With a new cyber attack or malware infection in the news almost every day, it can seem like a daunting task to protect your business. As the world becomes more connected by technology, cyber security has become a necessity, not a choice. Fortunately, we’re here to help.
At Superfast IT, we’ve been helping businesses with their cyber security for over 15 years. We’ve seen cyber defences change over those years as threats have become more sophisticated and complex.
Consider this page your one-stop shop for everything cyber security. We’ll cover a broad range of topics including;
- What are the Risks?
- Who will Attack you?
- How will they Attack you?
- 12 Cyber Security Controls
- Cyber Security Grader
The first thing we want you to do is to think about your business. How big is your business? Does it have anything of value to a cyber criminal? Are you cyber secure? What do you want to know about cyber security?
What are the risks?
By understanding the risks, cyber attacks can pose to your business it should encourage you to make sure your cyber security is in the best condition possible. Even the most basic cyber security measures are now a necessity, or you will leave yourself open to these risks.
Who Might Be Attacking You?
When you think of hackers, you may imagine somebody sat in their bedroom having not seen sunlight for the last three days trying to breach a system. This couldn’t be further from reality. Cyber criminals are now part of organised groups with a vast amount of resources. They’re not the only people who could be attacking you; it may even be somebody in your office right now.
Who Might Be Attacking You?
Cyber criminals are the likely suspects. They’re interested in making money through online fraud or the collection of valuable information. 
Competitors in both businesses and politics (Foreign Intel) will try to gain information to give themselves an economic or market advantage. 
Hackers will enjoy launching cyber-attacks. Hired for their hacking skills they’re experts at getting past network defences. 
Hacktivists, unlike hackers, will have a motive for their actions. The reasons often get based on politics or a company’s beliefs. 
Not only employees but anybody who has legitimate access to your network. The attacks may happen on purpose out of spite against a company. Attacks can also occur on accident if a user doesn’t have the correct training. How will they Attack You?
Commodity vs Bespoke Capabilities
Commodity Capabilities
Commodity capabilities are tools and techniques for hacking that are openly available online. They can also be used for security testing (Kali Linux, Metasploit) to see how cyber secure you are. Easily accessible commodity capabilities only work because basic cyber security principles do not get correctly followed.
Bespoke Capabilities
Bespoke capabilities are for the most intelligent and advanced hackers. The tools get developed for specific purposes with high detail code that can be effective immediately due to them being specific to the targeted system. Once the hidden bespoke capabilities get discovered, they become known as the previously mentioned commodity capabilities.
Untargeted vs Targeted Attacks
Like there are two types of capabilities there are two kinds of attacks. We’ll look at both untargeted and targeted attacks with different examples of each type of attack.
Untargeted Attacks
Untargeted attacks get massed produced without a real end goal in mind other than trying to hack into an unprotected system. Hackers will not target a set system/user they just want to find unprotected accounts. They could do it for several reasons;
- Finacial gain
- As a hobby
- Data collection
They will try to get into as many accounts at a time and keep repeating this process. Entry-level cyber security measures will block most these attacks.
Targeted Attacks
Targeted attacks target a particular thing such as a specific network or user. The attack could get aimed at an individual user or an entire business. The hacker may have numerous reasons for carrying out the attack;
- Personal Grudges
- Rival company
- Been paid to target you
These take much longer to execute than untargeted attacks and can even take months or years to set up depending on the scale of the attack. The majority of these attacks use bespoke capabilities and often go undiscovered even after the attack.
Types of Untargeted Attacks
Phishing is your typical spam E-mail. Ever had an E-mail telling you, you’ve won a too good to be true prize or amount of money? That’s because it is too good to be true. They’re fake, they just want your bank account details and should be deleted as soon as you get them. They can also tell you about ‘unusual activity’ on your accounts. 
Water holing attacks are the act of setting up a fake website that looks very similar to its real-life counterpart. The sites usually are online E-commerce sites such as Amazon or PayPal that people regularly use with their bank account details. At times the previously mentioned phishing leads to water holing. Once people visit and use these sites, the hackers will have the information sent to them leaving the user vulnerable to cyber-attacks or money fraud. 
This mass attack will infect vulnerable systems before locking the user out of the accounts. The hacker can then demand money or more information before they give access back to the account. 
Scanning tends to be the attack that has the lowest hit rate as it just searches the internet at random. There’s no set direction for the attack as it scans broad areas of the web looking for unprotected accounts. Types of Targeted Attacks
It follows the same guidelines as the previously mentioned phishing except rather than being mass produced. It will target an individual or a company containing specific attachments that appeal to the recipient of the E-mail.
Imagine two people fishing at a pool. A fisherman (phishing) would try to catch any fish in the pool. Meanwhile, a spear-fisher (spear-phishing) would target a singled out fish. 
When a hacker uses a botnet, it will flood the bandwidth of a targeted system(s) with an overload of traffic from multiple sources making the online service unavailable. Attackers build up a network of infected computers then use them to attack a targeted system(s) at the same time. 
Subverting a supply chain is probably one of the hardest ways for a hacker to get access. They try to get their hands-on equipment or software that is being delivered to an organisation and infect it before installation. 
People inside your workplace can be the biggest threat to your business. They can have the account passwords and access to several sources of information that should be kept private.
Workers could have been paid by a third-party source to gather information for them or could do it out of personal spite. They will know how the system works, so it is worth the hackers’ money paying for somebody who is on the inside. 
Download your FREE ebook below
with your IT support needs
