Cyber Risks Facing Company Leadership
The most lucrative targets of cyberattacks are Fortune 500 board members, many of whom have been forced to resign over catastrophic breaches.
Kem Gay, Senior Intelligence Analyst at Constella Intelligence, examines the cyber threats facing executives and how they can best protect themselves and their organisations.
Cybercriminals continue to target executives to access networks and pilfer data, and money. The C-Suite can include a treasure trove of valuable information and is often an easy entry point for threat actors. Alarmingly, 84% of C-level executives surveyed by MobileIron say they had been targeted by at least one cyberattack in 2020, and 60% of IT decision-makers believe that executives are the most likely individuals within their organization to be targeted by cyber threat actors. Simply put, executives’ finances and security are under threat by malicious actors looking to disrupt and do harm to organizations large and small.
Executive cyber risk can even go beyond a personal brand or bank account. It can upend their entire lives. In 2018, Kaspersky Lab research revealed that in North America, “32% of breaches resulted in a C-level manager/president/CEO losing their job.” The list of senior executives who were fired or stepped down following a data breach is long and includes consumer brands such as Target, Equifax, and Sony. Government officials are not immune, either – senior administration officials from Utah, Texas, Arizona, to name a few, have all lost their jobs because of cyber incidents.
CEO phishing scams comprise one of the most common types of attacks. Cybercriminals use phishing to gain access to identities and networks – because it works. It is a numbers game and, unfortunately, even the most tech-savvy individuals fall for spoofed emails. By clicking on a seemingly innocuous link or entering a password in a familiar-looking site, those who are duped put untold personal and corporate information and reputations at risk.
In 2018, Kaspersky Lab research revealed that in North America, “32% of breaches resulted in a C-level manager/president/CEO losing their job.”
Stolen credentials are another major issue at this time. Executives often use the same username and password combinations to log into various accounts, which means that once a threat actor gains the credentials that unlock one account, with little time and the right software, they can gain access to the executive’s other online accounts, including the enterprise network. This is an all-too-common way by which intellectual property, money, and identities are stolen, and networks are held for ransom. After the credentials are used, criminals will often sell or dump the information on the dark web for others to use. Cybercriminals compile troves of databases that match information extracted from different breaches, giving the bad actors a full view of the digital profiles of both people and companies. The dark web is a “free for all” and the stolen credentials are available for anyone.
The use of identity information by bad actors proliferates in the surface, social, deep, and dark web and has led to an unrelenting stream of new attacks that expose troves of personal information. We are all at risk: organisations that have implemented even the strictest of security measures can still fall victim to cyberattacks based on a single employee’s error. An action as simple as reusing a password from an account previously breached within another organization can cause dire consequences for the entire company.
So, how can a corporate leader reduce the likelihood of having his or her identity compromised, inadvertently putting the organization at risk of a breach? It would be wise to install anti-virus, personal firewall software, and update applications often on all devices. All employees should use complex passwords, change them relatively often and avoid reuse across sensitive accounts (using a password manager, such as LastPass, to keep track of unique passwords can be helpful). Turn on two-factor authentication, when possible, and implement mandatory cybersecurity awareness training for all employees in order to understand the signs of suspicious activity. Further, sign up for identity protection services which offer tips and actions high-risk targets need to take to protect themselves.
When an executive’s account is breached, it can trigger an earthquake for the entire enterprise, leading to severe financial and reputational damage. Given the risk an unwitting executive can pose to an organisation, it is essential to act during peacetime, instead of responding after it is already too late.