Cybersecurity introduction: Everything you need to know

As the internet economy broadens, with products and services increasingly shifting to web platforms, it’s more important than ever to safeguard critical information and data from nefarious entities looking to make a quick buck.

In this article, we’ll discuss cybersecurity’s definition, why it’s essential, and offer some tips for staying safe.

[Keep up with the latest in privacy and security. Sign up for the ExpressVPN blog newsletter.]  

What is cybersecurity?

Cybersecurity is the practice of safeguarding internet-connected systems (such as hardware devices, data centers, and software) from malicious actors.

Such actors steal financial data, proprietary information, or personally identifiable information (PII) to sell it on the dark web or to third-party advertisers. Some of these acts are political, such as when government-sponsored hackers aim to discredit activists, whistleblowers, or political opponents.

Cybersecurity aims to minimize these risks and prevent hackers from carrying out these attacks on both digital and physical assets.

While attackers can penetrate your software using brute force or malware attacks, there are threats found in hardware, too. For example, an infected USB drive could quickly unleash a virus inside your network, bypassing even the strongest firewalls and algorithms.

Robust cybersecurity systems incorporate multiple layers of protection with ongoing stress tests to identify chinks in the armor.

It’s important to realize that cybersecurity is an evolving field. With thousands of new vulnerabilities identified daily,  cybersecurity professionals must constantly update and test their systems against new threats.

Types of cybersecurity

Cybersecurity covers people, technologies, and processes. They must complement one another to create an effective defense for computer systems, data, and networks. Below, we highlight some common types of cybersecurity methods:

Application security

Many organizations almost entirely rely on cloud-based SaaS (software as a service) applications to get things done.  These apps hold an immense amount of proprietary data about the organization—data that hackers might eye.

Application security strengthens an app’s internal defenses against any infiltration attempts. While most of this occurs during the development stage, application security also includes patches, updates, and code audits to improve existing defenses.

No application is perfect and 100% secure. Cyber threats evolve quickly, and things like zero-day vulnerabilities are real. Humans can make mistakes while writing software. So it is imperative to test for vulnerabilities and constantly fine-tune as necessary.

Intrusion detection

The job of an intrusion detection system (IDS) is to identify network activity that might turn hostile. It’s a specific type of software trained to monitor behavior that seems suspicious and out of the ordinary. An IDS will log suspected violations in a centralized security and event management system.

Not all IDS’ are created equal. Some can both monitor threats and go on a counter-offensive if needed. Such systems are called intrusion prevention systems (IPS).

There are different kinds of IDS that defend the network at different points.A network intrusion detection system (NIDS) analyzes incoming network traffic and checks for suspicious deviations. A host-based intrusion detection system (HIDS), will watch important system files to ensure they’re not compromised or under attack.

There are two methods that IDS use to identify and quash threats. The first is signature-based, meaning that the IDS will identify a threat based on previously identified malware patterns and instruction sequences. However, signature-based tools aren’t very effective against zero-day vulnerabilities, for which no pattern has been identified.

The second type is anomaly-based, which relies on a machine-learning algorithm that creates patterns of trustworthy behavior. This behavior is compared against any new behavior detected in the system. While anomaly-based is more effective against malware and zero-day threats, it is relatively prone to alerting for false positives, i.e., legitimate activity classified as a threat.

Data loss prevention

Data loss prevention (DLP) mechanisms are predetermined processes and tools that ensure sensitive data isn’t accessed by unauthorized users or uploaded to unsecured servers outside the company.

For example, a robust DLP would prevent an employee from forwarding a business email outside of the corporate domain, thereby preventing data exposure to an unauthorized entity. Similarly, DLP software can guard against storing data on third-party cloud servers such as Dropbox and Google Drive.

DLP software is most relevant in regulated industries that manage high volumes of personal data. It maintains the integrity of the information held by the organization while ensuring compliance with privacy regulations such as HIPAA, GDPR, and more.

A DLP serves the dual purpose of controlling data streams while reporting to meet compliance requirements.

