In today's rapidly evolving digital landscape, the surge in cyber threats and the adoption of sophisticated techniques by cybercriminals emphasise the critical need to remain well-informed about the latest advancements in the cybersecurity realm.
To address this critical concern, our weekly news round-up aims to provide readers with the most significant cybersecurity news stories of the week, from data breaches to new vulnerability disclosures. Stay informed and stay secure!
Business Email Compromise (BEC) Attacks Surpass Ransomware as Major Cyber Threat
In the past few years, there has been a notable transformation in the cybersecurity threat landscape, where Business Email Compromise (BEC) attacks have taken centre stage, surpassing ransomware in prominence. According to Cloudflare's 2023 Phishing Threats Report, financial losses attributed to BEC incidents experienced a concerning 17% surge between December 2021 and 2022. This surge underlines the growing preference among cyber adversaries for employing BEC as their primary method of attack. But why are they on the rise? Our experts have explained everything about BEC attacks on our blog.
Analyst Comments: It is no surprise that Business Email Compromise (BEC) attacks have surpassed ransomware. In recent years, organisations have prioritised implementing measures to protect against ransomware as it was continually the largest threat against entities of any size. As the focus has been on this type of protection, attackers have been exploring other attack vectors where they can be more successful, finding victory in BEC attacks. These types of attacks are reasonably cheap and simple for cybercriminals to do, and there is a high return on investment for them, as can be seen with the large surge in financial losses for the victims. Organisations need to take a holistic approach and make sure that they are not leaving themselves vulnerable by focusing on protecting against one type of attack, such as ransomware.
US SMBs Urge for Cybersecurity Education as Cyber Threats Hit an All-Time High
A recently published global study has found that the most prominent cybersecurity challenge confronting small and mid-sized businesses (SMBs), as well as non-profit organisations, is understanding the constantly evolving threat landscape. Additionally, more than half of these entities are seeking assistance in managing these risks.
The report also found that 44% say economic uncertainty/cost of living has reduced cybersecurity budgets. For already stretched teams, it can be hard to know where to start when it comes to cybersecurity measures. Our experts have compiled a blog with all you know about protecting SMEs from cyberattacks.
Analyst Comments: Small and mid-sized businesses face a difficult challenge when it comes to cybersecurity. They are an easy target for attackers as they are often seen as a weak link that they can exploit to access better-protected, larger suppliers. Another issue is that small businesses do not have the same budget to build a strong cybersecurity posture as larger organisations, giving attacks more of an opportunity to break into their systems. It can be scary for a small organisation, but not all cybersecurity measures will break the bank. There is an opportunity for SMEs to have sufficient levels of protection with solutions that are designed to protect businesses of that size.
Thousands of WordPress Sites Have Been Hacked Through tagDiv Plugin Vulnerability
The susceptible plugin, identified as "tagDiv Composer," is a mandatory component for two WordPress themes: "Newspaper" and "Newsmag." These themes can be obtained through the Theme Forest and Envato marketplaces and have collectively garnered over 155,000 downloads.
Designated as CVE-2023-3169, this vulnerability falls into the category of cross-site scripting (XSS) flaws, allowing malicious code injection into webpages. Discovered by Vietnamese researcher Truoc Phan, the vulnerability carries a severity rating of 7.1 out of a possible 10. It was partially addressed in tagDiv Composer version 4.1 and completely remedied in version 4.2. This issue has led to the compromise of thousands of WordPress sites.
Analyst Comments: This is a new, sophisticated strain of malware, masquerading as a WordPress plugin to create administrator accounts and remotely control a compromised site. It has been reported that over 17,000 sites have been compromised in September alone. This is double the figures in August; therefore, administrators need to remain vigilant. This type of attack will also cause reputational damage to WordPress, with many current and potential new customers choosing to use alternative platforms to ensure higher levels of security.
Fifth of UK Cybersecurity Pros Work Excessive Hours
The Chartered Institute of Information Security (CIISec) has released its 2022/2023 State of the Profession report, shedding light on the state of cybersecurity professionals in the UK. This report, based on interviews with 302 security experts, reveals a mixed picture.
On a positive note, 80% of respondents expressed confidence in their career prospects, rating them as "good" or "excellent." Moreover, more than 84% of those surveyed believe that the industry they work in is either "growing" or "booming."
However, a concerning aspect of the report is the number of professionals working long hours. Over 22% reported working more than 48 hours per week, exceeding the government's upper limit for working hours. While individuals can opt out, the government's guidelines are intended to safeguard the health, safety, and well-being of workers. The data highlights the need for a closer look at the work-life balance and overall well-being of cybersecurity professionals in the UK.
Analyst Comments: It is well-known that some industries struggle with the problem of working excessive hours, which can lead to mental health issues and burnout. Unfortunately, cybersecurity is an industry falling into this category, and there needs to be more awareness of the consequences of working excessive hours. It is, however, positive to see that respondents have confidence in their career prospects and it is an industry where we would hope to see employees feeling safe in their jobs without having to work excessive hours.
In today's ever-changing landscape, staying well-informed about the latest advancements in the industry remains of utmost importance. By staying up to date with relevant news, leaders can make informed decisions, proactively implement security measures, and effectively shield their organisations from cyberattacks. Maintaining a vigilant mindset, embracing best practices, and leveraging cutting-edge technologies are all crucial components in building a secure digital future. Let's embrace these principles to safeguard our digital assets and pave the way for a safer tomorrow.