Holiday Time - New Cyber Attack Risk for Your Business

The holidays are an opportunity for people to take time off work and enjoy time with family and loved ones. During this period, people's minds are turned away from work that cybercriminals plan sinister attacks. 

Why During the Holidays?

Attackers will never give businesses a breather at any point during the year. The holidays present attackers with the opportunity to plan and execute a successful compromise. Security researchers have reported a 30% increase in the number of attempted ransomware attacks around the globe during the holiday season in consecutive years from 2018 to 2020. There has been a reported 70% increase in attempted ransomware attacks in November and December compared to January and February. Companies are less prepared to fend off a cyberattack with employees having departed for the holidays. 

In addition, employees and other end-users rarely think about cybersecurity when opening emails and surfing the web for holiday deals. Most people will let their guard down in one way or another as they become distracted by the prospect of enjoying the holidays. A distracted end-user and the mindless opening of emails in pursuit of holiday discounts and offers will present attackers with the opportunity to mount phishing scams and malicious advertisements. 

Severely short-staffed businesses as cybersecurity and IT professionals proceed for the vacations are at increased risk. There are fewer resources to address potential challenges, risks, and breaches when they happen. 

The Cybersecurity & Infrastructure Security Agency and the FBI recently released a general alert for businesses to increase vigilance against ransomware attacks during the holiday season. The following are the most common cybersecurity risks during the upcoming holiday season. Organizations must remain on guard to protect their data and operations. 

Ransomware

Ransomware is the biggest threat to companies and their data during the holiday season. The risk of visiting malicious websites and successful phishing attacks increases exponentially, posing a significant threat to businesses. Ransomware is mischaracterized as an encryption problem. However, this misconception undermines the determination and creativity of attackers to break into networks and then crawl within an organization's digital environment to discover, steal and then encrypt data. Ransomware can be very costly to businesses. On average, ransomware attacks cost companies $4.62 million, including notification, escalation, lost business, and response costs. The cost doesn't include the demanded ransom amounts. 

Attackers entice users to click on malicious links carried in phishing emails or perform a drive-by attack using malicious web code on a hijacked website. The two methods act as a gateway for ransomware infection. Notable ransomware attacks on holidays include Memorial Day on JBS, the meat processing giant, and the Fourth of July attack on Kaseya, an IT management software company. 

Businesses can take a few measures to protect against ransomware, including putting in place:

. Application whitelisting

. Least privilege access

. Micro-segmentation

. Strong password policies and breached password protection

. Phishing email filtering

Phishing Emails

Phishing emails are an easy way for attackers to compromise networks. A phishing email will look like communication from legitimate companies. Cybercriminals have become adept at making phishing emails appear like legitimate emails, including logos, wording, images, and styling. A lack of adequate security protections will see end-users click on malicious links and set in motion widespread damage. Without zero trust and micro-segmentation boundaries, ransomware will crawl freely within the network and infect everything a user account has permissions. 

During the holiday season, end-users are click-happy, never taking time to check email communication closely. Attackers are aware of this fact and will send a flurry of emails in an attempt to infiltrate an organization's network with a phishing attack.

The cybersecurity basics - phishing email filtering, disallowed attachments, and end-user cybersecurity training - will protect against phishing attacks.

Data Breaches

Data breaches are another big challenge for organizations across the world. The implications of a data breach can be far-reaching both in terms of impact and financial losses. The costs of data breaches have increased from $3.86 million in 2020 to $4.24 million in 2021. 

Dara breaches will often occur due to malicious cyber-attacks, intentionally and unintentionally. Employees may deliberately or accidentally share data with unauthorized persons. Employees are typically distracted during the holiday season and may expose critical data. The increased threat of ransomware means that data leaks may happen at any time. 

Distributed Denial of Service (DDoS) Attacks

The holidays are also an opportune time to launch Distributed Denial of Service (DDoS) attacks. DDoS attacks have been found to increase around the holidays. Online shopping is a significant thing around the holidays, and it's a time when attackers launch DDoS attacks that are costly to businesses. Organizations need to put network mitigations and server technologies that protect significant DDoS. 

Breached Passwords

Cybercriminals are finding ways to compromise environments using stolen or compromised credentials. It's easier to obtain compromised credentials and mount considerable damage to business-critical data with minimal effort.

The same theme of distracted employees during the holidays is repeated, becoming easier targets. Ransomware attacks are being launched to harvest legitimate credentials and verified user accounts. Attackers also choose to buy user credentials on the dark web to eliminate the hard work of gaining access. 

Compromised credentials are the most commonly used initial attack vector, and they account for 20% of data breaches. Breached passwords are the most expensive cause of data breaches and lead to prolonged data breach lifecycles compared to other types of data breaches. Organizations need to bolster password policies and implement adequate breached password protection. 

Organizations need to bolster their cybersecurity strategies and posture during the holiday season to prevent these listed challenges.