Groundhog Day: Cybersecurity Teams Keep Seeing the Same Shadows

Sometimes cybersecurity is a lot like Groundhog Day. The movie, that is, not the holiday. It repeats itself with predictable results. On a frigid day in the Northeast after Punxsutawney Phil saw his shadow, scurried back into the warmth of his den, and left the people outside to grapple with six more weeks of winter (brr), Tech-Channels looks at five cybersecurity issues that seem to be on repeat.

Ransomware. Despite some pretty bold proclamations nearly a decade ago, ransomware isn’t dead and continues to challenge cyber defenders. Not only do ransomware operators continue to up their game with more sophisticated attacks, and commoditization lowers the bar for nearly anyone with cybercrime on their mind, but AI allows threat actors to launch attacks at scale. And ransomware operators have proven resilient. In fact, they are a little like the character from another holiday movie—"Halloween"’s Michael Myers—knock them down and they get back up, re-emerging under different names.

Unpatched vulnerabilities. News outlets fill the headlines with tales of exploited vulnerabilities, but the ones that rankle and perhaps create the most liabilities for organizations are those for which patches, or fixes, are available, but not implemented (a large credit reporting agency comes to mind). There are a few reasons that organizations don’t update software—some having to do with cost, others with concerns over disruptions and integration, and still others due to poor or no planning. But regulators, customers, boards and investors don’t look favorably on costly problems that arise from threats that have fixes. And now that AI is rapidly shrinking the time (in some cases to hours) between vulnerability disclosure to exploitation, it's better to bear the headaches from updates and modernization than to become a headline.

Phishing. Unfortunately, the success of these attacks/techniques, depends on the trusting nature—or just plain lack of awareness—of human beings, who often click and download with abandon. And, really, some of the newer phishing attempts, thanks to AI and deepfakes, are so realistic that it’s understandable that they can now trip up even the savviest of humans.

Open buckets. Isn’t it time to put servers that expose sensitive information—sometimes reams of it—out of commission? For the most part, they’re often an outcropping of a more nimble, permissive DevOps process that moved outside the protective walls of on-premises development environments. Better hygiene, more rigorous processes and greater attention to where data resides can help strangle this vulnerability. But organizations need to impose and enforce those guardrails.

DDoS attacks. Distributed Denial of Service (DDoS) used to be considered a nuisance that disrupted businesses and perhaps kept customers from accessing accounts and other information. But more recently they’ve continued to do just that—and also serve as smokescreens for other, more destructive crimes (like downloading malware or ransomware). And the answer that once seemed most appropriate—increase bandwidth—is not only inefficient, it’s incomplete.

Unlike Punxsutawney Phil, security teams don’t have the luxury of running away from their shadows and hibernating. These pesky threats will continue well past six weeks and require more than a few shovels, warmer temperatures and some sunshine to dig out. Instead, put best practices on repeat as well—practice good cyber hygiene; know where data is, who’s using it and how; add Sec to DevOps; and patch those flaws.