The 6 Biggest Cyberthreats for 2021 (and How IT Support Can Help)

Introduction

2020 was a difficult year for all of us, but some of the effects of the global pandemic are more visible than others.

Take cybersecurity, for example, did you know that over 20 billion data records were either “lost” or stolen in 2020? Or that the number of breaches doubled since 2019, especially in the latter half of the year?

It’s all true — and it all points to one thing: UK businesses need to be more aware than ever of cyberthreats.

That’s why we’ve compiled this essential list of the 6 biggest cybersecurity threats facing UK business in 2021.

#1: The downside of the work-from-home revolution

There’s no question that IT support teams were stretched in 2020 as businesses were effectively forced into the world’s largest ever remote working experiment.

In 2021, mercifully, most businesses have adapted to the new work-from-home culture and things should (hopefully) be getting easier.

But it’s not just businesses who have adapted. Cybercriminals have also pivoted their approach to target users who may now be working on less secure home networks using mobile apps and digital platforms to share sensitive data.

With less stringent and consistent security measures in place on personal devices, it’s easy to see how employees working from home might fall victim to scams or even direct hacks which expose important company information. While there’s never any foolproof way to eliminate the human element in these threats, you can still mitigate the risks of a remote workforce in a number of ways. Straightforward tactics such as enabling Multi-Factor Authentication are a great starting point, leading all the way up to more comprehensive solutions such as Microsoft Intune.

Knowledge is power here, so it pays to do your research.

#2: Cloud-based software vulnerabilities

With the ability to access our data from almost anywhere and any device, cloud-based technology has transformed the way we work.

But nothing is perfect.

While there are plenty of great reasons to sing the praises of cloud-based solutions, including remote storage services like Dropbox and SaaS workplace platforms like Asana, using such services isn’t without its risks.

Of course, the biggest concern around cloud-based platforms is the fact that your data is no longer held by you on-premises. Instead, it’s sitting in a datacentre somewhere, potentially across the globe, accessible to only those with the proper authorisation. This implies, therefore, a certain level of trust between you as a business and the cloud provider.

What could go wrong? Well… quite a lot, actually.

Cyberattackers could launch “DDoS” (Distributed Denial of Service) attacks which bring down cloud services for a period of time, making your data inaccessible. Or, worse, attackers might launch what’s known as a “Man in the Cloud” (MitC) attack, which involves hijacking your cloud authorisation so that an attacker gains access to all of your cloud files.

It’s worth noting that cloud attacks like these are very rare, but we still recommend protecting your business by establishing a reliable cloud backup system. This way, you can enjoy the full benefit of cloud technology – without the risk of losing your data.

#3: Social engineering cyberattacks

If there’s one thing we all have in common, it’s that we’re human beings.

And, as the saying goes, to err is human. In the context of cybersecurity, that essentially means that – eventually – mistakes are going to be made. This is simply human nature and it’s not something we can easily plan for, just as we discussed earlier – but that doesn’t mean it’s impossible.

The best example in cybersecurity of attackers taking advantage of human error is what’s known as social engineering cyberattacks.

Perhaps best envisioned as a more sophisticated form of phishing, social engineering attacks are really a stable of different techniques attackers use to gain access to accounts and data they shouldn’t. The common thread is that these attacks lead the victim to believe something which isn’t true, which then leads them to provide access to protected accounts or even share data directly.

Here are some of the most common types of social engineering cyberattacks to look out for in 2021:

• Phishing will send messages which appear genuine, causing the user to take actions such as changing passwords. In reality, of course, they’re simply sharing their data with cyberattackers.
• Scareware attacks lead the user to believe their computer is infected with viruses or other threats. From there, the attackers may encourage the victim to call a “helpline”, which will actually do more harm than good.
• Pharming is a form of social engineering which redirects a user to a site which looks totally genuine, causing them to let their guard down and potentially give away sensitive data.

#4: Zero-day exploits

If there’s one thing that can be said about cyberattacks in 2021, it’s that they’re getting faster and more difficult to detect. Why? Because of a renewed focus on so-called zero-day exploits.

A zero-day exploit, as the name suggests, is a type of attack which is entirely new and entirely unique. Such attacks take both users and systems entirely by surprise, often exploiting flaws in software systems which take time to fix. This lag between a software developer learning about a flaw and pushing a patch to fix it can be an open goal for cyberattackers – making zero-day exploits one of the most dangerous attacks online today.

So how do you prepare for potential zero-day attacks as a small business? If they’re entirely new, how can you possibly prevent them? Well, as any good IT support company will tell you, the right cyberattack protection can work wonders. Take Endpoint Detection and Response (EDR), for example.

A good EDR system is so sophisticated that it’ll detect the signs of a zero-day exploit and take action immediately to quarantine, disconnect, or prevent the threat. Sounds a bit like magic, we know, but you can learn all about how EDR works in our Plain English Guide.

#5: “Watering hole” attacks

We know what you’re thinking… warthogs and elephants. But fear not: this has nothing to do with the Serengeti.

“Watering hole” attacks are a more recent addition to the line-up of cyberattacks which businesses and IT support providers alike are having to tackle in 2021.

What is a watering hole attack? In the words of the National Cyber Security Centre, a watering hole attack works by “identifying a website that’s frequented by users within a targeted organisation, or even an entire sector”. From there, the attackers target this single website with the aim of compromising it in a way which means the cybercriminals can place malware on it and take advantage of the trust the user has in the site.

Watering hole attacks hinge on the fact that users implicitly trust certain websites – especially if they use them a lot. So, rather than attacking big targets directly, cybercriminals instead shift their attention to smaller ones which feed (or water) the bigger ones.

#6: The rise of ransomware

Here’s a sobering fact: the number one cause for reported cyberthreats in 2020 was ransomware.

We’ve covered this topic in-depth with our article, What is Ransomware? The Essential Guide for Small Business, but it’s become clear that this form of cyberattack isn’t a passing phase — it’s becoming the go-to attack vector for cybercriminals.

As we covered earlier with social engineering attacks, ransomware often relies on human error to find its way onto unsuspecting computers. Once there, it has the potential to wreak havoc – but it won’t do this straight away. Unlike other forms of malware, ransomware isn’t strictly designed to cause chaos, but instead to spur the victim into buying their way out of trouble.

Encrypting spyware works by locking files on a local computer using an almost uncrackable algorithm, then displays a message letting the user know how to deliver the “ransom” to unlock the precious files.

While ransomware can be devastating, choosing the right cyberattack protection can keep you safe from even the most sophisticated attack. That’s why we always recommend the use of an advanced threat protection system like SentinelOne.

Get ahead of cyberthreats before they strike with an IT support agreement

It’s easy to see why IT support companies like Get Support are busier than ever before – but there’s good news, too.

As you’ve seen, we’re pioneers in technologies like Endpoint Detection and Response (EDR) which can directly prevent and/or address cyberattacks as they happen. In fact, in many cases, EDR can tackle threats before they do any damage.

Want to learn more about EDR or how an IT support agreement could help protect your business from cyberthreats this year? We’re waiting to hear from you. Call us now on 01865 59 4000 or drop your details in the form below and we’ll call you.