Introduction

We are in an era where cloud-based networks enabling remote access and the frictionless exchange of data, information and digital services, are fundamental to the digital economy, but they bring with them increasing threats.

Unfortunately, no matter how good your security, data which can be remotely accessed, whatever arrangements are in place, is vulnerable, whilst threats to networks are diversifying and proliferating at speed and scale.

Good cyber hygiene and effective cyber security practices can neutralise the impact of most attacks. The reality is that hygiene is hard, and so a level of risk acceptance is required to operate in the digital world; and determining whether you are a target and identifying/protecting your critical assets/information is a fundamental part of managing that risk. Honesty with customers, clients and users is essential to build trust, as is both assurance and accountability.

An open and connected world

Success in the digital and services economy requires speed, innovation, customer experience and delivery – both for clients and employees. Both hybrid working (a must for many employees) and the global marketplace require data, services, and infrastructure to be constantly accessible, information easily shareable, and services easily transferrable. Organisations will be cloud based and internet facing – this is unlikely to change – and this has driven innovation, collaboration and transformation at an unprecedented rate. Moreover, as with many services, organisations often outsource the security of their data and systems to third party providers (payroll, HR, accounting, project management tools) - especially for Software-as-a-Service products. This has bought opportunity and efficiencies but brings risk.

The threat environment

The cyber threat environment continues to diversify and proliferate. The Russian, Chinese, Israeli, and western (UK, US, France etc…) states remain the most capable threat actors in the cyber environment. Alongside Russia and China, both of whom have a proven track record of using state capabilities for commercial espionage and intellectual property theft in addition to strategic operations, sit North Korea, Iran and similar states. Beneath these are state backed or directed actors, such as those organised crime groups in Russia which are supported or protected by the state (such as EvilCorp, REvil, Cozy/Fancy Bear etc) which have less finesse, but significant capability against networks and remotely hosted data/operations.

Of concern is the growing “cyber mercenary” market which is proliferating high end capability to actors. Sat in this space are the independent vulnerability research and exploit chain development houses, most of whom are legitimate bug bounty hunters, but some of whom are tempted to sell on to other threat actors (noting that in most countries, developing and selling an exploit chain is not a crime, only deploying it). And the activist space is improving; entities such as the International Consortium of Investigative Journalists or Bellingcat harness impressive digital forensic, research and data acquisition techniques (including the purchase of stolen or leaked data).

But the most prolific actors remain those organised crime groups, sat beyond or outside law enforcement control or backing, which lack major resources, but are capable of building and deploying malware at scale. In 2023, the global cost of cybercrime was estimated to reach £8.4 trillion annually, with organised crime groups responsible for a significant proportion of these incidents.

These actors can deploy a range of well-known and researched capabilities against networks and individual devices. Ranging from denial of service and brute force attacks, taking advantage of misconfigured hardware, software or infrastructure, poor policies and procedures, to social engineering and careful exploitation of known vulnerabilities. At the top end are zero-day, zero click exploit chains (those where there is no user interaction) against which there is no defence. Taking advantage of as yet undiscovered vulnerabilities, these chains allow the most capable and well-resourced actors to compromise internet facing devices and networks. And this is without considering the insider threat, or considering the unknown, and possibly transformative, effect which Large Language Models, Generative Adversarial Networks, and AI more broadly will almost certainly bring.

Are you in the 1%?

For some organisations particularly those in the banking and finance world (albeit the lessons are universally applicable), there are few alternatives: cyber regulatory and compliance framework dictate technical standards which must be met and audited. But for many organisations, the key question becomes: are you in the 1% - is your organisation likely to be a target from a high-end actor? Do you need advanced protection and more rigorous security procedures? 

Threat analysis and critical pathway analysis are useful in determining: 

• Is your organisation likely to be a target for a high-end actor? 
• What would critically damage your organisation if it were stolen, destroyed, or disrupted by a cyber incident? 

This could include intellectual property (software, hardware, research, trade secrets); client lists (particularly for clients where privacy and anonymity are valued); personal and commercial data for clients who are under threat; and commercially advantageous information.

Contact us today to find out how we can help you manage your risks.