Happy Holidays: How time flies when you’re having fun!

How time flies

It’s coming up to a year since I started writing for the SolCyber blog.

As I wrote in my first article (this is my sixtieth – I just counted them!), what really attracted me to SolCyber in the first place was the human-centric approach of the company.

To quote from the main page of the SolCyber website:

Businesses don’t need more security tools; they need transparent, human-managed cybersecurity and a trusted partner who ensures nothing is hidden.

This resonates strongly with me, for the reasons I declared in that article at the start of 2024:

I’ve been fighting cybercrime for more than 30 years, right from the earliest days of computer viruses, and even though I’ve spent a large part of my adult life helping to reverse-engineer malware and to invent and build software that detects and stops attackers automatically, I’ve never slipped into the opinion that technology alone is enough to get the upper hand against cybercriminals.

Whenever the industry has found itself getting carried away with cybersecurity slogans such as “set and forget”, or “never needs updating”, or “buy our next-generation closed-loop deep-learning multi-layer cross-platform self-healing one-pane-of-glass auto-remediating cloud-native threat prevention system”…

…it has made me more determined than ever to remember the saying that those who cannot remember the past are condemned to repeat it.

Clear and present dangers

We do face genuine dangers posed by the always-on availability of processing power and network bandwidth provided by the cloud, combined with the explosive power of attacks enhanced by the increasingly believable copy-cat content churned out by generative AI engines.

However, to quote once again from that first article of mine:

[Cybercriminals] have indeed learned to use the best (by which I really mean the very worst) hands-off, fully-automated techniques to find new victims. But they have also learned to combine this approach with the optimum (by which I mean the most devious and deceitful) hands-on-the-keyboard treachery in order to cause the most trouble to, and to extract the greatest cost from, those victims they decide to attack.

Most cybercriminals are no longer just rogue programmers with axes to grind, like the first malware writers were back in the 1980s and 1990s, determined to take out their pent-up social, technical or political frustrations on an unsuspecting cyberworld by trashing hard disks, corrupting data, popping up infantile messages, or making unfunny jokes at our collective expense.

Malware and cyber-attacks are now almost all about making money illegally, stealing intellectual property to compete unlawfully, snooping on staff for industrial espionage, luring would-be investors into financial scams, manipulating incoming and outgoing payments to defraud suppliers and their customers at the same time, dishonestly acquiring political or commercial advantage, and much more.

With that in mind, cybercriminals haven’t forgotten the significance of humans in computer security (or, in their case, the significance of humans in computer insecurity), to the point that we’ve even developed cybersecurity jargon to remind us of the tricky problems that arise when automation is combined with human artifice, including:

• Human-led attacks. That’s where criminals don’t rely only on automation to take over an entire network, but carefully – though often very rapidly – set themselves up to look like legitimate insiders: self-appointed sysadmins who go out of their way to fit in, so their malevolence doesn’t trigger any obvious alarms.
• Living off the land. That’s where criminals who are already in your network don’t download and install malware, or any other new and unexpected software tools. Instead, they find legitimate tools that are already installed, such as low-level operating system utilities, network scanning software, and official system management services, that won’t stand out as unusual when they show up in security logs.
• Social engineering. That’s where attackers dedicate personal time to working one-on-one with individuals inside an organization to lure them (or scare them, or even to bribe them if they think that might work) into giving away passwords, installing remote access software, swapping mobile phone numbers, and numerous other tasks that the individual knows they shouldn’t do, but are manipulated into doing anyway.
• Initial access brokers. IABs, as they’re known, don’t generally themselves get involved in ongoing cyber-attacks such as ransomware or industrial espionage. They simply steal or buy up information such as passwords or lists of vulnerable servers that they sell on to other attackers who want to commit those types of cybercrime.

What to do?

The good news in all of this apparent doom-and-gloom is that if we work collectively to get the basics right, or to help our colleagues, friends and family to get the basics right if they look to us for advice and support, we can make things much harder for the cybercriminal community.

With that in mind, we decided to choose seven useful, community-focused articles from the past year, all of which include plain-English, human-centric tips on how to push back against cybercriminality:

1. If automated tools let more than 1 in 4 fake LinkedIn account registrations through, what can we humans do to help close the security gap?

2. If your phone is stolen while it’s unlocked, you could end up worrying about way more than the value of the phone…

3. What sort of data collection is “fair and reasonable” when it’s your car doing the collecting?

4. Romance scams often lead to victim blaming. What can we do to avoid them, and to keep our own vulnerable friends and family safe?

5. Dire cybersecurity warnings about QR codes are commonplace, but is the risk really as bad as some vendors are saying?

6. Do you back yourself to spot the scams that drop into your email inbox? Could you teach your friends, family and colleagues to do the same?

7. Blackmail through ransomware has been around for 40 years, and shows no sign of abating. Prevention is way better than cure – just how well-prepared are you?

Enjoy, and have a wonderful but cyber-safe festive season.

From me, and everyone at SolCyber.

PS. If you haven’t done so already, why not give our awesome podcast TALES FROM THE SOC a listen? Tightly-edited 20-minute episodes, featuring SolCyber’s thoughtful (and tastefully witty) CIO and Head of Operations, David Emerson. Fun with a serious and educational side, for techies and non-techies alike.