Cybercrime today represents a threat with a scale and persistence that hasnt been encountered before. Despite the widespread threat of cybercrime, many people and businesses remain ignorant of the true risks they face and what they can do to combat them. Gaining a greater understanding of the types of cyber crimes can help one understand the importance of cyber security for their business.
The prevalence of cybercrime is more widespread than ever before and shows no signs of slowing down. Cybercrime can and does represent an existential threat to businesses today (which makes establishing a cyber security presence based on industry-accepted best practices extremely important.)
The Landscape of Risk
The landscape of non-physical threats facing modern businesses is vast and multifaceted. The reality is that a cybercrime has the potential to cause financial and reputational damage on a scale that few other crimes or actions by outside parties can match. A cybercrime is a threat to people, businesses, and nations in every economy in the world. Understanding this risk is the first step towards understanding the real scope of cybercrimes and the threat they pose to your business.
Lets start with defining cybercrime because it is sometimes mistakenly believed to include any type of crime that involves the internet. This isnt quite true, as there are some traditional types of fraud that utilize the internet that dont qualify as a cybercrime. While it is true that a cybercrime must be committed using the Internet. In addition to this qualification, the primary target must consist of data, code, or other types of digital material or the motive of the crime must be to disrupt remote systems, infrastructure, services, or the internet itself. Therefore, the cybercrime requires that the vehicle of the attack be the internet, and the target needs to be something that can be attained through such an attack such as data, information, or intellectual property.
Cyber criminals may also be using the attack to disrupt systems or services but not necessarily be trying to steal anything. The true scope of the risk that businesses face from cybercriminals is difficult to fully explain or grasp due to the diffuse nature of a cybercrime itself. The reality is that every computer system in the world is constantly being assailed by cyber attacks. Many of these attacks are automated and have little chances of success. Despite the regularity with which cybercriminals stage attacks, few businesses make their cybersecurity a central concern for their business operations. An important aspect of the risk associated with cybercrime is our ignorance of the level of that risk.
A contributing factor to this is the fact that cybercrimes are underreported, whether because a criminal escapes without being detected, or a company fails to report the crime for fear of the loss of business or trust from their customers. These fears are well-deserved, as cyber attacks targeting the personal information of customers have become more damaging over time. To illustrate this, all one has to do is look to the most recent breach of the credit reporting company Equifax, through which cyber criminals stole the personal information of roughly 148 million people.
The number of crimes covered under the umbrella of cybercrime is staggering, and continue to expand every year. This makes listing every type of cybercrime a futile task, as an exhaustive list is outdated from the moment it is published. Well outline the main risk channels that have been observed so far, but it is especially important to remember that one of the difficulties of combating cybercrime is the rapid pace at which criminals change their tactics, tools, and targets. There is currently a digital arms race between cybersecurity experts and cybercriminals, with cybercriminals constantly developing new tools and methods to perpetrate a crime, while cybersecurity experts must maintain constant vigilance against new and unforeseen threats.
Common Types of Cyber Crime
Cybercrimes affect all industries, but it does so unevenly. Some industries are particularly lucrative for cybercriminals, while others represent high-value targets for both private and state-sponsored cybercriminals. In the following list of cyber crimes, well also discuss the industries they can affect.
Cyber Blackmail
In the past, cyber blackmail was seen more commonly perpetrated against individuals. Todays targets of cyber blackmail are key sectors and industries such as healthcare, finance, energy, and infrastructures like dams, bridges, and power plants. To see an example of this, one needs to look no further in the past than the massive ransomware infections from the malware programs NotPetya and WannaCry, both of which spread rapidly among aging IT infrastructure or poorly secured networks. These ransomware programs carried a payload which encrypted files and required a payment made in cryptocurrency in order for files to be unlocked. Ultimately it is unknown how successful the attackers were, as not everyone is forthcoming about paying the ransom. But what is known is that the attack was successful and lucrative for the attackers, which makes cyber blackmail an increasingly common risk.
Theft of Data
Data theft represents a huge sector of risk for companies in nearly any industry. As the recent data theft involving the credit monitoring bureau Equifax proves, data theft is a persistent threat that must be recognized and accounted for. Data theft can encompass many things, and largely depends on the industry targeted and the type of data that the attackers hope to come away with.
One of the most common types of data theft involves the theft of personal information. Nearly every company today stores vast troves of digital information on their clients, including their purchasing history, name, age, address, email address, and payment methods. All of this information is a rich target for a motivated attacker.
