Covid-19 has shined an uncomfortably bright light on the state of cyber security around the world. As early as March 2020, Deloitte found that the pandemic led to increased security risk from remote working, delayed cyber-attack detection and response, gaps in physical and information security, and an influx of cybercriminals. Since the start of the pandemic, there has been a 300% increase in reported cyber-crimes.
In addition, the increased popularity of crypto currency has enabled a larger community of cybercriminals to drive ransomware attacks. The ability to hide the ransom payment using unregulated currency has proven to be one of the key attributes of the crypto world being exploited by cybercriminals.
Despite the fact that the move to remote working increased the risk of cyber-crime for companies of all sizes, their largest vulnerability is the fact that they use Microsoft as a platform for most things, says Richard Firth, CEO of MIP Holdings. “The vulnerabilities in various Microsoft products are the biggest source of cyber-attacks worldwide. Approximately 1.5 billion people use Windows operating systems every day, and the number of reported Microsoft vulnerabilities has risen a whopping 181% in the last five years. In 2020 alone, 1268 Microsoft vulnerabilities were discovered,” he says.
“Many companies think that if they patch their software, they are fully secure. This is not the case. Several Microsoft issues may or may not receive a patch, and some are configuration issues that can’t be patched. On GitHub, there is an entire ‘won’t fix’ list of security issues that Microsoft has either not yet patched, won’t patch, or are issues that need manual adjustment to fix.”
Firth adds that many organisations are building a “Microsoft everything” strategy, by using Microsoft throughout their architecture. The logic is sound, he says. It is easier to use all the components that Microsoft have built to easily integrate into one delivery method, but now think about the ease by which a vulnerability can be spread throughout the organisation! This will increase the scope of a cyber-attack in the future, as cybercriminals continue to focus on the most widely used platform in the world.
“Most vulnerabilities are on Microsoft Exchange Servers, but all Microsoft products have been targeted by criminals. Check Point Research, for example, recently found four security vulnerabilities that affect products in the Microsoft Office suite, including Excel and Office online. Rooted from legacy code, the vulnerabilities create the potential for an attacker to execute code on targets via malicious Office documents, such as Word, Excel and Outlook.”
As cyber-attacks continue to rise, and as they have a bigger impact on businesses and customers alike, companies will have to take a careful look at their choice of technologies, saysFirth. “According to Ponemon’s State of Cybersecurity Report, the long tail costs of a data breach can extend for months to years and include significant expenses that companies are not aware of or do not anticipate in their planning. These costs include lost data, business disruption, revenue losses from system downtime, notification costs, fines associated with government regulations designed to deal with breaches of ’Protection of Personal Information’ or even damage to a brand’s reputation,” he explains.
“Microsoft offers a ‘secure’ version of its products, at an additional cost. This would move a software development company such as MIP from a cost of U$20 per employee per month to a total cost of U$57 per employee per month. While many companies might see this as an investment in security, the fact that the secure version costs almost three times as much as the ‘normal’ version raises questions. There is no guarantee that the secure version will keep out all attackers – there isn’t a single product on the market that can do that – so additional tools will still be required. In fact, I would ask if this is any different to ‘Microsoft’ ransomware. Microsoft is charging almost triple for a product that will still require additional investment to secure, effectively taking advantage of their poor networking tooling to make extra money.”
Firth points out that some industries are more vulnerable to cyber-attacks than others, simply due to the nature of their business. While any industry could be subject to a data breach, those most at risk are businesses that are closely involved with people’s daily lives.
“Companies that hold sensitive data or personally identifiable information are common targets for hackers. These organisations have already invested heavily in their security, so why should they pay extra for a secure version of the tools that their businesses use daily? Shouldn’t the secure version be the standard version?” Firth asks.
