Most companies by now have heard or unfortunately experienced a cyberattack. In the data collated by Forbes, almost 1.5 million Americans complained of identity theft to the Federal Trade Commission (FTC) in 2020 alone. This is almost twice the number the previous year. Meanwhile, one in every five Americans has fallen victim to a ransomware attack.
These attacks come in different forms, but the tactics are already common. For example, over 80 percent are phishing accounts. These are fraudulent websites that mimic legitimate ones to encourage users or subscribers to provide their login or financial information.
Ransomware is another. A hacker can penetrate the network or computer and hold the data hostage until the owner pays the ransom, which is commonly cryptocurrency, so it’s not easy to trace. Otherwise, they can delete all files or sell them on the black market.
The SolarWinds attack, therefore, demands extreme attention to both software developers and consumers and highlights the importance of automated performance testing.
Sophisticated Hacking, Simple Step
Many cybersecurity experts today consider the SolarWinds hacking as sophisticated for doing something so simple. The hackers maximized one of the most common procedures in software management, which is updates.
But first, what is SolarWinds? It is an Oklahoma-based company that offers B2B network management software. It allows businesses to set up cybersecurity, monitor their network, and perform other related functions more easily.
It is all over the world, and according to the data, they have at least 300,000 customers. While this may not be that much, remember that they cater to businesses that include Fortune 500 companies, government, and financial institutions, to name a few. These are organizations capable of spending millions, especially for cyberprotection.
But then what happened? Based on SolarWinds report, the hack happened many months before its discovery. There’s a good chance it occurred during the early months of the pandemic.
Around this time, SolarWinds released an update for one of its platforms called Orion. This application served as the eye of the network’s components, ensuring they are all working properly and, most of all, safe.
Software companies usually release updates for two reasons: introduce a new feature or fix bugs and other technical issues. For this one, it’s the latter.
What SolarWinds and thousands of customers didn’t know at that time, however, was that the updates also came with a malicious code that now allowed hackers to create backdoor access to the network.
The Dangers of the Hack
The SolarWinds hacking controversy remains a hot topic even after many months since it happened and its discovery for plenty of reasons.
First, until now, they couldn’t figure out what the hackers did within those periods of non-detection. Many American cyberspecialists believe that they could have been spying, considering some of the affected organizations included Treasury, Justice Department, and, interestingly, Cybersecurity and Infrastructure Agency (CISA), which belongs to Homeland Security.
Second, it has the ability to disrupt the economy significantly. The attack also hit companies Microsoft, AT&T, Mastercard, Time Warner, Procter & Gamble, and even the San Francisco International Airport. If the hackers can penetrate the networks of these businesses, there’s no reason they can go deeper and access the data of their individual customers.
Even worse, they can render these businesses useless or in danger. Consider, for example, a possible takedown of the San Francisco Airport, which could lead to canceled flights and losses of thousands of jobs.
In 2021, a new report suggested that the hack also exposed Denmark’s central bank. Although the bank commented that the attack didn’t create any significant consequences, it also revealed the major weakness of the financial system. It could mean cybercriminals can now access billions of money and cripple one of the foundations of the country’s business sector.
Lastly, many companies remain unprepared for any cyberattack. A Yahoo article revealed that almost 80 percent of IT executives believed that their organization lacked enough protection against hacks and data breaches. Further, over 75 percent said that they don’t have cybersecurity posture.
The cost of cybercrime is staggering. By 2025, it could reach at least $10.5 trillion a year. Small businesses are likely to shut down within six months after experiencing a data breach.
Like thieves and robbers, cybercriminals are both strategic and opportunistic. While they have a specific target and agenda in mind, they want the simplest method to get it. After all, no criminal wants to be detected.
Now is the best time to further strengthen cybersecurity policies and strategies, including automating performance testing. Some techniques may be redundant, but it’s better to catch a breach as soon as possible than becoming one of the statistics and experiencing a severe economic downfall.
