and access all their files.
4. Smishing
Smishing – a form of phishing that uses text messages or messaging apps instead of email – is on the rise in part because more people are shopping on their smartphones. Like phishing, it begins with an unsolicited message.
People are in the habit of opening each and every text message. But while most workplaces have sophisticated email systems that flag or quarantine suspected phishing emails, the same is not true for smishing. When these mobile devices are connected to a company’s network, the attacker can gain access, stealing customer and employee data.
Hackers have also found ways to get around two-factor authentication, explains a cybersecurity expert at the Healthcare Information and Management Systems Society (HIMSS). As an example, a user clicks on a text link that takes them to a decoy model of their bank’s homepage. As they begin entering their login information, hackers program software to simultaneously input the user’s login information into the real bank website. When the bank website responds with a two-factor authentication code via text, the victim will enter it into the fake website and then the software enters it into the real bank site to instantly gain access.
5. Configuration Mistakes
Even the most sophisticated cybersecurity systems are likely to contain at least one error in how the software is installed and set up. The digitally-native business insurance company Embroker reports 80% of external penetration testing reveals exploitable misconfigurations.
Not knowing whether deployed solutions are working as promised is a largely overlooked security risk, according to the pre-eminent research center dedicated to privacy, data protection and information security policy. The Ponemon Institute found that half of IT experts admit to not having a clear picture of their organization’s cybersecurity posture, meaning they are not performing regular internal testing and maintenance.
Cyber risk is on the rise. Today’s hackers are working relentlessly to develop innovative, more sophisticated cyber-attacks faster than organizations can update their protections. Recognizing and defending against these malicious threats as they emerge requires an ongoing strategy of both internal and external testing and maintenance.
Coaxis Hosting is an endorsed program for the FICPA that provides CPA firms with a fully hosted and managed network solution designed to remove the complexities of federal and industry compliances, curb the demands of maintaining an IT infrastructure, and greatly minimize the threat of cybercrime. The company partners with SXIPHER, a leading ethical hacking company that supports clients in shifting from a defensive to an offensive posture by providing in-house penetration tests. To learn more, visit www.coaxiscloud.com/ficpa or contact Lisa Bryant, executive vice president of corporate development, at (850) 391-1022 or [email protected].
Topics
