Every 39 seconds a cyberattack is happening somewhere in the world.
And, while cybercrime involving large organisations, like the HSE or Sony, makes headlines; in reality, small and medium businesses are three-times more likely to be victims of attack, due to weak defences. Current cyber threats facing businesses in Ireland, and what can be done to manage them, is the subject of the annual Irish Reporting and Information Security Service cybercrime conference, in Dublin in November.
IRISSCON 2024 takes place on November 6th next, at The Aviva Stadium in Dublin, featuring expert speakers and delegates from all over the world, as well as the popular Cybersecurity Challenge, testing the skills of would-be hackers to break the system! Jake Moore (pic), global cybersecurity advisor for security software company, ESET, is a keynote speaker.
With a 14-year background in the UK police force, in digital forensics and cybercrime, Moore now helps businesses bolster their cybersecurity, blending real-world crime insights and social engineering techniques, with advanced digital security strategy, to combat ever-evolving cyber threats. Attackers have been known to spend over 200 days in an organisation’s network, unnoticed, before launching any sort of attack, he says.
“Once a hacker has breached an organisation’s network through unprotected endpoints, like a mobile phone, laptop or IoT device, it takes around one minute, 84 seconds on average, to move laterally and get deeper into the network.” That is not a lot of time for any network security to react, and, once the harm is done, it takes 73 days, on average, to contain the breach.
“So, the objective is to prevent the network access in the first place.” Ransomware and phishing attacks remain top threats, according to the ESET software developers.
Cybercriminals use AI algorithms to analyse vast amounts of their target segments’ data. They look at social media profiles, online behaviour, recent purchases and other publicly available information to create very personalised phishing and social engineering attacks.
With Artificial Intelligence affecting every single industry, AI obviously benefits cybercriminals too, Jake Moore says. “From text and image creation tools, to audio and video generation, the newest wave of cyberattacks is AI supercharged.
“New defences are needed to protect companies from this next generation of attacks.” The ESET expert’s work with clients begins with some very telling practical examples of their vulnerabilities.
Jake Moore has hacked businesses using AI voice cloning technology, stealing money, completely unnoticed, in minutes. He has also, in the guise of work, hacked a police station.
Having socially engineered his way into the police station, he was able to steal a laptop, break the encryption, hack into the entire network, and change the password of the Head of Professional Standards, without being caught. Moore also engineered a targeted phishing attack, via LinkedIn, on the CEO of a company, illustrating how easy it is to manipulate people into handing over their account credentials, and data, using hacking tools widely available on the internet, (if you know where to look).
Simple social engineering techniques, like psychological manipulation, tricks users into making security mistakes, or giving away sensitive information, so the criminal can take over their email account, website, or even their life, the cybersecurity pro says. Deepfakes are getting easier to make and are the next big tool in the social engineer’s toolkit, the cybersecurity sector insists.
“From hacked CCTV to cloned RFID cards, deepfake technology is used to create new identities or to steal the identities of real people”, Jake Moore explains. Attackers create false documents, or fake their victim's voice, so they can hack systems, create accounts, get information, or purchase things by pretending to be that person.
From the malicious spread of misinformation to financial crime, IRISSCON 2024 delegates will hear how deepfake fraud is becoming more sophisticated, and difficult to identify, and how tech security in business can, and must, stay a step ahead of the hackers.