Published on August 5, 2021

The former CEO of Cisco, John Chambers, once said: “There are two types of companies: those that have been hacked, and those who don’t yet know they have been hacked.” And while there have been various cyber attacks (with serious consequences for the victims) in recent years, organizations need to be more prepared than ever before to avoid finding themselves in either one of the above-mentioned groups.

A quick search in your favourite search engine will immediately confirm that several large international businesses have had to deal with the repercussions of a cyber attack in the past year. Don’t kid yourself: cyberthreats—attempts by an individual or group to compromise the security of a computer system by taking advantage of its availability, integrity, and confidentiality—are continually multiplying.

What is the reason for this explosion of cases? The rise in cybercrime is likely the result of the all-out digital transformation deployed by businesses over the past few years. The emergence of mobility and teleworking are also likely to fuel ill-intentioned people’s appetite.

Cyberthreats: who and why?

Cybercriminals are generally greedy. Their greatest motivation? Money! It should be said, however, that many resources are needed to carry out financial fraud and cyber attacks. And certain organizations are well versed in this matter.

Nation states have the ability to significantly plan and coordinate their efforts. In addition to having operational relationships with criminal organizations, they have access to several experts from various fields. They aren’t driven by money; their focus is primarily on geopolitics.

Other perpetrators have more ideological motivations—think hacktivists and terrorist groups.  And contrary to the high level of sophistication deployed by nation states, these two categories of wrongdoers often use widely accessible tools that can easily be deployed with relatively limited technical skills.

But beware: The attacker can also be a cybercriminal—someone who lives off adrenaline could agree to do the unthinkable for fast cash or recognition from their peers. A disgruntled employee could be motivated by their desire for revenge or have been brainwashed by a third party. Their access to internal networks eliminates the need to use other, more advanced technological means.

As you can see, cyber attackers can be categorized based on their motivation and level of sophistication. Here are a few tools at their disposal to help them achieve their goals.

Cyber attacks: a diversified arsenal

1) A variety of malware

Malware infiltrates a network by way of a vulnerability, usually when a user clicks on a dangerous link or an attachment that then installs the malware. Ill-intentioned people can choose from a wide variety of malware—ransomware, spyware, viruses, and trojan horses, for instance—to carry out their attack. The first on the list is currently wreaking havoc within several businesses.

Ransomware: overview

Ransomware attacks often make headlines. The attack that completely shut down Colonial Pipeline in the U.S. in May was a clear reminder of how vulnerable certain critical infrastructures are to this type of threat. Closer to home, the Longueuil company D-Box, known for its vibrating movie-theatre seats, also fell victim to a ransomware attack, which affected its commercial operations.

Ransomware allows a hacker to take your company’s computer system hostage. The hacker in question threatens to divulge the information they have collected unless they are given a large sum of money. Once the ransom is paid, by cryptocurrency, the fraudster will usually send a decryption key to release the system from the malicious code.

Ransomware attacks have been on the rise all over the world, and the damages caused to companies are expected to reach some $20 billion in 2021, according to the Cybersecurity Almanac 2019 report by Cisco & Cybersecurity Ventures.

2) Phishing

Phishing consists of sending fraudulent messages to potential victims. These email or text messages appear to come from a legitimate source. The goal of the ill-intentioned sender is to steal sensitive information, credit card information, or log-in information. The wrongdoers may also be seeking to install spyware on the victim’s device.

In this sense, it is crucial to have employees’ engagement when it comes to raising their awareness of cybersecurity. Inform recipients that they should delete suspicious messages without clicking on any links or opening any attachments. Finally, notify the real institution concerned that their name is being used in phishing attempts.

3) Password cracking

Password cracking is used to gain direct access to specific accounts. A brute force attack is one method used by wrongdoers to achieve their goals. It consists of using a high number of randomly generated passwords to attempt to access the account in question. The second method, known as the dictionary attack, uses common passwords to gain access.

That’s why it’s important for your employees to avoid using passwords such as 123456, for example. Invite your troops to choose complex passwords and activate the multiple-factor authentication whenever possible.

4) Denial of Service attack

A Denial of Service attack (or DoS for short) consists of flooding the servers with high traffic in an effort to block access to resources and bandwidth. The system targeted becomes non-functional—unable to respond to legitimate requests from your clients and consumers. Online shopping and gaming sites are especially targeted by such attacks.

In the event that your business would fall victim to a DoS attack, your ability to make sales would most likely immediately be compromised.  DoS attacks have a direct impact on your company’s profits. And this problem is expensive to fix. It can also affect the quality of your customer service: because customers can no longer access the online support they need, your telephone representatives can expect an increase in calls, leading to an additional wait time for each. The good news is that you can protect your business with a DDoS protection solution.

5) Man-in-the-middle attack

This can also be referred to as an interception attack. Using a public or unsecured Wi-Fi connection or malware, the cybercriminal surreptitiously intercepts an online transaction between two people, getting a hold of the exchanges between them to then decode the content and use it to their advantage.

The man-in-the-middle attack is a passive one: the victim does not need to click on a link, as is the case in phishing attempts. However, if they log on to a restaurant’s Wi-Fi during their lunch break, caution is key. Are the available networks legitimate, or do they belong to a hacker, waiting in the shadows for their next target to bite?

6) Malicious code injections

A Structured Query Language (or SQL) injection occurs when a cybercriminal inserts a malicious code into a server that uses this IT language to gain access to sensitive information. The mere fact of entering such a code into a vulnerable website’s search bar is sometimes enough to access the desired content. This means the database can be consulted, edited, and deleted.

Plus, hackers have other code insertion tricks up their sleeves, some of which can have serious consequences on the victim—think saving typed content or taking control of the computer remotely, for example.

7) Zero-day attack

A zero-day attack occurs when an individual uses a security vulnerability, unbeknownst to the developer or the public. The victims of such an attack will only learn of said vulnerability on zero-day, that is, once it has already been exploited or made public.

When a software is targeted by this type of attack, its developers must quickly identify the vulnerability and establish a corrective to prevent future attacks. However, coming out with an adequate update can take several weeks, making this threat that much more dangerous.

Cybersecurity: Tips for businesses

The list of cyberthreats that are likely to compromise a business is continually growing. And some of these threats are even more complex or have not been very documented as of yet. So if you’ve heard talks of DNS tunneling, logic bombs, or cryptojacking: beware!

One thing is certain, the pandemic provided a unique opportunity for cybercriminals. With businesses quickly going digital and their employees working remotely, wrongdoers—masters of the keyboard hiding behind their screens—were left with various potential vulnerabilities to use to their advantage.

In terms of telecommunications, make sure you have a reliable partner you can count on. There are smart, customized security solutions available to businesses to protect them from external threats without affecting the performance of their IT infrastructures. If your organization plans to continue using teleworking as a solution in the future, a VPN Internet service offers a permanent connection between your teams and your company’s head office.

Finally, keep in mind that the implementation of best governance practices can help you sleep better at night. When it comes to cybersecurity, it’s better to be safe than sorry!