2017 has seen an inordinate number of cyber security meltdowns. Breaches happen in their thousands each year, however 2017 a large number of breaches were made public, with headlines around WannaCry, NotPetya, Equifax and even Uber. So what have we learned and how can organisations be better prepared to respond to cybercrime?

The end of January saw several UK high street banks, including Lloyds Bank targeted in a huge two-day denial-of-service (DoS) attack. During the attack, criminals attempted to block access to more than 20 million UK accounts and as a result, customers were unable to send payments or check their balance online.

In February, the seemingly innocent CloudPets’ Teddy Bear made the headlines as the Internet connected toy exposed the dangers of everyday items being connected to the Internet. In fact, the connected stuffed animal maker exposed more than 2 million recordings of children and parents, as well as the email and password details of over 800,000 accounts. With warmer weather around the corner, March brought more than the March flower blooms. Fears grew that the medical records of 26 million NHS patients were unsafe, as records held by 2,700 GP practises could reportedly be accessed by strangers.

>See also: The rise of cyber crime continues to accelerate

Settling into spring and April, the media reported that the International Association of Athletics Federations (IAAF) revealed it had suffered a suspected cyber-attack from a more malicious bear than the CloudPets’ IoT Bear – the infamous international hackers Fancy Bear. The hackers were believed to have compromised the security of athletes’ medical records, which in some instances obtained data on which athletes take banned substances for verified needs. In other ‘lighter’ cybercrime news, a hacker held one of the world’s favourite streaming services, Netflix, to ransom for the new season of hit show ‘Orange Is the New Black’. To fans’ delight and Netflix’s misfortune, the season was leaked early due to the hacker’s ransom demands being ignored.

As May brought higher temperatures, ransomware hackers raised temperatures across boardrooms with the release of WannaCry, the devastating strain of ransomware that affected hundreds of thousands of targets, including public utilities and large corporations. The ransomware also temporarily crippled National Health Service hospitals and facilities in the United Kingdom, delaying vital medical procedures, and creating chaos for many British patients.

Just when we thought that the ransomware woes were over, June came with another ransom crisis in the form of Petya (or NotPetya), which was first spotted encrypting computers in the Ukraine a week before reportedly infecting systems in Spain, Germany, Israel, the UK, Netherlands, and the US.

The summer of 2017 arrived with reports of hackers breaching at least a dozen US power plants and cable network HBO being targeted by cybercriminals in July, with the finale of the box office show ‘Game of Thrones’ being leaked in August.

>See also: Cyber crime: an unprecedented threat to society?

As September rolled around, so did one of the most unsettling breaches of 2017 – the breach of Equifax, one of the three largest credit agencies in the US. The agency suffered a breach that may have affected 143 million consumers, causing their share price to plummet.

In October, Halloween was unfortunately not the scariest day of the year, especially for Yahoo, as headlines on October 3rd reported that the huge Yahoo! breach in August 2013 affected every user on its service, which equated to three billion users in total. Moreover, as the bearded man in Lapland began working on his naughty and nice list in November, the cyber security naughty list got ever more crowded as it was revealed that Uber concealed a 2016 breach that affected 57 million customers and drivers. The firm hid the breach by paying $100,000 (£75,000) to the hackers to delete the data.

What has been learned?

With December nearing its end, 2017 will be remembered for the year that cybersecurity took centre stage in the media and boardrooms around the world. So what have we learned after this turbulent year in cyber security? Well, that anyone and any company can be the victim of a cybercrime; from media, production, travel apps, banks, power plants or healthcare organisations – criminals show no mercy.

>See also: Cyber crime and the banking sector

As such, in 2018 we can expect criminals to continue ‘following the money’ as they use more sophisticated techniques to weaponise similar tactics which have proven successful in 2017, as well as invent new ones to stay ahead of the game.

What will 2018 bring and how can businesses prepare?

The new year is likely to bring a rise in ransomware as the method continues to prove profitable, and offers virtual invisibility for cyber criminals. Moreover, IoT vulnerabilities will also be increasingly targeted by criminals, especially as the IoT network is fast expanding its user base with the likes of smart home assistants, smart cars, and all smart ‘things’, including teddy bears. Targeted attacks on banks are also likely to remain a threat, ranging from highly-targeted intrusion activities mounted against high-value targets to massive banking trojan botnets, both of which provide a good return on investment through achieving mass distribution.

This is why, organisations of all sizes and all industries need to prepare for when, not if, they are targeted by cybercriminals. Many organisations mistakenly believe that they are ‘too small’ or ‘own data that is too insignificant’ to hack, but this is not true.

>See also: Cybercrime is on the increase and has been for some time

In fact, looking for easy ways to increase the money in their bank account, criminals are increasingly turning their focus to small businesses because they typically lack the breadth of security measures of larger organisations. Yet, cyber security does not have to be expensive or extensive.

Some of the breaches mentioned in this article could have been prevented by identifying what the company’s most sensitive data is, locating where it is stored, and minimising the number of people who have access to it, as well as training personnel on cyber security best practice.

In conclusion, in 2018, organisations across the globe should work on improving basic cyber security hygiene and understanding that cyber security is the shared responsibility of all employees, from Corporate Executive to any worker with access to the network. 2018 may bring an even stronger array of cyber-criminal tactics, but the time is now to unite our defences and work together toward a safer online environment for all.

Sourced by Ian Bancroft, vice president and general manager EMEA at Secureworks