Cyber Griffin: The Cyber threat landscape
Cyber criminality continues to grow in both frequency and complexity. Looking forward in 2022, we expect this trend to continue and that socially-engineered phishing and ransomware attacks will be a prominent feature. We firmly believe that many cyber attacks can be prevented if we focus on building our collective defences against them.
A Brief Introduction: Future Security Challenges
With so many information feeds on the cyber threats of today, the task of defending against them can appear daunting. It can be helpful, by way of summary, to consider these cyber threats in terms of three themes:
Cyber intrusion was the preserve of a minority with the necessary skills to attack a system. Today, we face a broader spectrum of criminals. The biggest increase has been in non-technical attackers, people who buy ‘off-the-shelf’ malware and use basic, well-known attack techniques. This is a useful starting point for us as defenders because it indicates that getting basic security measures in place will have a real impact.
Today’s attacks have a strong focus on financial gain. For many businesses, we can therefore infer that criminals will be motivated to select attacks which end in financial gain, have an attractive ratio of effort vs. success, and present a minimal risk of being caught. This suggests that phishing and ransomware will continue to be key threats beyond 2022. This basic formula is also useful when determining whether any new attack will become a key feature of the threat landscape.
Our approach as defenders needs to recognise two large shifts that we are all experiencing. Firstly, at the network level, the ‘service area’ of businesses, which is to say the number of devices we use (local and cloud-based), is expanding rapidly. Businesses today defend an increasingly large, complex and dynamic digital space. Secondly, our working conditions have changed in the past two years. The COVID-19 pandemic has had several impacts on security, particularly on security culture. Security planning which effectively manages these two shifts will be rewarded for tackling these challenges.
Cyber security intelligence is an extremely fast-paced discipline. Without dismissing this truth, it is also reasonable to suggest that these wider trends are stable. This means that they can be planned for and that we all can all contribute. As with cyber criminals themselves, cyber security is no longer the preserve of technical experts. It is in non-technical areas that some of our greatest security potential lies.
Cyber Griffin
Cyber Griffin, founded by the City of London Police in 2017, supports businesses and individuals in the Square Mile to protect themselves from cyber crime. We are an independent, vendor-neutral service, with direct access to police and Action Fraud databases. We offer four core services: Baseline 3.0, Table Top Exercise, Incident Response Training, and the Cyber Capability Assessment.
Baseline 3.0: Designed to raise attendees’ baseline level of knowledge by providing accessible advice to those with little or no knowledge of cyber security. Baseline 3.0 incorporates the psychology behind hackers and defenders and features the latest advice and insights from industry experts and the National Cyber Security Centre.
Table Top Exercise: An interactive exercise designed to explore the decisions that people make in order to protect their businesses from modern-day threats.
Incident Response Training: Training on how to respond to and manage a critical incident to safeguard against the loss of revenue, reputation, trust, and assets. Cyber Griffin provides first-hand insight into the tried and tested incident response models and methods used today by UK policing.
Cyber Capability Assessment: Using the CDCAT® tool, Cyber Griffin can assess an organisation’s current cyber defences and controls and highlight any capability vulnerabilities.
All Cyber Griffin services are available for free of charge and can be delivered in person or via our digital platform.
Wider policing services
Police forces across the country now have teams who run similar cyber security services and regionally based Cyber Resilience Centres (CRCs) offer a range of support services designed to keep you and your business safe. Please contact your local police force, the Cyber Griffin team or your local CRC to take advantage of the offer to protect you from cyber criminality.
Sgt Charlie Morrison
Cyber Griffin, City of London Police
Email: Cyber.Griffin@cityoflondon.police.uk
