Safeguarding Against Cybercrime – Bojan Belušić on Delivered

Seasoned cybersecurity expert Bojan Belušić appears in our event series Delivered to discuss the strategies for protecting an organization from cyberattacks and the latest security trends and regulations.

The year 2024 started with a data leak of such magnitude that it soon started to be referred to as the Mother of All Breaches. Cybercrime is booming and evolving alongside new and powerful technologies such as AI.

To make sure that your company doesn’t fall victim, we’ve invited a cybersecurity expert, Bojan Belušić, to discuss the strategies for keeping your organization safe from the latest cyber threats and compliant with cybersecurity regulations.

The Mother of All Breaches, although initially hyped as a massive incident, turned out to be a collection of data from various past leaks, but it still exposed over 26 billion records, including sensitive information from high-profile companies like LinkedIn and Facebook.

Similarly, the LastPass breach of 2022 highlighted the severe consequences a breach can have for a company’s reputation and finances. 

The incident occurred when a hacker stole Last Pass’s source code and documentation, including cleartext embedded credentials, stored digital certificates for the company’s development infrastructure, and encrypted credentials used for production. After that, they stole a copy of a customer database and copies of the customers’ password vault. This led to a devastating outcome.

“The reputational damage was tremendous. LastPass lost so many customers, and in the end, had to deal with lawsuits from the people that were directly affected,” Bojan explains.

On the other hand, having adequate security measures in place can give any business a competitive advantage, ensure customers and employees trust the company, and avoid reputational damage and penalties from regulatory agencies.

Cybercrime comes in many shapes and forms, but in most breaches, the key factor is the human element.

Phishing attacks are the most common type of cyberattacks. As the name suggests, the attack involves hackers “fishing” for sensitive information from a “sea” of users. In the business world, financial scams like Business Email Compromise (BEC) attacks are the most popular, where attackers impersonate executives to trick employees into making urgent payments.

Additionally, spear-phishing attacks are used to steal account credentials. Although phishing scams use digital channels, hackers rely on our character traits like empathy and willingness to help in an emergency.

Malware, another threat, is malicious software designed to exploit or harm devices or networks. A current trend in this space is infostealer trojans. The software targets both Windows and Mac systems and could even be implanted in office documents. Although MacOS was once considered more resistant to malware, its increasing market share in the business world has made it a prime target for attackers.

Ransomware, perhaps the most lucrative form of cyberattack, involves encrypting data and demanding payment for its release. According to reports, ransomware payments surpassed $1.1 billion in 2023. Criminal groups like LockBit and BlackCat exploit vulnerable computers and servers to extort valuable data from companies.

Phishing attacks have been around for decades, but they’ve evolved since the days of Nigerian Prince scams. Nowadays, with AI on the rise, cybercriminals can easily create convincing and elaborate social engineering attacks with hardly any effort. It’s never been easier to whip up a phishing email with generative AI tools like ChatGPT.

And it’s not just emails. Generative AI tools can be used to make fraudulent phone calls or deep fake videos for financial scams. They can even be used to write malware.

“Maybe AI-generated malware is not sophisticated enough to fool antimalware on computers and servers, but IoT and OT are much easier to crack,” says Bojan.

Security is a relatively new field. Bojan’s role as the head of information security didn’t even exist 15 to 20 years ago. As a result, security often takes a back seat in software development, with engineers occasionally responsible for it but not addressing it systematically.

Fortunately, awareness is growing, and regulations such as the EU’s Cyber Resilience Act are driving companies towards better cybersecurity practices. 

This is where the Security by Design approach comes into play, especially in the software development industry. The focus is on creating inherently secure systems and products. Key steps include conducting risk assessments, implementing security requirements based on product functionality, and continuously testing security controls throughout the development lifecycle.

To combat the evolving threats in the digital space, Bojan also highlights the importance of doing regular penetration testing. It should be done whenever you’re launching a new service or product online, and ideally, by an external company for an unbiased point of view.

The importance of robust security measures cannot be overstated, especially when the landscape is dotted with examples of high-impact breaches that expose vulnerabilities even in well-guarded systems. When we are committed to building and maintaining secure platforms, it not only protects our operational integrity but also solidifies trust – a currency of unparalleled value in our interconnected world. 

If you want to dive deeper into regulations, trends, and cybersecurity best practices, watch the full episode.