The passing of another year provides a perfect opportunity to reflect. And, because 2023 marks the 50th anniversary of the incomparable Bob Dorough and the Schoolhouse Rock gang musically, mathematically, and just plain marvelously proving that “Three Is a Magic Number” — here’s a quick look back at three notable cyber security trends and events from the past year.
TikTok Mayhem
The more smart devices, the more apps, and the more apps, the more cyber trouble. The most-downloaded app in 2022, TikTok, is an unfortunate testament to this sentiment. As foreign and domestic security threats from the app steadily increased in 2022, federal and state authorities saw no other option but to act in the best interest of their constituents.
In December 2022, FBI director Chris Wray warned that TikTok could be used for espionage operations and unethical intelligence gathering. To mitigate these security threats, 26 states including South Dakota, South Carolina, Maryland, Indiana, Texas, Oklahoma, Utah, and Alabama signed executive orders and announced cyber security directives to ban the use of TikTok on government-sanctioned devices. State and federal authorities claim that without these regulations, the app presents a clear danger to the security of personal data online.
Due to the questionable nature of TikTok’s data collection practices, other popular social media platforms, like WeChat and Tencent, have also faced intense scrutiny over the past year.
LockBit Gang Apologizes for Attack
A research hospital in Toronto for sick children, known as SickKids, was victim to a rather unusual ransomware attack in 2022. Attackers from the ransomware gang LockBit infiltrated internal and corporate systems, hospital phone lines, and the hospital website on December 18th. According to SickKids, the attack was detrimental to internal processes – causing delays in lab and imaging results and forcing longer wait times for patients.
After the attack, leaders from LockBit ransomware gang issued a formal apology to the hospital and a free decryptor, claiming that the partner who attacked the hospital violated rules and was no longer an affiliate of the gang.
“It is forbidden to encrypt institutions where damage to the files could lead to death, such as cardiology centers, neurosurgical departments, maternity hospitals and the like, that is, those institutions where surgical procedures on high-tech equipment using computers may be performed,” explains the ransomware operation’s policies.
Regardless, the ransomware operation LockBit allows its affiliates to encrypt pharmaceutical companies, dentists, and plastic surgeons without penalty. Under organizational policy, LockBit operators may earn up to 20% of all ransom payments and the rest goes to the affiliates.
According to BleedingComputer, this is not the first time a ransomware gang has provided a free decryptor to a healthcare organization, and it may not be the last. Even still, organizations should always lean on the side of caution; expecting nothing from ransomware attackers but compromised data collections and derailment of internal processes.
Cyber Insurance
In the wake of an unprecedented increase in ransomware events in 2022, being cyber insured became a necessity. Yet, necessity aside, the cost of cyber insurance premiums during the first quarter of 2022 increased by an average of 28%, making them financially inaccessible for some businesses. The increase in premiums can, in part, be attributed to a higher awareness of cyber risks and subsequent demand for cyber coverage by organizations amid the cyber threat landscape. Additionally, after enduring countless security breaches by cyber criminals, who managed to attack layers of security, the cyber insurance industry chose to counteract by tightening up underwriting standards and implementing more monitoring requirements than ever before.
To prevent the depletion of cash reserves by underwriters, cyber insurance organizations are now promoting and even requiring higher level testing and training for employees on phishing awareness, endpoint protection, and alarming password behaviors. The Cyber Security Team at ACP CreativIT would be happy to help set you up with multi-factor authentication and an endpoint detection and response plan to make sure your organization meets the requirements cyber insurance providers are looking for.
Overall, this past year showed us that the world somewhat “adjusted” to post-pandemic life, but still has more than its fair share of cyber security threats and subsequent cyber security responses. Businesses looking to revitalize internal processes, recover from pandemic losses, and expand their clientele are wise to continue using a proactive approach to cyber security, instead of a reactive one. With cloud technology on the rise, cyber criminals are infiltrating security systems, left and right. Meanwhile, inflationary pressures have made it difficult for businesses to adapt to the necessary security solutions preferred by insurers. As organizational security threats ebb and flow, one thing is certain; businesses are learning to be innovative with their approaches to business continuity in the face of security dangers. It’s safe to say the cyber age will only continue to grow and evolve- providing us with opportunities to dig deeper and embrace changes to protect our organizations and employees from the unknown. We also know that history tends to repeat itself, meaning that by analyzing trends and events of the past, we can be better prepared for a bright future in the cyber space.
ACP CreativIT has a dedicated department for cyber security. Whether you are looking to start protecting your business, or you have a solid foundation and want to ensure you are protected for the future, ACP CreativIT can help. Contact us at contactus@cccp.com to talk to one of our security experts today or visit our cyber security page here.
Source: Forbes
Source: CNBC
Source: CNBC
Source: Morgan Lewis
Source: Bleeding Computer