Daluch Consulting Pty Ltd

01/03/2022

Something we all need to be aware of which, seems to be more prevalent these days, is Invoice Fraud. In essence, scammers intercept a legitimate supplier invoice change the banking details and submit to the customer spoofing the original supplier's email with the added note of highlighting the changed bank account so that everything appears to be legitimate. Naturally, the change is made in systems, invoice processed and paid... and then supplier rings and asks why you haven't paid. The best example is when a guy paid for his new Tesla a few years ago on a Tesla invoice..only to find his payment went to scammers. No money & no car

The solution is before any changes are made to a suppliers details is to check with the supplier directly and don't just trust the email that has been received.

21/03/2021

It is becoming more likely that private & public enterprises will encounter a cyberattack/ ransomeware attack at some stage. The reason is simple - MONEY! These attacks are becoming more lucrative for cybercriminals by the day. My earlier posts have referenced how year-on-year attacks & money paid for an organisation's own data have increased significantly over the last year.

How best then for any organization, especially small to medium to mitigate that risk? Organisations can ensure that their backups are maintained securely offline ( minimises the risk of them being compromised by a cyberattack ) & have effective recovery plans in place. That plan should also be tested on a regular basis.

It's strongly recommended that all organisations conduct regular cyber attack awareness training with their staff & the recovery actions necessary if attacked. With more people working from home & accessing networks remotely those services need to be configured & secured appropriately to minimise unauthorised access.

Organisations consider having Cyber insurance coverage to assist with costs of data recovery, risk mitigation, ransomware payments & Network restoration in the event of an attack.

18/03/2021

Perhaps the only industry that showed significant growth in 2020 was those involved in Ransomware hits. If anything the pandemic meant that could take greater risks which, according to Palo Alto Networks Unit 42 lead to a significant increase in revenue. The average ransomware demand was USD $ 312,493 in 2020 compared to the USD $ 115,123 in 2019. The highest amount officially disclosed as being paid was $ 10 M double that from the previous year. I am aware that one major ASX company was hit twice in the space of a few months early last year.

Hospitals & Healthcare facilities along with government agencies were the most targetted with many suffering the dual-threat of not being able to access their data but the possible release of that encrypted information out into the open. It is not just major companies that are under threat a small Manufacturing company in the US was hit when the network was locked down. The stark choice facing the owner was either pay-up or see his business close and 20 odd staff lose their jobs. He was fortunate in that the cybercriminals were prepared to negotiate the ransom but not everyone is as fortunate. More than likely that 2021 will see that growth continue.

24/02/2021

Malwarebytes recently issued their report on the State of Malware landscape for 2020. As much of the world reacted & adapted to the Covid 19 pandemic so too did those involved in Cybercrime. The tools used by Cybercriminals evolved with the focus shifting to intelligence gathering to better exploit system vulnerabilities.

The pandemic enabled cybercriminals to act more freely and responsively as businesses adapted to employees working from home. Whilst not unique 2020 enabled them to exploit gaps as IT departments struggled with the workloads to maintain security. They did this by exploiting fear through phishing emails that looked like the real thing, gathered their intelligence on system vulnerabilities, building smarter software and modularizing their products for easier distribution.

The Malwarebytes researchers noted that there was a substantial increase in the use of spyware ( up 1677 % on prior year ) to gather information on businesses and industries, with Agriculture seeing a sixfold increase in detections. The precursor, no doubt, to launching ransomware attacks in 2021. Businesses and IT departments will need to become more flexible & adaptable in order to meet these challenges.

16/02/2021

11/02/2021

Since Mid -January there has been a noticeable increase in email phishing campaigns, up 29 % on the same time last year according to Check Point Research. With more folk doing online shopping cybercriminals are taking advantage, particularly when special events occur such as Valentine’s Day.

These scams are usually geared towards buyer fraud through fake webpages that appear to be the real webpage offering product at significantly reduced prices. These are always socially engineered to take advantage of human nature. The things to look out for include;

- The Product on offer appears to be massively discounted
- The email address not aligned to the supposed product supplier
- Minor spelling mistakes in the Suppliers Names, webpage or email
- Unsolicited emails especially those suggesting password resets

 

29/01/2021

In a recent report, Satec analysed the impact that the current technological evolution was having on ITC environments globally, more so for the Professional teams dedicated to the implementation, administration and operation of associated infrastructure that support these services.

What they found was that internal cybersecurity services would grow around 7.2 % whilst external services would experience an 8.4 % increase in spending. The global Cybersecurity market between 2017 and 2026 will grow by 86 % and be worth $ 270 B by then, with 77 % of that spending focused on security services managed by third parties.

The graph is fascinating and terrifying at the same time - fascinating that there will be strong growth over the next 6 years and the associated opportunities that arise. Terrifying that the demand for this is largely being driven by the need to protect one's data & information from attacks by criminal enterprises.

     

27/01/2021

As 2021 starts to build momentum there is still a degree of uncertainty as to how this year will roll out. This time last year the beginnings of the pandemic were only just starting to make their presence felt. Lockdowns slowed economic activity considerably, almost killing off the entertainment, restaurant & travel industries in the process, to the point where quite a significant number of business are now on life support.

The one growth area last year, unfortunately, was in the ongoing threat of cyberattacks. With employees virtually housebound and having to remote work, there were greater risks to businesses networks due to the increased vulnerabilities ( it's also worth noting that phone scammers were able to get 270 % more personal information in 2020 than they did in 2019 - particularly when Governments were offering various payment supports ).

With potential vaccine delays, cyber disruptions to vaccine distribution channels, virus mutations coupled with potential outbreaks ( Sydney's Northern beaches ) there is a strong likelihood that business will extend their remote working plans well into the year. A recent report from Atlas VPN reveals the top growing cybersecurity skills over the next 5 years.

26/01/2021