UAE-based advisor in digital transformation and cyber resilience organisation Digital14 has revealed how organisations in the country are becoming the targets of cyber-attacks.
The company’s ‘Cyber Resilience Report: The UAE Threat Landscape 2021’ revealed that despite the high cost associated with successful cyber breaches, public and private sector organisations need to do more to address critical security threats and protect themselves and their customers from data theft, added a media report.
“Proactive action costs a fraction of the bill for responding to and recovering from a successful breach. The pandemic has acted as a force multiplier for existing cyber threats, while giving birth to a whole new set of cyber risks.
While we have been shifting work practices to new, remote ways of working and relying on personal devices, threat actors have been watching and have switched tactics to exploit this new reality,” said Joshua Knight, EVP Cyber Defence at Digital14.
The UAE has witnessed a 250 percent increase in cyber-attacks in 2020, The Head of Cybersecurity for the UAE Government, Dr. Mohamed Hamad Al Kuwaiti, stated that ‘there is a cyber pandemic, not only a biological pandemic’, the report said.
Phishing tops the list
Digital14’s analysis report further pointed out that phishing remains among the observed top threat vectors in 2020. Over 1.1 million phishing attacks were recorded in 2020.
Ransomware also increased significantly in 2020, with an industry study showing an increase of over 33 percent in the number of new ransomware families compared with 2019.
“Traditional cyber security approaches are no longer enough. We must augment our security policies with always-on cyber protection as an ongoing process that steadily strengthens and improves enterprise security, rather than a one-time solution,” said Knight.
“Traditional perimeter-based network defense, for example, is obsolete. Not only does the perimeter no longer exist in our newly connected environments, but organisations must also recognise that their networks have most likely already been breached,” added Knight.
The report further added that nation-state cyber threat actors have become more active between 2017 and 2020, growing in number, becoming more sophisticated and increasingly harder to identify.
The UAE and the wider Middle East are constant targets of nation-state activities driven by economic and political motivation.
Industry estimates put the cost of a data breach in the Middle East as the second highest in the world at $6.52 million on average in 2020, just after the United States. Such a breach could lead to financial damage, and affect an organisation’s operations.
The threat actors behind the Maze ransomware reportedly pioneered double extortion: by the end of 2020, 15 different ransomware operators had used this approach.
In a 2020 survey of 300 UAE IT managers, 49 percent of UAE organisations reported having experienced a ransomware attack.
The report also underlined that during 2020, the most common incident types were Unauthorised Access and Malicious Code. The former accounted for 40.4 percent of incidents.
Unauthorised Access is when an individual gains logical or physical access without permission to the network, system, application, data or other resources of an organisation. This category also accounted for almost 34 percent of severely critical incidents observed.
Malicious Code accounted for the second-highest number of incidents observed at 39.6 percent. Malicious software, commonly known as malware, is any program that infects an operating system or application.
Key findings of the report include
In 2020, a total of 249,955 vulnerabilities were found in 800,315 unique instances.
Significant numbers of old vulnerabilities, some dating back to 2000, have yet to be remediated within UAE organisations’ networks. These can easily provide an entry point for devastating cyberattacks.
Over 100 vulnerabilities affecting UAE entities have public exploits that can be abused by even the most unsophisticated threat actors to breach IT and OT environments with minimal effort.
Password reuse is among the most common weaknesses in UAE organisations.
The most common incident types are associated with unauthorised access and malicious code.
Over 1.1 million phishing attacks were observed last year, peaking at moments when UAE residents were restricted to their homes and needed to rely on internet platforms for their daily needs.
Ransomware increased significantly in 2020, with an industry study showing an increase of 33 percent in the number of new ransomware families compared with 2019.
The government and critical infrastructure sectors were among the major sectors targeted in attacks over 2020.