To connect directly click here
COVID-19 imeonyesha kwa njia isiyo ya kawaida hali ya usalama wa mtandao ulimwenguni. "Kama mapema Machi 2020, Deloitte iligundua kuwa janga hilo lilisababisha kuongezeka kwa hatari ya usalama kutokana na kufanya kazi kwa mbali, kucheleweshwa kwa kugundua na kujibu mashambulizi ya mtandao, mapungufu katika usalama wa kimwili na habari, na kuongezeka kwa wahalifu wa mtandao. """ Tangu kuanza kwa janga hilo, idadi ya makosa ya kibiashara ya mtandao imepanda kwa asilimia 300. Kwa kuongezea, kuongezeka kwa umaarufu wa sarafu ya crypto kumeruhusu jamii kubwa ya wahalifu wa mtandao kuendesha mashambulizi ya ransomware. Uwezo wa kuficha malipo ya fidia kwa kutumia sarafu isiyo na udhibiti umethibitika kuwa moja ya sifa muhimu za ulimwengu wa crypto unaotumiwa na wahalifu wa mtandao. "Licha ya ukweli kwamba kuhamia kwa kazi ya mbali iliongeza hatari ya uhalifu wa mtandao kwa makampuni ya ukubwa wote, udhaifu wao mkubwa ni ukweli kwamba wanatumia Microsoft kama jukwaa kwa mambo mengi, ""alisema Richard Firth, Mkurugenzi Mtendaji wa MIP Holdings." <unk> Udhaifu katika bidhaa mbalimbali za Microsoft ni chanzo kikubwa cha mashambulizi ya mtandao ulimwenguni kote. Takriban watu bilioni 1.5 hutumia mifumo ya uendeshaji ya Windows kila siku, na idadi ya udhaifu wa Microsoft ulioripotiwa umeongezeka kwa asilimia 181 katika miaka mitano iliyopita. Katika mwaka wa 2020 pekee, udhaifu wa Microsoft 1268 uligunduliwa. <unk>Kampuni nyingi hufikiri kwamba ikiwa zitabadilisha programu zao, zitakuwa salama kabisa. Hilo si kweli. Masuala kadhaa ya Microsoft yanaweza au hayawezi kupokea patch, na baadhi ni masuala ya usanidi ambayo hayawezi patched. "Kuna orodha ya ""haitakuwa kurekebishwa"" ya masuala ya usalama ambayo Microsoft haijawahi kurekebisha, au haitaweza kurekebisha, au ni masuala ambayo yanahitaji kurekebishwa kwa mkono. "" Firth anaongeza kwamba mashirika mengi yanajenga mkakati wa ""Microsoft kila kitu"" kwa kutumia Microsoft katika usanifu wao wote." Anasema kwamba jambo hilo linaeleweka. Ni rahisi kutumia vipengele vyote ambavyo Microsoft imejenga kwa urahisi kuunganisha katika njia moja ya utoaji, lakini sasa fikiria juu ya urahisi ambao udhaifu unaweza kuenea katika shirika lote! Hii itaongeza wigo wa mashambulizi ya mtandao katika siku zijazo, kwani wahalifu wa mtandao wanaendelea kuzingatia jukwaa linalotumiwa sana ulimwenguni. Vibaya vingi viko kwenye Microsoft Exchange Servers, lakini bidhaa zote za Microsoft zimekuwa lengo la wahalifu. Utafiti wa Check Point, kwa mfano, hivi karibuni uligundua udhaifu nne wa usalama ambao unaathiri bidhaa katika Suite ya Microsoft Office, pamoja na Excel na Ofisi mtandaoni. "Kutokana na kanuni za zamani, udhaifu huo unaunda uwezekano wa mshambuliaji kutekeleza kanuni kwenye malengo kupitia hati mbaya za Ofisi, kama vile Word, Excel na Outlook. ""Kama mashambulizi ya mtandao yanaendelea kuongezeka, na kama wana athari kubwa kwa biashara na wateja sawa, makampuni yatalazimika kuangalia kwa uangalifu chaguo lao la teknolojia." Kulingana na Ripoti ya Hali ya Usalama wa Siber ya Ponemon, gharama za mkia mrefu za uvunjaji wa data zinaweza kupanuka kwa miezi hadi miaka na ni pamoja na gharama kubwa ambazo kampuni hazijui au hazitaraji katika mipango yao. Gharama hizi ni pamoja na kupoteza data, kuvuruga biashara, hasara ya mapato kutoka kwa wakati wa mfumo, gharama za taarifa, faini zinazohusiana na kanuni za serikali zilizobuniwa kushughulikia ukiukaji wa "Ulindaji wa Habari za Kibinafsi" au hata uharibifu wa sifa ya chapa, anaelezea. <unk>Microsoft inatoa toleo <unk> salama <unk> ya bidhaa zake, kwa gharama ya ziada. Hii itahakikisha kuwa kampuni ya programu kama vile MIP inazidi gharama ya $ 20 kwa kila mfanyakazi kwa mwezi hadi $ 57 kwa kila mfanyakazi kwa mwezi. Wakati makampuni mengi inaweza kuona hii kama uwekezaji katika usalama, ukweli kwamba toleo salama gharama karibu mara tatu zaidi ya toleo la "kawaida" huinua maswali. Hakuna dhamana kwamba toleo salama itaweka nje washambuliaji wote <unk> hakuna <unk> bidhaa moja kwenye soko ambayo inaweza kufanya hivyo <unk> hivyo zana za ziada bado zinahitajika. Kwa kweli, ningependa kuuliza kama hii ni tofauti na "Microsoft" ransomware. Microsoft inatoza karibu mara tatu kwa bidhaa ambayo bado itahitaji uwekezaji wa ziada ili kupata usalama, kwa ufanisi kutumia zana zao za mtandao duni ili kupata pesa za ziada. <unk> Firth anaonyesha kwamba sekta fulani ni zaidi ya kuathiriwa na mashambulizi ya mtandao kuliko nyingine, kwa sababu tu ya asili ya biashara yao. Ingawa sekta yoyote inaweza kuwa chini ya uvunjaji wa data, wale walio katika hatari zaidi ni biashara ambazo zinahusika kwa karibu na maisha ya kila siku ya watu. <unk>Kampuni ambazo zina data nyeti au habari za kibinafsi ni malengo ya kawaida kwa wahasibu. "Wanajamii wamewekeza sana katika usalama wao, kwa nini walipe zaidi kwa toleo salama la zana ambazo biashara zao hutumia kila siku?""" Je, toleo salama haipaswi kuwa toleo la kawaida? Firth anauliza. Kuunganisha moja kwa moja bonyeza hapa