Cloud security

Cloud security refers to a system of checks and balances that help protect cloud infrastructure. This system consists of policies, controls, procedures, and technologies that work in tandem to identify incoming threats and respond to potential intrusions.

Cloud security is needed to protect client privacy, ensure compliance to privacy regulations, safeguard proprietary corporate data, and set access rules for individual users. Strong cloud security prevents unauthorized data exposure, leaks, flimsy access controls, and downtime. 

End-user training

Nine out of ten corporate cyberattacks are caused by human error or negligence. Therefore, an effective cybersecurity program must involve employee training so that they know the importance of adhering to security best practices and how to identify threats on their devices.

End-user training comes in various forms, such as in-class training, instructional videos, quizzes, and gamification approaches. The goal, however, is to gain awareness of some or all of the following best practices:

• Anti-phishing and social engineering: Phishing scams are a common method deployed by hackers to gain access to otherwise well-protected systems. Such scams are successful because they tend to impersonate people the targeted users know and trust. Employees trained on how to identify suspicious emails can stay clear and, by extension, keep the company secure too.
  

• VPNs: With the growing prevalence of remote work facilitated by cloud-based apps, employees should be made aware that hackers can compromise unsecured public Wi-Fi networks. As such, they should use a good VPN to access company servers and resources from remote locations to significantly reduce the possibility of interception.
• Password management: Many users don’t go through the trouble of setting strong passwords. What’s more, some may share their passwords with others. An end-user training program should address these matters. The cloud security team can also create password vaults for better moats.
• Email management: While most aspects of cloud security focus on incoming emails, employees send emails too, and often to those outside the corporate network. End-user training should educate employees about the kinds of emails and attachments that should never be forwarded. For example, employees should refrain from sending confidential spreadsheets to their email accounts so that they can work on them over the weekend.

Software patches and updates

While users often ignore software update notifications on personal devices, promising to get to it later when it’s convenient, the same principle cannot apply in a corporate environment. Your security team should educate users on updating their devices, especially when a critical patch is received. The security team can take a proactive approach, too, by enforcing updates through policies and making it impossible to disable them.

Most common cybersecurity attacks

Now that we’ve discussed some of the common methods organizations use to implement cybersecurity, let’s take a closer look at how criminals try to engineer attacks.

Malware

Malicious software, or malware for short, refers to unwanted computer programs that aim to get access to proprietary information, take control of internal systems, or serve advertisements. It’s software that you don’t want on your device, doing things that you haven’t agreed to.

Malware includes, but isn’t limited to, spyware, adware, keyloggers, trojans, and ransomware. They’re used to achieve varying outcomes, from financial extortion to data tracking.

Below are some common types of malware: 

• Viruses: A virus is any type of software that, when downloaded and executed, damages the device it’s on. You can get software viruses by opening attachments (see Trojans), inserting an infected USB, browsing malicious websites, or using fake apps.

• Trojans: Trojans are a type of software that appears to be safe at first glance but are harmful to a device. They appear disguised as common file formats such as Word, Excel, PDF, HTML, or ZIP files. They will also carry harmless names such as “invoice”. When unsuspecting users click these files, they will install malware onto the user’s device.

• Spyware: Spyware, like Predator spyware, is software that is secretly installed on your device with the intent of either stealing information or monitoring activity on a device. These can be piggybacked on legitimate software.

• Ransomware: Ransomware is a type of malware that encrypts your files during an infection. The hacker will usually demand for payment to decrypt your files within a time limit at the treat of the data being published or deleted.

• Adware: Adware doesn’t usually harm a user’s device. Instead, it scares a user into purchasing expensive software that claims to “protect” or remove a threat.

• Botnets: Botnets are a group of compromised IoTs that are connected to each other and the internet. These devices are usually controlled remotely by an attacker after being hacked.

Phishing attacks

Phishing attacks involve tricking users into revealing confidential information, such as login details. For example, hackers might try to impersonate a bank you know and trust in an email. Once you click on the link, it directs you to a site looking similar to your banking login, tricking you into revealing your username, password, 2FA token, or other confidential information.

