Cyber attacks are, in 2021, more common than ever before. Malicious software and phishing attacks target personal data and sensitive information, while social engineering attacks attempt to extract security-sensitive data daily. Early in 2021, a major incident crippled the UN’s security by exposing over 100,000 staff records. As a result, the network security industry has seen a rapid advancement in its knowledge base and technology, and for good reason.

A key to introducing better cyber security, as well as incident resolution and management, is cyber awareness – a core pillar in the protection of systems, networks, and operations across the entire organisation.

What are cyber awareness and incident management?

“Users have a critical role to play in their organisation’s security and so it’s important that security rules and the technology provided enable users to do their job as well as help keep the organisation secure.” – National Cyber Security Centre

Cyber awareness is the practice of establishing a conscious and risk-aware environment in an organisation. This helps to stave off potential attacks, encourage the adoption of robust cyber security plans, and educate teams on what to do when there is an attack to resolve the incident quickly and efficiently.

Incident management builds on this, providing the fundamental next step by proactively putting cyber security measures into practice. This investment in implementing sufficient defences boosts the resilience of your infrastructure, your asset protection, and the confidence of both organisations’ users, partners and end-clients.

Incident management planning assumes that a potential cyber attack is likely, and so establishes a structure and framework to reference when the occasion arises. This framework includes tools to instantly detect, analyse, and record incidents – providing a comprehensive view of any, and all, cyber security threats.

Why cyber awareness is important for incident management success

Both cyber awareness and incident management are vital components in a successful cyber security framework, working to reinforce data and assets against potential threats.

Additionally, one is directly affected by the other. A company practising strong cyber awareness is likely to place more importance on incident management policies, invest more heavily in cyber security measures, and reduce the initial success of attacks.

Again, both cyber awareness and incident management assume that cyber attacks will happen. Through the examination of current security and the responsible training of staff, organisations may be better prepared to face threats when they arise.

Aiding staff to better recognise and understand the reality of cyber attacks is the first step in introducing a cyber awareness culture. This begins by identifying various popular attacks, and the effect they may have on not only the organisation but on their sensitive data and credentials too.

Common types of cyber attacks

There are many forms that a potential cyber attack might take, and the arsenal of tools available to adversaries is growing as technology continues to expand and develop. From malicious phishing scams to rogue insiders, staff should familiarise themselves with the most well-known attacks.

Attacks are commonly classified into two types. Targeted attacks, and un-targeted attacks. As well as these two core forms, there are also larger, extremely dangerous threats that we will examine later.

Un-targeted attacks

These are deployed at random to an extremely large population, with the intention of latching onto as many users as possible to gain the largest reward and cause the most amount of damage possible. Examples of these attacks, as defined by the National Cyber Security Centre, include:

• Phishing software – sending emails to large numbers of people asking for sensitive information (such as bank details) or encouraging them to visit a fake website
• Water holing – setting up a fake website or compromising a legitimate one to exploit visiting users.
• Ransomware – an attack that threatens to publish the victim’s data or perpetually block access to it, or a site, until a ransom is paid.
• Scanning – An attack designed to hit vast portions of the online population at random.

Targeted attacks

Unlike un-targeted attacks, these seek a specific organisation or individual to exploit. These can often be more destructive and likely to work, as they have been designed specifically to penetrate a specific system. Examples of targeted threats include:

• Spear-phishing – sending emails to targeted individuals that could contain an attachment with malicious software or a link that downloads malicious software.
• DDOS (Distributed Denial of Service) attack – An attack that threatens to deny access, or operations, on a particular network; this is usually until a ransom has been paid.
• Subverting the supply chain – This attack threatens equipment or software being delivered to the organisation.

CNI (Critical National Infrastructure) threats

CNI threats refer to attacks that target and intend to inflict damage to core national frameworks.

In the UK, there are 13 defined critical national infrastructures, ranging from chemicals and transport to food and finance. A successful attack on any of these 13 core infrastructures has the potential to damage daily lives and seriously harm the national economy.

Examples of critical national infrastructure threats include high-profile cyber attacks, terrorism, and cyber espionage from hostile states and criminals.

Threats at this level need the highest level of cyber security solutions and cyber awareness possible to avoid great national disruption and damage.

How Riskaware can help your organisation raise cyber situational awareness

At Riskaware, we’re passionate about helping others increase their cyber security awareness. We believe that to do this, and therefore to reduce the threat of potential attacks, three core areas must be addressed.

Communication of risk

It’s vital to effectively communicate the risks and threats of cyber attacks to your team, and do so in an understandable way. In doing so, those who don’t possess the same level of technical knowledge, such as decision-makers in an organisation, can understand the need to implement improved cyber security solutions and defences.

Board-level engagement

Cyber attacks don’t just affect IT teams, but the entire operation of an organisation. Therefore, it’s essential to ensure that those at a board level are aware of the necessity to implement solutions. Through this, teams can ensure that appropriate funding and resources are allocated to cyber security while increasing the overall level of awareness.

Placing threats in context

Attacks don’t happen without a reason. It’s always important to place threats in the context of the business. This insight gives a greater understanding of what assets may have been targeted and where your vulnerabilities lie.

Our cyber security products

We specialise in developing tools that perform complex cyber analytics and display it in a visual, understandable way to enable effective knowledge transfer and threat awareness for all members of staff.

We currently offer two products in our CyberAware platform, each designed to support more proactive security practices through improved cyber awareness:

CyberAware Resilience

CyberAware Resilience is a system that models the potential impact of cyber attacks on businesses. It provides insight into how cyber attacks could impact operations, enabling organisations to assess their resilience and mitigate network threats.

The tool uses advanced analytics to identify cyber attack paths that highlight the vulnerabilities adversaries might exploit to compromise critical assets. It can even simulate the beneficial effect of patching vulnerabilities, before allocating time and effort to mitigation tasks. Quantitative metrics then show the improvements in resilience as vulnerabilities are patched.

Download the CyberAware Resilience product sheet here.

CyberAware Predict

CyberAware Predict is a system that can predict both future cyber attacks and the next steps of evolving attacks, based on information obtained from network scans, real-time monitoring and threat intelligence.

It can be used to provide operational decision support or as a tool for training in a simulated network environment. An extensive cyber threat intelligence database built on the MITRE ATT&CK knowledge base of adversary tactics and techniques underpins the predictions CyberAware Predict generates. The tool provides users with comprehensive information about potential attacks, including appropriate mitigations and the known hacker groups and malware tools capable of mounting such attack.

Download the CyberAware Predict product sheet here.

Boost your cyber awareness today

As cyber threats and attacks become more sophisticated, we too must adapt the way we approach the cyber security landscape. For more information on our CyberAware products, or to start your journey to better cyber awareness, find out more here.