The biggest cyber attack of 2020 has ‘already happened’

The biggest cyber attack of 2020 has “already happened”, according to the CEO of the Chartered Institute of Information Security (CIISec). 

Words from Amanda Finch, CIISec head, were issued as a wake-up call to organizations to take pre-emptive action against future— and potentially catastrophic— cybersecurity breaches. Ultimately, the vulnerabilities that will underscore next year’s landmark breaches will likely be already brewing. 

“Cyber attacks do not happen in an instant,” said Finch. “From the initial breach to detecting the attack, to eventual resolution, reporting and any action by regulators can take months or even years. 

“As such, the biggest attack of 2020 – that will affect the most people, cause the greatest reaction in the industry, and result in the greatest damage to the organization – has almost certainly already happened.”  

Finch added that the hypothetical breach is “most likely a skeleton waiting to emerge from an unknowing organization’s closet.”

Breaches in the making

The statement serves as a reminder that most breaches can be traced back to human error and a lack of robust policies throughout an organization, despite the security measures the business might have in place. Meanwhile, attackers often enter systems months in advance, remaining undetected, making proactive threat-hunting missions a neccessarily vital part of an organization’s defense. 

2019 has seen no shortage of headline-grabbing data breaches. Perhaps one of the most damaging to a brand was that of Capital One, whose server breach exposed personal information belonging to some 106 million of the bank’s customers and applicants in the US and Canada. 

Among the personal data exposed were names, addresses, dates of birth, credit scores, transaction data, Social Security numbers, and linked bank account numbers.  

This year has also seen a surge in ransomware targeting municipal victims. The attacks, which have taken place across cities in US states, such as New York, Florida, Texas and Maryland have disabled vital city infrastructure and communications— the pace of attacks exacerbated throughout the year, attackers likely heartened by some victims’ willingness to hand over the multimillion-dollar payouts demanded. 

Meanwhile, Norwegian manufacturing giant Hydro (among other firms) was struck by Lockergoga malware. Likely stemming from a misjudged email link click, the entire business was brought offline across 22,000 computers within 170 sites across 40 countries worldwide. 

With cyberattacks continuing to prove fruitful— and methods of hackers ever more sophisticated— 2020 will inevitably witness its fair share of high-profile breaches unfolding. 

“To avoid becoming this victim, organizations need to be sure they can both prevent attacks, and identify the signs of a breach so they can mitigate any damage,” said Finch. 

Cyberattacks can carry an extraordinary level of damage to a business, spanning the legal impact of compromised sensitive data, the damage to reputation and customer trust, and the cost of reparations and down-time. 

Businesses may be tempted to invest in brimming cybersecurity armories— most businesses have 50 defense tools in place at one time, according to Ovum— but an “enormous” part of infosec management comes down to people, Finch said. 

“Organizations must have the right people, with the right skills, occupying the right roles. 

“Investing in equipping staff with the best training – not only in the security team but across the whole organization – will also be critical in defending against attacks. Ultimately, organizations can either prepare for the worst now or learn a very expensive lesson later.”

Even if a business falls victim to an attack, however, proving that thorough mitigation efforts were taken can reduce the various impacts of a breach. 

According to a survey of M&A experts by (ISC)², while 86 percent said a publicly reported breach would detract from an organization’s valuation, a previous breach is not a deal-breaker if the company can demonstrate it acted with the correct procedure at the time.