Phishing attacks commonly exploit human vulnerabilities and can bypass robust cybersecurity software. That’s why it’s crucial to train employees to stay wary of this technique.

Advanced persistent threats

An advanced persistent threat (APT) is a highly sophisticated intrusion using a combination of social engineering and hacking techniques to stay undetected in a network for as long as possible to steal the maximum amount of data. Nation states and militaries usually carry out advanced persistent threats, or sophisticated criminal organizations with the financial resources and technical nous to bypass defenses and stay under the radar as they do their work.

Unlike malware, which uses a broad-based approach to infiltrate devices, APTs are usually directed at a specific, high-value target, mostly in defense manufacturing, financial services, and government agencies. Therefore, they are generally customized to breach the defenses of a particular organization and may incorporate specific codes to carry out the dirty work.

The initial breach attempt, however, might be through a malware or social engineering attack designed to gain access to the system by masquerading as a trusted connection. Once inside, the threat may lie low for some time so that cyber defenses aren’t alerted to the possible intrusion. It uses this time to better understand the organization’s warning systems. It may alter its plan of attack to steal the most data and do the most damage.

SQL injection 

Modern software store information in databases. If these software databases were physical libraries, Structured Query Language (SQL) would be the librarians, serving up data to authorized people upon request. 

In an SQL injection attack, the librarian is compromised. They deliver sensitive data to unauthorized people. Besides stealing information, these attacks might also input false data, remove important details, or deny access to applications. 

Man-in-the-middle attacks

A man-in-the-middle attack (MITM) occurs when an attacker sits between two victims—mainly you and the server. Both victims are tricked into thinking they are communicating with each other when talking to a third party instead. A hacker can trick a victim into inputting credentials through a fake website through MITM attacks. 

Denial-of-service attacks

A denial-of-service (DoS) attack occurs when a site or service is flooded with requests from a single user. The number of requests can overwhelm a server, causing it to become temporarily unavailable or unusable to legitimate users. Often, hackers will request payment if a service wants them to remove or stop their DoS attack. 

Large-scale DoS attacks are known as distributed denial-of-service (DDoS) attacks. Read more about their differences and the common types of attacks here.

Insider threats

Insider threats are any sort of threat that comes from within a company or organization. For example, an employee, former employee, or vendor could leak information or give unauthorized access to certain services or apps to external parties. 

While it’s not always the case, some perpetrators want to steal confidential or sensitive information for personal gain and to trade them for monetary rewards.

Why is cybersecurity important?

As we grow increasingly reliant on internet-enabled products and services, the need to protect data and applications has increased rapidly over the past few years.

The modern workforce needs to access documents and critical applications through several devices and from anywhere with a functional internet connection.

Consumers also use the internet to log in to their bank accounts, transfer money to one another, and engage in e-commerce transactions. Simply put, we’ve shifted most of our sensitive activity over to the internet and cloud-based applications.

Hackers realize this. They know that if they were to get access to this data, they could sell it for a profit or extort companies into paying ransoms.

The average cost of cyber breaches swelled by 72% between 2013 and 2018 to 13 million USD, according to an Accenture study. The increase is caused by two factors: businesses relying more on cloud-based apps and increasingly sophisticated methods deployed by hackers, causing more significant material losses.

Common cybersecurity challenges

Because security risks evolve continually and attack vectors become more sophisticated, professionals must stay at the top of their game. This is one of the biggest challenges of cybersecurity.

The lack of trained personnel is a major problem, too. According to a 2019 study, globally, the number of unfilled cybersecurity jobs stands at over 4 million, up from 2.93 million a year earlier.

According to the report, 51% of cybersecurity professionals find their organization at risk of cyberattacks due to a lack of experienced personnel. And the staffing shortage isn’t expected to go away anytime soon: Insufficiently dedicated training programs and a small talent pool are significant hurdles that need to be addressed first.

Thanks to the pandemic, several companies, and remote workers were victims of cybersecurity attacks. According to a study by FireEye, companies experienced an 81% increase in cyber threats during the pandemic. Healthcare companies, in particular, were attractive victims because of the amount of valuable data they collected as more people were registering for vaccines and getting tested for the Covid virus.

