Though hacktivism has become well known, the practice has evolved significantly in just the past five years. When hacktivism first began, attacks were fairly simple and largely focused on denial of service. Though annoying, these attacks were largely overlooked by customers once a website was successfully back online. More recently, however, hacktivists have begun deploying much more organized, sophisticated attacks. These are much less likely to be forgotten by customers, as they are aimed at breaching a company’s security and stealing the data most likely to damage the reputation and credibility of the enterprise or, even worse, air customers’ dirty laundry.
Unlike other hackers who are generally after a company’s data for monetary reasons, hacktivists have the explicit goal of tarnishing a company’s brand. This motivation is the scariest part of the practice – hacktivists are not going to just break in and steal account information. They’re going to find the most embarrassing thing possible for the company or its customers and release it to the world.
Given the somewhat marginal threat that hacktivists originally posed, many CSOs and upper-level managers are used to writing off the risk of hacktivism, assuming that a lack of what they perceive to be dirty laundry would keep them from being targeted. Now that this shift has taken place, however, it is important to remember that despite thinking a company does not operate within a controversial industry, hacktivists, and people in general, have political issues with corporations for all sorts of reasons.
Additionally, as the volume of data collected by companies about their employees and customers has increased exponentially, what a company considers “dirty laundry” must change – no longer is the concern only for embarrassing or regulated information, but rather all personal information. This can range from credit card and Social Security numbers, to less concrete examples like purchase histories and account information that customers may not want on public record. As such, it is no longer enough for a company to conduct itself in a way it perceives to be ethical – constant vigilance is required, both from the company and its employees.
Hacktivists have become a much more serious threat to enterprises, creating the need for companies to pay much closer attention to their data, their approach to training, and security controls. We must realize that conforming to the security status quo is not enough:
- Invest in the right cybersecurity software: Though companies likely have a cybersecurity strategy in place, due to advancements made in recent years (both in terms of hacking strategies and protection options), upgrading is likely necessary. Whereas for years firewalls were the tried and true method of protecting a network from hackers, the advancements made over the past year have proven that this is not enough. Cybersecurity software must be more dynamic, with the ability to identify, block, and learn from attacks.
- Train employees to be suspicious: Savvy hackers know that not everyone is well trained when it comes to cybersecurity. As such, they will often conduct phishing or whaling attacks, targeting a specific individual within an organization who will unknowingly grant the hacker access to company data. There have been many examples of these attacks, with hackers gaining access to servers inside of security firms, national laboratories and even the White House. With the ability to gain access to companies in high-risk industries, hackers are obviously getting smarter with their communications. Thus, taking the time to educate and train employees to be on the lookout for suspicious-looking emails or strange links is all the more important.
- Consider how much data is “too much”: Collecting data on customers and employees can be helpful when that data is relevant to a business, but if it’s sitting untouched, it’s only adding to a company’s risk, especially if that data is sensitive. Hackers and hacktivists who gain access to this data can use it for a multitude of reasons – to embarrass customers, to gain access to other websites or personal profiles – resulting in bad news for the company. Think critically about what kinds of information you need on file, how many locations it needs to be stored, and evaluate the risk and reward of holding onto that data with regard to potential breaches.
As hackers evolve and mature, so must the protection strategies that companies employ to keep data safe. It’s time to throw away the cybersecurity rulebook and take a close look at the specific risks facing a company and create a flexible, dynamic plan for protecting its data.
