Prevention better than cure in cybersecurity

When botnet, phishing and ransomware attacks were comparatively rare, common sense and diligence were often seen as suitable defense mechanisms.

For many businesses, the lack of attacks proved their strategy suitable in the past.

But not anymore.

A study by University of Maryland professor Michel Cukier estimated 30,000 websites are hacked a day and a potential cyberattack occurs every 39 seconds.

It's now more important than ever to evaluate security and alleviate threats to any potential point of entry - from malicious internals to any possible breaches.

Last year, Hong Kong Computer Emergency Response Team, which acts when local enterprises and internet users are attacked, handled 8,393 incidents, up 9 percent and the first increase in four years.

The majority, 4,858, of these were botnet cases, up 40 percent. Botnets - a portmanteau from the words "robot" and "network" - are networks of computer devices hijacked to carry out scams and attacks.

Phishing cases came in second at 2,946, down 21 percent. But the number of uniform resource locators, or web addresses, actually rose 4 percent to 15,736, with more than 60 percent of them related to e-commerce, online banking and cryptocurrency.

Prevention is better than cure.

I want to look at two threat prevention elements - a cybersecurity plan and ransomware safe backups - that can help businesses and individuals get a cumulative protection benefit in the event of an attack.

A cybersecurity plan is designed to alleviate the pressure of changing cyber threats and help businesses stay up to date.

This generally refers to threat detection and prevention tools, such as endpoint detection and response, and strategies that prioritize preventative techniques.

However, the World Economic Forum finds that 95 percent of cybersecurity incidents occur due to human errors.

To protect the public from phishing attacks, businesses should develop and deploy cybersecurity plans that encompass five strategies to reduce human factors.

First, email screening.

Companies should draw employees' attention to especially those unknown emails requesting them to click on links or provide personal information. They should carefully check the sender's email address and phone number to ensure it is correct.

Second, web filtering.

Firms should get staff to hover over links to view the full URL and ensure it is not a fake website before clicking on a link.

Third, password management.

Companies should always use multiple- or two-factor authentication to reduce the risk of a malicious intrusion.

Fourth, patch management.

Firms should keep computers and mobile devices up to date with the latest security patches and antivirus software.

Lastly, simulated phishing.

Firms should conduct regular phishing drillswhere deceptive emails, similar to real-world phishing emails like online meeting invites, an AI chatbot subscription or questionnaires from food delivery platforms, are sent to staff to gauge responses.

In 2021, the average click rate for a phishing campaign was 17.8 percent according to the FBI.

If businesses have a ransomware-safe backup, they can use that backup to recover data without having to pay the price.

It is crucial that at least one of your off-site backups is not accessible from your server and that this backup is verified from a remote location on a regular basis. The verification ensures the integrity of the backup.

If your server backups remain intact, they will allow you to recover from any "disaster" and allow your organization to recover from data loss or corruption due to scenarios involving human errors, physical disasters, software bugs and ransomware attacks.

A human-centered cybersecurity plan and ransomware-safe backups can mitigate cyber risks and ensure businesses continue to operate even in the event of an incident.

Dr Jolly Wong is a policy fellow at the Centre for Science and Policy, University of Cambridge