Benefits of cybersecurity for businesses

Regardless of its size, all businesses should invest in a robust cybersecurity framework because they can all be vulnerable to malware, phishing scams, and ransomware attacks. 

Cost savings and value 

According to IBM, the average cost of a data breach is 4.35 million USD, an all-time high compared to the figures in 2020. Besides losing data, companies that experience a data breach might also run the risk of getting fined for the lack of robust cybersecurity practices in place. The hotel chain, Marriott International, was fined about 24 million USD for failing to keep its customer’s personal data safe.

Improved productivity

Data breaches have the potential to really affect productivity and destroy a business. Compromised data and software require a lot of work to investigate and change, and depending on the nature of the data at stake, employees might have to work extra hours just to secure and protect their data.

Brand trust and reputation

If a business falls victim to a cybersecurity attack, it also runs the risk of having its reputation damaged. A study by Varonis in 2020 found that millennials are less likely to trust a company after a data breach occurs. The lack of trust consumers might have towards a business could lead to customers shopping with a more secure competitor instead.

Protects data and intellectual property from being exposed through hacking or theft 

By educating employees and equipping your company with the right cybersecurity tools, you’re preventing company and employee data from being hacked or stolen.

A real-world example of cybersecurity threats

Early this year, the hacker group known as Lapsus$ targeted multiple high-profile companies, including Nvidia, Samsung, and Microsoft. In each attack, Lapsus$ stole and leaked customer data online. During its attack on Microsoft, Lapsus$ reportedly leaked 37GB of files and shared them on its Telegram channel. 

According to Microsoft, the hacking group compromised an employee’s account and used it to grant access to multiple group members. 

Lapsus$ used phishing methods to obtain credentials and publicized their social media attacks. In March 2022, British police arrested seven members associated with Lapsus$ and have gone quiet since then.

Cybersecurity awareness tips

When it comes to ways of improving cybersecurity, there are certain best practices you can follow.

1. Keep your devices up to date

The existence of zero-day vulnerabilities means that there are threats out there without an existing patch. Thousands of new malware strains are released in the wild every single day, some of which could make their way into your device.

The best way to guard against zero-day threats is to accept automatic updates. Developers will ship improved code to quash the bug whenever they see new threats. By not updating your devices, you’re putting yourself at risk.

2. Avoid clicking on unsafe links and unsolicited emails

We mentioned above that phishing scams are one of the most common ways criminals breach defenses. It’s generally recommended that you thoroughly vet each email that asks you to click on a link or download specific software.

Even if the email appears to be from someone you know and trust, be sure to check its authenticity. You can also take it a step further and never click on links in emails, navigating to the site in question using a bookmark instead.

While many email providers will label an email if they believe it to be suspicious, it’s possible that some might evade their filters.

3. Use strong passwords and authentication

One of the worst things you can do is keep a weak password such as “admin,” “password,” or “123456.” And if you don’t change the password that came out of the box, that’s another possible attack vector.

Consider using a password manager if you don’t want to remember all the passwords for different services. If you’re stuck on coming up with a good password, then use a password generator. Enable two-factor authentication whenever possible to add an extra layer of security.

4. Only connect to secure Wi-Fi

While office networks are usually secure, it’s still a good idea to check with your system administrator about the security measures the company has implemented. However, most home Wi-Fi networks don’t come with the same security safeguards, and public Wi-Fi networks such as those in malls and coffee shops are even riskier.

To ensure that there’s always an encrypted connection, make sure to connect to a VPN first. That’ll keep hackers and other intrusive entities at bay.

5. Operate with a safety-first mindset

To improve cybersecurity, you must operate with the assumption that there could be threats anywhere. So while it may seem like a good idea to share pictures of your workspace and meeting rooms on Facebook, you must assume that someone could use that information to spy on you.

At the same time, it’s not recommended that you share any personally identifiable information, such as social security numbers or credit card details, over email, text messages, or a phone call. Cybercriminals are adept at making websites and impersonating others, so it’s important to stay guarded.