The cyber threat landscape is growing exponentially worldwide, with organizations suffering a series of ransomware and extortion attacks. According to an analysis from the NCC Group, ransomware attacks surged by 288% between January-March 2021 and April-June 2021. The victims of ransomware attacks also suffered data leaks and distributed denial of service (DDoS) attacks, causing additional damages.
Readiness to Defend Ransomware
Many organizations have raised their cybersecurity budgets to defend against evolving threats. However, most companies are failing to implement effective cybersecurity practices to tackle potential security incidents.
The Cybersecurity and Infrastructure Security Agency (CISA) stated that ‘Bad Practices’ increase the risk of hacker intrusions, causing severe damage to critical infrastructure. “All organizations, and particularly those supporting designated Critical Infrastructure or National Critical Functions (NCF) should implement an effective cybersecurity program to protect against cyber threats and manage cyber risk in a manner commensurate with the criticality of those NCFs to national security, national economic security, and/or national public health and safety,” CISA stated in a statement.
Bad Cybersecurity Practices to Avoid
CISA has listed certain bad practices that are extremely risky for organizations that support critical infrastructure for the nation. These include:
- The use of unsupported (or end-of-life) software in service of NCF is dangerous. It significantly elevates risk to national security, national economic security, and national public health and safety. This dangerous practice is especially egregious in technologies accessible from the Internet.
- Use of known/fixed/default passwords and credentials in service of Critical Infrastructure and NCF.
- The use of single-factor authentication for remote or administrative access to systems supporting Critical Infrastructure and NCF is risky and increases the chance of hacker intrusions. Threat actors could easily obtain access to critical systems with poor authentication. Weak or easy-to-guess passwords can be guessed with different hacking tactics like phishing, credential stuffing, keylogging, social engineering, and brute-force attacks.
CISA urged organizations to implement robust cybersecurity plans for better security. The agency also created a discussion page to engage with administrators and IT professionals from industry, federal and state governments, and local governments to gather different perspectives and inputs.
