Top Cybercrimes of 2020 - How to Prevent them in 2021

As we all know 2020 has been the year of the unexpected. The COVID-19 Pandemic led to working from home, remote education, cancelled events, and panic-buying essentials. Unfortunately, 2020 was also quite a successful year for cybercriminals, with at least 80% of firms seeing an increase in cyberattacks in 2020. Here are three of the top types of cybercrimes for 2020 and how you can prevent them in your organization in 2021. 

Click here to find out about the essential Cybersecurity toolkit.

#1 Phishing Attacks 

Spear phishing email attacks are highly personalized forms of email attacks designed to trick victims into providing personal information. Often, attackers research their targets and craft carefully designed messages impersonating a trusted colleague, website, or business. These emails include links or attachments that contain malware set to infiltrate your computer or network server.

In 2020 alone, 1 in 4 Americans have received a COVID-19 phishing email, according to a report released by OpenText. These emails appeared to be coming from valid and trustworthy sources such as the ,World Health Organization (WHO), asking for donations for their Solidarity Response Fund. The WHO has since released a statement alerting users to beware of criminals impersonating them as they will never ask for login credentials, send email attachments, charge money, or conduct lotteries through email. According to the Federal Trade Commission Americans have lost more than $145 million to fraud related to the coronavirus, fielding over 200,000 complaints from consumers.  

While pandemic related phishing email are on the rise, more versions of these scams continue to exist. In August, 4 individuals ran a phishing attack on Amazon by sending them fake vendor invoices which ultimately cost the company $19 million. Fortunately for Amazon, these individuals were identified and arrested for defrauding the company, but this is rarely the case for phishing scams. 

How To Prevent This: 

There are three important things you should do to prevent your organization from becoming a victim of phishing attacks: (1) using email filtering software, (2)  training your staff, and (3) implementing new procedures. 

(1) Email filtering software, like Barracuda Total Email Protection, will filter through your emails and quarantine the ones that appear suspicious or have known strains of malware. The less phishing emails that land in your employee's inboxes, the less likely the scams are to be successful.

(2) In the event that a phishing email gets past your filtering software, it is important for your staff to know how to recognize one. While phishing emails are getting more difficult to identify, the majority of them will contain a link or attachment, create a sense of urgency, and request some form of payment or information. It is important that you provide your staff with cybersecurity training at least once every year.

(3)  In the event that your staff believes a phishing email with a request for money, your organization should have a set procedure for handling these requests. By requiring that someone in your organization speak on the phone with the person who had a payment request should quickly reveal if the email is valid or a scam.

Read more about phishing attacks: how to recognize and avoid attacks.

#2 Ransomware 

Ransomware has become one of the most popular forms of malware that cybercriminals use to infect networks, lock emails, data, and other critical files until a ransom is paid.  These sophisticated attacks can be extremely damaging causing day-to-day operations to be put on hold and result in financial losses from downtime. 

In 2020, ransomware attacks increased by 40% to 199.7 million cases over Quarter 3 this year, according to cybersecurity firm, SonicWall. Cognizant, an IT services provider, expects to lose $50 million to $70 million following a ransomware attack in April. This ransomware affected their internal networks and impacted their billing system and employee’s work devices. The attack not only cost them money from the legal aid, investigation, and fixing their network, but it also cost them their customer’s trust. 

How to Prevent This: 

One of the most important things you can do to protect your organization from a ransomware attack is taking a look at your current security posture. Run a test on your current system to find potential gaps in security so you can patch them up before a cybercriminal identifies them. By routinely checking your security posture, you can help prevent your organization from being attacked with ransomware, which is projected to hit a total damage cost of $20 billion by 2021. If monitoring and maintaining your security posture isn’t something your organization is prepared to do alone, Managed Service Providers, like Datalink Networks, can do this for you and even offer Free Network Security Scan to show you your organizations vulnerabilities.  

Learn more about information security. Click here to read out Cyber Security 101 guide.

#3 Insider Threats 

Insider threats typically come in two different forms: employee negligence or criminal employees. Negligent users are simply employees who made a mistake such as leaving their work device at a coffee shop, accidently emailing the wrong person sensitive information, or falling victim to a phishing attack. Malicious or criminal users are often disgruntled former employees who intentionally steal or delete data.  According to the 2020 Report by Ponemon institute, the total average cost of insider-related incidents is $11.45 million, making these threats no less costly than other types of cybercrime.  

We can see an example of a disgruntled former employee becoming a major threat in a man named Chrisopher Dobbins. Dobbins worked for a medical device packing company but had been let go in March for unknown reasons. Although the company had blocked his access to their computer systems, Dobbins had created a fake user account during his time there which remained unnoticed. He logged in through this account and edited over 115,500 records and deleted 2,371 records. This disrupted the company's shipping processes, delaying delivery of Personal Protection Equipment to hospitals and other healthcare providers at a critical point in the pandemic.  

How To Prevent This: 

Preventing insider threats requires both types of threats, malicious and negligent, to be taken into consideration. To prevent malicious insider threats from disgruntled employees, such as the case with the medical device packing company, you need to ensure that the number of users on your server matches up to the number of employees who are currently employed. Any additional users should undergo an investigation. For both kinds of threats, your IT team should consider implementing a variety of software such as a password management system, data loss prevention system, web and email filtering, and privileged access management system. You may also want to consider documenting your policies and controls, complete with regular training for all employees in the organization and penalties for non-compliance.  

Click here to read the ultimate guide to building your information security program.

Concerned about your security posture? Get your free Network Security Scan today!