The recent DDoS attack of web hosting company OVH using hacked devices provides yet another example of the escalating security threats faced by businesses. The hackers created a botnet of 150,000 IoT devices to deliver a 1 Terabit DDoS attack, thought to be the largest of its kind – eclipsing the previous record set only a week before when a 620Gbs attack took down journalist Brian Krebs’ website. 

It is clear that the range of security threats are growing both in size and sophistication, and the chance of businesses being hit by an attack is ever more likely. We have laid out the top 5 trends we think businesses need to be aware of in the coming months to ensure they are adequately prepared:

IoT-led DDoS attacks

IoT devices are on the rise, but the security measures to protect them are not. Vulnerabilities in the wave of smart, connected devices flooding the market makes them easy targets for cyber criminals, who are beginning to utilise more and more ‘dumb’ devices, such as CCTV cameras.

The OVH example mentioned above will provide a blueprint for other copycat hackers, who, in a couple of clicks, can harness the power of IoT devices and cause havoc via massive DDoS hacks, capable of bringing down company websites and operations. Organisations must be wary of IoT devices, which, although heralded as the future, ultimately provide another vector for cyber criminals to leverage. Businesses need to ensure that they have a DDoS mitigation strategy in place and clear plan, should they be targeted.

Impending POPI

The Protection of Personal Information (POPI) Act has not yet been enacted, but considering it will take most organisations years to prepare for, it should be on every firm’s agenda. With strict penalties for non-compliance, businesses need to get their IT infrastructure in order fast. Elements within the POPI Act around data privacy, such as the length of time data needs to be kept, might cause problems. This is because, for many organisations, the extent of customer data they actually hold is unknown, both in terms of quantity and location. The biggest challenge organisations face is trying to understand just how much data they are responsible for. Getting caught out by a breach in the future or data demands from customers, could inflict major damage on the bottom line and harm customer loyalty.

Cloud comfort

As a business enabler, organisations are becoming increasingly more comfortable with moving their infrastructure into the cloud. Yet, many security concerns remain. Are companies aware of how to operate securely in the cloud or who even holds the key to their information, considering it no longer resides on premise or in the data centre? Technology is emerging to help organisations securely manage their transition to the cloud. For instance, Cloud Access Security Broker (CASB) solutions apply enterprise security policies across multiple cloud services, giving IT teams control over who can access cloud services, while ensuring company data is sufficiently encrypted.

App security

Organisations with a heavy reliance on apps (i.e. most businesses) need to shift their focus more towards the end user and the protection of credentials. The rise of the mobile worker has resulted in employees using a plethora of apps to access corporate assets from a range of devices and locations. Any weak point in this network, such as a mobile phone infected with malware, can give cybercriminals the key to the kingdom. If a cybercriminal is able to gain an employee’s domain credentials, they can ultimately access all company information. By switching focus and resources to app-level security and user awareness, rather than solely to more old-fashioned firewall approaches, organisations can better secure themselves.

Access management/IDAM

The rise of the cloud has led to an ecosystem of third-party services for businesses to utilise. Employees can access different online portals, from sales, to financial services, to holiday allowance, all with the same single sign on authentication. If an employee left a company, there are concerns that they may still gain access to vital information through their credentials if they are not removed in time. Companies, therefore, need to invest in a Federated Services technology that can provide a single sign on approach where the authentication point resides with the employer and redirects employees back to the cloud service to seamlessly access the application.

By putting themselves in charge of their employees’ credentials, corporations can regain their position as gatekeeper and better protect against fraud.

Failure to recognise or keep on top of developing issues, such as those above, can stop a business in its tracks. Years of best practice and hard-earned customer loyalty can be shredded by a few clicks of a hacker’s mouse. By identifying threats early, investing in the right cyber security infrastructure and educating users about the cyber security landscape, businesses can keep ahead of the hackers and improve the likelihood of 2017 being a successful year.

This month's business articles sponsored by: