Cyber attacks are never far from the news. A posting on computer security company IT Governance’s website at the start of January 2023 noted that there were 42 serious assaults in December 2022 including a ransomware attack on The Guardian newspaper, the same on Uruguay’s Ministry of Transport and Public Works, and a cyber attack on California’s Department of Finance.
Such events can be disruptive: A ransomware attack on tech firm Rackspace in the same month not only locked 30,000 subscribers out of their email accounts, but some of their data was lost too.
Of course, these are just some of the more well-known events and there are a multitude of attacks on countless small organisations that never make the headlines.
The problem is a real concern for the (UK) government. Its own Cyber Security Breaches Survey 2022, published in July 2022, found that of the 39% of UK businesses who identified an attack, the most common method was a phishing attempt, however, nearly a fifth identified a more sophisticated attack type such as a denial of service, malware, or ransomware attack. But despite its low prevalence, organisations considered ransomware to be a major threat, with 56% of businesses having a policy to not pay ransoms.
While cyber attacks are not only inconvenient and potentially destructive, they can be expensive to resolve. The government’s survey reckoned that where there is some form of material outcome, such as loss of money or data, the average estimated cost over the last 12 months was £4200. But when looking at events that affected only medium and large businesses, the figure rose to £19,400. These figures are based on known data – the unknown is bound to be very much larger.
As to the overall impact of cyber attacks, Comparitech, a pro-consumer website, found that they are forcing firms to spend heavily on combatting the threat, with UK firms investing an average of 11.3% of their IT budget on solutions. While that seems like a large proportion, it is much less than the 15.3% spent by firms in Turkey or the 15.6% spent by organisations in Brazil. French firms only spend 10.7% in comparison.
When it comes to attacks that are successful, a worrying 13% of UK firms go on to pay the ransom demanded. But while that proportion also seems high, it pales into comparison to organisations in India (66% pay up), Sweden (50%) and the Philippines (32%). In terms of the cost of the ransom, cybersecurity firm Sophos found that the average cost for UK organisations was more than £900,000.
There are, however, options for firms wanting to protect against cyber-based threats. The government’s National Cyber Security Centre says that exposure can be reduced by the introduction of firewalls and internet gateways that prevent intrusions and block access to malicious downloads and websites; the frequent patching of known and newly-discovered vulnerabilities; preventing unknown software from running; restrictions being placed on devices (computers, phones etc.) and operating systems; instituting a robust password policy; and limiting users access rights to systems.
Beyond that comes the advice to train staff to be aware of the risks associated with cyber attacks, and also to be aware of the risks that come from social engineering where external individuals manipulate staff into opening systems up to external threats.
And it shouldn’t be forgotten that an attack opens an organisation up to a data breach and data protection law can lead to regulatory intervention. This is a point noted by the DLA Piper Data Breach Report 2022. It found that, since the introduction of the General Data Protection Regulations, the UK has issued €45,350,000 worth of fines. Again, while this seems high, Luxembourg has levied an astonishing total of €746,299,400 while Ireland is second highest with €226,046,500 worth of fines.
The message is clear: cybersecurity is a threat that cannot be ignored, no matter how small the target organisation is.