Malware poses a significant cyber threat to businesses of all sizes. An attack can devastate your systems and data, damaging your brand reputation. As a leader, it’s crucial to assess the level of protection needed to defend against these threats and consider all elements of your cyber essentials plan.
What is malware?
Malware, short for malicious software, includes computer viruses, worms, spyware, and ransomware. Its goal is to infiltrate a computer system without the owner’s consent, often to make money illegally through fraud, extortion, and identity theft.
Data shows that malware is a serious issue for UK businesses, with ransomware being a particularly costly and prevalent threat. Reports from Acronis indicate that ransomware costs UK companies £346 million per year [1]. According to SonicWall, despite a decline in overall malware attacks, ransomware volume increased by 195% in the first half of 2019, making the UK the second most attacked country globally. [2]
In 2023, ransomware attacks soared during the summer, nearly matching the unprecedented highs of 2021. Although the latter part of 2023 saw a decrease, resulting in 36% fewer attacks year over year, the significant spikes during the summer made 2023 the third-worst year on record for ransomware. This ongoing threat underscores the need for robust cybersecurity measures and vigilance against malware attacks.
The UK government supports businesses through the Cyber Essentials scheme, which helps organisations understand modern cybercrime and provides a clear cyber security strategy for organisations of all sizes.
How does malware attack?
Phishing attacks are the most common way malware is installed on a device. For example, you might receive an email from someone pretending to be your bank or another trusted institution, asking you to open an attachment or click a link. Clicking on the link can install malware on your device.
Other common methods include clicking on ads on websites or downloading software from non-approved sources. Removable storage devices like USB sticks can also introduce malware.
If you encounter ransomware, you may be prompted to pay a ransom to get your data back. However, paying the ransom often doesn’t decrypt your files. This is known as wiper malware. Therefore, always maintain a recent offline backup of your important files and data.
Types of malware
The list of malware types is extensive, emphasising the need for a comprehensive protection strategy. Types include:
- Ransomware: Encrypts files, demands payment, risks data loss.
- Zero-day Attack: Exploits unknown vulnerabilities for immediate access.
- Computer Worm: Self-replicates, spreads, can carry additional malware.
- Rootkit: Provides hidden, admin-level access to attackers.
- Zip Bomb: Overwhelms systems upon extraction.
- Backdoor: Bypasses authentication for unauthorised access.
- Logic Bomb: Activates malicious actions based on triggers.
- Pop-up Ad: Deceptive ads that can lead to malware downloads.
- Adware: Displays ads, tracks users, and may lead to infections.
- Pharming: Redirects to fraudulent sites for phishing.
- Dialer: Dials premium numbers for fraudulent charges.
- Polymorphic Code: Evades detection by changing its form.
Protecting your devices with Cyber Essentials
How can you protect your operating systems and devices? At The Missing Link, we recommend five main defences, which align with the Cyber Essentials accreditation:
- 1. Anti-malware software
Anti-malware software monitors your device for malicious activity and destroys threats before they cause harm. While many operating systems come with built-in anti-malware, it's essential to supplement this with third-party software for full protection.
- 2. Sandboxing
Application sandboxing is a software development strategy that isolates applications from critical system resources and other programs. By limiting the environments in which certain codes can execute, you can prevent unauthorised access to sensitive resources unless explicitly granted by the user.
- 3. Application whitelisting
Manage a list of approved applications that are allowed to run on your devices. By maintaining a list of trusted applications, you provide an additional layer of defence against unapproved software.
- 4. Patching
Regularly update the software on your computers and network devices to guard against low-level cyber-attacks. Keeping software current is crucial for closing security gaps.
- 5. Firewalls & secure configuration
Firewalls monitor incoming and outgoing network traffic, deciding whether to allow or block traffic based on predetermined security rules. When paired with secure configuration practices, firewalls are effective at shielding against numerous cyber threats.
Fortify your business
Ready to Enhance your Cyber Security? Discover Cyber Essentials requirements and elevate your business's cyber security with The Missing Link's expert guidance. Our tailored support ensures you meet all requirements and strengthen your security.
Contact our specialists for assistance with certification and cybersecurity needs, including Secure Configuration, User Access Control, and Patch Management, and start your Cyber Essentials journey today with The Missing Link.
References
[1] https://www.acronis.com/en-sg/blog/posts/ransomeware-attacks/
[2] https://www.sonicwall.com/threat-report/
If you liked this article, you may also like:
Cyber Essentials decoded: Firewalls and User Access Control
Cyber Essentials decoded: Secure Configuration
Cyber Essentials decoded: Patch Management