While the theft of personal information is perhaps the most publicly visible type of cybercrime, other forms of data theft targeting intellectual property (IP) are common and widespread. Data theft targeting IP is increasingly being perpetrated by state-supported and sanctioned attackers, which is a wakeup call for large corporations and businesses whose profitability is based on their IP.
The prevalence of data theft targeting IP is difficult to assess, as is the economic damage resulting from IP theft. This is due to the fact that all types of data theft are believed to be underreported, whether due to ignorance that any data was stolen or because knowledge of data theft would result in reputational or financial damage.
Fraud
There are a variety of different types of fraud that qualify as cybercrime. With the rise of eCommerce and electronic banking, cybercriminals are increasingly drawn to committing financial crimes. Fraud most directly affects the financial industry, including banking, payment processing, the vendor, and the consumer. Each one of these points along the transaction is vulnerable to cyber fraud.
Attackers may use a number of tools to get access to payment card information, including attacking poorly secured account databases on the merchants end, interjecting themselves between a shopper and the website through a man-in-the-browser, or leveraging human fallibility through social engineering for identity theft. Staff fraud is also a very real risk for eCommerce and online banking organizations, as it often involves an employee with trusted access.
Regardless of if the attacker is an insider or outsider, fraud is an enormous threat to online banking and eCommerce and represents a huge risk sector for any company or industry accepting payments online. Cyber fraud can be difficult to detect or can go unnoticed for years, further highlighting the importance of implementing industry accepted best practices for securing your payment processing and user account data.
Deleted or Corrupted Data
Not all cybercrimes are carried out with the intention of reaping a financial reward. Some target specific data or databases with the intent of deleting or corrupting files in order to cause damage. The damage caused by these attacks can be physical, economic, reputational, or all three. Data deletion or corruption can be carried out by a state-sanctioned attacker, such as in cases where the attack represents an ongoing effort to destabilize a specific industry or company. This is particularly troubling for key industrial sectors, such as energy, where data deletion or corruption has the potential to disrupt entire power grids. The financial industry is also acutely at risk for this type of cybercrime, as deleted or corrupted account or transaction data can result in reputational and financial harm and loss of consumer trust.
Denial of Service
One of the most high-profile DDOS attacks in recent years targeted the Domain Name Server (DNS) company Dyn. DNS companies are the backbone through which internet traffic is routed and function by translating a website URL into the IP address to which your traffic is routed. The DDOS attack on Dyn in 2016 was highly successful, and affected a number of high-profile companies such as Amazon, Twitter, Netflix, Etsy, and Github to name a few.
DDOS attacks such as the one that targeted Dyn seek to deny access to websites and the services they offer, resulting in economic damage and reputational harm for the affected business. DDOS attacks can also be used as leverage to blackmail an affected company into making a payment to the attacker in order to restore services.
Avoiding Cyber Crimes
Although avoiding cyber crimes is nearly impossible in todays world, there are some strategies you can employ to minimize your risk of being a victim of cybercrime. The most important thing a business or even an individual can do to avoiding cyber crimes is to first recognize the broad level of risk that they face. Cybercrimes are a persistent threat to every business, even those with only a minimal online presence. Mitigating this risk requires acknowledging the persistent nature and wide scope of the risk that a company faces, and then making cybersecurity a top organizational priority. The reality is that in todays world, cyber security should be an integral consideration in all business operations to avoid becoming a victim. Executive management should make cyber-security a top-tier priority, and work quickly to assess their security risks and shore up any vulnerabilities against hackers.
One area of particular focus for companies that utilize online payment processing is to implement globally recognized standards for the Payment Card Industry (PCI). Establishing and implementing PCI Data Security Standard (DSS) requirements and best practices will go a long way towards ensuring your customers payment card information and transactions are safe and secure. At the same time, businesses also need to have a dedicated Qualified Security Assessor (QSA) that can assess and monitor the security and health of their payment card processing. QSAs can ensure compliance with industry recognized best-practices and make targeted recommendations for reducing risk. Additionally, businesses should have their network scanned by an Approved Scanning Vendor (ASV) every quarter.
If your business lacks the manpower, resources, or technical expertise to provide comprehensive cyber-security against hackers, consider outsourcing your cybersecurity to a managed security services organization dedicated to providing cybersecurity services. As the data breaches and hacks in recent memory have continued to increase in scale, the importance of implementing and maintaining a comprehensive cyber-security plan has never been more apparent.
Get A Free Cyber Risk Report
Hackers don’t rest, neither should you. Identify your organization’s cybersecurity weaknesses before hackers do. Upon filling out this brief form you will be contacted by one of our representatives to generate a tailored report.