The Scary Cybersecurity Risks Keeping the Pros up at Night

It’s a scary time in cybersecurity. From more employees working from home to increasingly inventive cybercriminals, there’s a lot to frighten even the most security-conscious organizations.

For one thing, cyber actors no longer spend their time knocking at your perimeter door with a battering ram. Instead, they prefer to take a much easier, more stealthy route — they simply open a window into your network with ill-gotten employee email addresses and passwords. Once inside, they’re free to do their damage and disappear back into the dark web — like ghosts in the night. Or they sit still, hiding and waiting for the exact right moment to strike.  

In this episode of the Cloud Talk podcast, Matthew Dunn describes one such bone-chilling attack. Cyber actors executed a successful heist of a million dollars from a corporate 401(k). The crime was pulled off by a few clever twists and turns that netted the thieves access to the fund using executives’ own email addresses and passwords.

Dunn is the Associate Managing Director at Kroll, a cybersecurity risk solutions firm. Before that, he spent 20 years as a supervisory special agent with the FBI, including a tenure dealing with cyberthreats. Like telling scary stories around a campfire, he and Rackspace Technology CTO Jeff DeVerter discussed the all-too-real cybersecurity risks facing organizations in this episode of Cloud Talk.

Topics covered in this podcast episode include:

• New and emerging security threats that are keeping professionals up at night
• Cybercriminals’ transition from perimeter attacks to email/password breaches
• Why humans are the weakest links in an organization’s cybersecurity defense
• How COVID-19 created a new world of threats via weak security in employee homes
• How ransomware is impacting life-and-death scenarios in the healthcare industry
• How cybercriminals infiltrated a highly secured casino through an innocuous IoT device
• The best security advice for individuals and corporations to prevent the next attack

From his vantage point of chasing down the bad guys in cyberspace, Dunn has seen how they take advantage of vulnerabilities. “In the case of the investment firm breach, it was not a sophisticated attack,” he explained. “It was basically just a phishing expedition, but with a million-dollar payday,” he says. “Poking around to get their hands on emails and passwords was all it took. These are the types of things I used to see when I was working at the FBI. But now we’re seeing even more of them. Compromising email accounts is still the number one way that bad guys get access to networks.”

What’s more, Dunn says the onset of the COVID-19 pandemic opened up a whole new area of vulnerability — home devices. Cybercriminals wasted no time exploiting this weakness. “When the crisis started, organizations were not prepared to send so many people home to work remotely nearly overnight,” says Dunn. “Companies didn’t have updated remote desktop protocols; their VPNs were unpatched and they had a shortage of corporation-issued devices. So workers were forced to use their own personal devices, the same ones their kids play games on. Things like this scare me because they create too many gaps in our security strategies. And the criminals know it.”