Use hackonomics to ensure your business is less enticing cyber target than competitors, advises Centre for Risk Studies

Experts from the University of Cambridge advise corporates to use hackonomics to assess whether they are likely targets for cybercriminals and ensure their own security is at least on par, or preferably better, than protection in place at competitors. Laying out the cyber risk landscape for 2018, the experts said supply chain attacks are the most worrying trend facing companies, warned that cybercrime as a service continues to bring down barriers to entry for hackers, and explained that cyberterrorist capabilities remain weak. Leading researchers and academics from the Centre for Risk Studies, which is part of the Judge Business School at the University of Cambridge, presented key findings from cyber research at its Risk Summit 2018 in London yesterday. In his ‘Threat Actors in the Cyber Black Economy’ presentation, Andrew Smith, research assistant at the centre, advised companies how they can use academic research and hackonomics to reduce cyber risk in the real world. Mr Smith said companies can use the information to understand which companies are targeted by cybercriminals and why, before considering if they are likely to be chosen ahead of competitors and taking further mitigation actions if so. “Hackonomics allows us to understand the targeting decisions of hackers. If you are a corporation or an organisation, you could look at third actors’ motivations and capabilities and match that with the characteristics of your organisation. You can then see if you are a likely target for these groups and whether you have enough defence in place,” said Mr Smith. He explained that cybercriminals’ targeting decisions are, unsurprisingly, based on a cost-benefit framework where the logistical burden of breaching defences is weighed against the expected benefits. As a result, a key consideration for companies is target substitution and the fact that threat actors will take the path of least resistance, Mr Smith continued. “One of the key things to look at is your security relative to the next best alternative. Therefore, from a cybersecurity perspective you should be looking at your competitors around you to see if you at least have the same level of security in place, if not better, than those in your sector,” advised Mr Smith. He also said those in the risk space should understand how future trends can alter the fragile equilibrium between cyberattackers and defenders. The researcher added that cyber risk is often viewed through the prism of technology but is, in fact, an entirely a man-made phenomenon. It is imperative that we all understand the criminals to get to grips with this threat, said Mr Smith. Laying out the cyber risk landscape for 2018, Dr Jennifer Daffron, research associate at the Centre for Risk Studies, named internationalisation of cybercrime, the cryptocurrency gold rush, multiplicity of ransomware, cybercrime as a service and supply chain attacks as five key areas to watch. She said cyberattacks on supply chains are “the most interesting and yet worrying” trend facing companies. She stressed that organisations are only as strong as their weakest link and therefore vendors present a “huge risk”. Cyberattacks on the supply chain are difficult to detect while defences are often weaker and therefore more easily breached, said Dr Daffron. The academic noted that the huge cyber breach suffered by US firm Target in 2013, which eventually saw its CEO resign and cost the company more than $150m, was traced back to a third-party heating, ventilation and air conditioning vendor. She put forward figures that show 56% of organisations have had a breach caused by one of their vendors. Dr Daffron said the global impact and internationalisation of cyber events were highlighted by ransomware NotPetya last year and that this sort of cyber threat is “not going away anytime soon”. She explained that cryptojacking, whereby criminals illegally mine for cryptocurrency, is a risk to watch and that ransomware attacks are only likely to get worse under the General Data Protection Regulation, because criminals will be able to leverage potentially heavier fines to their benefit. Dr Daffron also told the audience that cybercrime is increasingly being offered as a service. This is reducing the cost of hacking and expertise needed to breach security, in turn “dramatically changing” the risk landscape, she said. Dr Daffron explained that an internally developed zero-day exploit costs hackers about $1m whereas a commodity zero-day exploit, bought on the cyber black market, costs just $5,000 to $100,000. A zero-day exploit is an attack that exploits a previously unknown security vulnerability that leaves no time between that vulnerability being discovered and the attack taking place. Meanwhile, hackers can pay just $7.99 a month to subscribe to a programme that tells them whether their malware will be stopped or detected by antivirus software, Dr Daffron explained. Mr Smith said the development of the cyber black market has changed the business model of cybercriminals, with more relying on outsourcing to lower the costs and skill level needed to perpetrate attacks. “This has reduced the barrier to entry and made it easier to launch cyberattacks so they have increased in number,” he told delegates at the Risk Summit. Mr Smith explained that there are an estimated 18 active markets in the cyber black economy that have seen the emergence of cybercrime as a service business model. The black market offers access to stolen records, zero-day exploit kits, malware and mercenary hackers, he explained. Tamara Evan, research assistant at the Centre for Risk Studies, said cyberterrorism is an emerging threat but there remains a gulf between the intent and capability of cyberterrorists. “Acts of cyberterrorism are possible, however the means to carry out attacks is currently not supported,” said Ms Evan during her ‘Cyber Terrorism Threat Intelligence and Loss Modelling’ talk. “There is little evidence to suggest current terrorist groups have invested significant time or capital into the development of sophisticated physical cyberattacks,” she added. Ms Evan explained that there have been no known instances of cyberterrorism in 2018 that meet the Centre for Risk Studies’ definition of such an attack. She said future cyberterrorism is likely to fall into one of two categories – explosive, high-damage single attacks on major physical assets such as chemical processing facilities, or high-frequency attacks on a wide area such as instigating fires in commercial office buildings.

Use hackonomics to ensure your business is less enticing cyber target than competitors, advises Centre for Risk Studies

Want to read this article?

Read Next

Fitch shifts state-linked Chinese insurers to negative outlook

Singapore regulator acts to bolster cyber resilience

Aon names Sapra head of reinsurance solutions India

Supporting net zero – is it enough?

SEC climate-related disclosure rules on hold

Fitch shifts state-linked Chinese insurers to negative outlook

Singapore regulator acts to bolster cyber resilience

Aon names Sapra head of reinsurance solutions India

Supporting net zero – is it enough?

SEC climate-related disclosure rules on hold

Want to read this article?

Read Next

Fitch shifts state-linked Chinese insurers to negative outlook

Singapore regulator acts to bolster cyber resilience

Aon names Sapra head of reinsurance solutions India

Supporting net zero – is it enough?

SEC climate-related disclosure rules on hold

Related Articles