Since spring 2020, cyberattacks have skyrocketed, and in a way, COVID-19 exposed new cybersecurity threats that organizations were not aware of, and not prepared to deal with. Not expecting to face cybersecurity crises and challenges, the majority of organizations had to improvise and improve their security.

With the emergence of new technologies, the number of cyberattacks is proliferating and their techniques are getting more sophisticated. Hackers have become better structured and meticulous in organized crime networks. They now have more efficient tools and can even offer their services in the Dark Web with distribution models such as MaaS (Malware-as-a-service) and other DDoS (distributed denial-of-service) products.

Reports from international organizations specialized in risk monitoring (ENISA, CVE, NIST, CIS, OWASP, etc.) classify digital risks as some of the most important risks organizations face today. Organizations have realized that in order to manage and better anticipate digital risk situations and other sophisticated threats, they must design and implement effective, and permanent risk management processes. To do so they are advised to implement a culture of data protection in the organization through the establishment of Security by design and Security by default processes.

In any case, one can make use of vulnerability assessments that are used to uncover weaknesses that could be exploited by a threat, or threat assessments that analyze how these threats could affect a particular asset, organization, or system.

Threat modeling involves examining all possible agents, actions or events, attack vectors, and vulnerabilities of a given system, asset, or process, and then modeling or simulating an example of how they might progress and see the damage they might cause.

When adapting the new risk management methodologies to address the challenges of immersive digital risks based on up-to-date attack threat scenarios, organizations should take into consideration the state-of-the-art threat identification framework, such as the MITRE ATT&CK Framework.

Detecting zero-day vulnerabilities is also another challenge for organizations. Proactive monitoring of infrastructure, networks, and systems, through SOC and CIRT monitoring, allows organizations to anticipate unclassified events that can turn into incidents. The risk management process provides the most effective security measures that should be implemented in order to protect an organization when anticipating any decision-making.

This requires first of all a precise mapping of the organization’s systems and processes and then even more efficient processes of identification, analysis, and risk evaluation.

The consulting, auditing, and training firm ACG Cybersecurity has therefore developed its own methodology for digital risk management, in compliance with the ISO/IEC 27005 standard.

What makes this method so unique is the fact that it is well adapted to the best identification techniques of cybersecurity threats since it is based on Cyber Threat Intelligence and the latest attack techniques.

By thinking like hackers and unrolling the risk management process, organizations will be able to create a risk treatment plan that could prevent, detect, have response controls, and take action to remediate all types of attacks.

Our R&D teams continue their research to improve our unique methodology on the market.

Thus, by adopting this system, the company ensures continuous monitoring of threats and new attack techniques as well as technical vulnerabilities (including Zero Day).

The control of digital risks also requires alignment with security standards recognized by the market. In this area, the international standard ISO/IEC 27001 and its library of security measures ISO/IEC 27002, represent a solid security foundation adapted to the context and strategic priorities of the organization. The controls and requirements of those standards should be implemented in line with the logic of continual improvement, i.e. in a PDCA cycle (Plan, Do, Check, Act) to ensure that they are suitable to the context, risks, threats, and vulnerabilities that are in perpetual change.

We remind you that 100% security or zero risk does not exist, and in this case, preventing is better than curing.

Some statistics on emerging cybersecurity threats:

Top cyber threats in 2020 from the European Union Agency for Cybersecurity (ENISA) report:

1. Malware
2. Web-based attacks
3. Phishing
4. Web application attacks
5. Spam
6. Denial of service
7. Identity theft
8. Data breaches
9. Insider threat
10. Botnets
11. Physical manipulation, damage, theft, and loss
12. Information leakage
13. Ransomware
14. Cyber espionage
15. Cryptojacking

Top 10 risks for experts based on the AXA Future Risk report:

1. Climate change
2. Cybersecurity risks
3. Pandemics and infectious diseases
4. Geopolitical instability
5. Social discontent and local conflicts
6. Biodiversity and natural resource risks
7. New security threats and terrorism
8. Financial stability risks
9. Macroeconomic risks
10. Artificial intelligence and big data risks

Some figures from the ENISA Threat Landscape 2020 report

• 400,000 detections of pre-installed spyware and adware on mobile devices
• 13% increase in Windows malware detections at business endpoints globally
• 71% of organizations experienced malware activity that spread from one employee to another
• 46,5% of all malware in e-mail messages found in ‘.docx’ file type
• 50% increase in malware designed to steal personal data or stalkerware
• 67% of malware was delivered via encrypted HTTPS connections