Beyond the preventive measures we’re all familiar with—and that we take to protect our own health and that of others—there are some that pertain to the health of our… businesses!

I’m going to try to address many of the questions currently being raised by these groups, drawing on factual information gathered from the 350 clients of ITrust, the company I run, which specializes in this field. In other words, real-world insights. This opinion piece may seem naive, but its sole aim is to be, above all, educational.

Undermined by an unprecedented and severe crisis that has led to an economic and social situation that can be described, to say the least, as tense, another risk has emerged and has become increasingly evident in recent months.

However, the number of attacks, thefts, and viruses is literally skyrocketing. It’s harder to find a company that hasn’t been affected than it is to find examples of organizations that have been impacted.

ITrust's teams have observed a 400% increase in attacks compared to the same period in 2019.

Since early 2020, certain sectors have been particularly targeted: healthcare, the high-tech industry, government agencies, and law firms. Hacking, espionage, theft, and ransomware attacks are a daily reality for these companies and institutions, and most of these threats originate from:

  • professional hacker groups—veritable “mafias”—that are often protected or tolerated by the countries that host them: Brazil, Russia, China, Korea, Indonesia, Pakistan, the U.S., Vietnam, and Iran.
  • opportunistic hacker groups: typically specializing in phishing scams, often originating in Africa or South America.
  • individuals or small and medium-sized businesses, specialists in fake emails or social media profiles
  • governments themselves… (Five countries in the world have an official cyberoffensive capability)
  • freelance hackers, students, independent contractors, expert activists, etc.

Most operate through government or corporate contracts. Countries use these “mafia-like” groups to influence their geopolitical interests, carry out subversive actions against competitors, steal technology, and weaken other nations. In the digital Caribbean, allies and enemies are often indistinguishable. Pirates, buccaneers, and privateers are best equipped to plunder colonies without being called to order by governments.

Because … The piracy business is very lucrative.

In 2017, a digital medical record was selling on the black market for $15, and a stolen credit card number for €1.

In March, a "hacker" group demanded 6 million to keep from revealing data stolen from a well-known construction company.

This business can be very profitable and, unlike our well-established companies, requires only a few thousand euros in investment.

All it takes is a small team of experts, and you’re all set. Very high net profits—tax-free, no VAT… We’re even offering you an enticing end-cap promotion: a 10% discount if you pay in full! And we’re providing customer service that’s “unique,” to say the least: advice on how to stop getting… taken advantage of! Pros, in fact…

 In the tech industry, we love statistics, so we analyzed the data from our own customers.

Real-life examples and personal experiences.

100% of customers are constantly subjected to attacks or malicious activity. Of course, we need to distinguish between 

  • Attempted attacks (firewall port scans, intrusion attempts) that affect 100% of companies but are unsuccessful (in our jargon: “cold attacks”)
  • Ongoing real-world attacks: The attack has infiltrated the company and is spreading, but does not necessarily have an active payload or has not yet succeeded in impacting the company. And here, too, we see that 100% of customers are affected! (active attacks)
  • Attacks that were successful and resulted in a financial impact on the company: ransom demands, viruses, theft, downtime (this is classified as a “qualified” attack)

Of course, many companies prefer not to discuss this, and we respect their confidentiality.

Among those that have been targeted by successful attacks, the damage is as follows: 

  • 75% experience a decline in service quality
  • The average cost of a successful cyberattack is estimated at 1.2 billion euros for a medium-sized company (ETI).

A fairly simple comparison can be drawn between the cost of protection—that is, the cost of implementing security measures—and the impact of a successful attack. On average, a protected customer spends 25 KE per year. This prevents a probable loss of more than one million…

Simply put, every euro spent on cybersecurity prevents a loss of 40 euros, with a 100% success rate. Cybersecurity is becoming an investment rather than a cost center.

Did you know that most suspicious attacks originate from within the organization?

The most commonly used techniques are phishing and malware (90%), internal service overload, and application and network security vulnerabilities.

And the techniques with the greatest impact are: DGA, DNS tunneling, XSS, default guest accounts, and an unencrypted AD password database that is therefore highly vulnerable. (In this regard, I refer you to the ITrust white paper on the top 10 security vulnerabilities link)

 The analysis we can derive from this is very interesting. We can draw conclusions that allow us to establish empirical preventive measures which, according to our data, can block more than 90% of malicious attacks!

Indeed, beyond the basic principles to follow—such as setting a strong password (a clever mix of numbers and punctuation that’s easy to remember) or avoiding default passwords for devices or apps (yes, this still happens all the time!), or keeping apps and systems up to date—

We’ll refer to these as essential “hygiene” rules, to stick with our introductory analogy. It seems essential to focus on more substantial and technical protective measures. We see that 100% of companies experience suspicious attacks, and 78% experience successful attacks.

BUT none (0%)—and I mean none—suffer a successful attack when the perimeter is monitored proactively through ongoing vulnerability audits and by a SOC. (ITrust customer statistics over a 2-year period, involving more than 300 customers). 

So it's high time to use a vaccine—one we've found here.

To facilitate its implementation in all companies, to support executives’ efforts in this area, to help them achieve the peace of mind they need to focus on the sustainability and growth of their organizations, and to relieve them of an additional burden by implementing a support policy that is simple, practical, and acceptable in these times of uncertain prospects and complex challenges.

Pointing fingers only leads to division and harm.

Making this a priority to preserve our skills and our communities is also becoming a matter of urgency—admittedly less visible than this dreaded virus that is restricting our lives and affecting our families and friendships, but just as harmful and with long-lasting consequences for our jobs and economic stability, which, as you’ll agree, doesn’t need this added burden…

At ITrust, we’ve created tailored, agile, and specialized solutions. But for companies to be fully prepared, they need financial resources—resources they’re currently directing toward critical priorities that are obvious today, and surely for good reason. But time is running out, and hackers have no time for empathy, taking advantage of stormy seas to line their own pockets by sinking these ships—OUR companies—which create added value and shape our future.  

During the COVID-19 pandemic, we all feel the need to follow preventive measures, to find meaning in what we do, and to protect our families. We are facing extraordinary circumstances that can have a profound impact on our lives. 

A virus that affects us? A digital one? A company that could lose its expertise, its jobs, and affect our children who work there? If we realize that the cost of a mask or hand sanitizer is nothing compared to the protection it can provide for our way of life and our family, the same is true for cybersecurity—the protection of our digital lives. It’s far more important and central to our lives than we can imagine.

 “Protecting yourself is expensive. Not doing so is even more so.” QED…