Information security

The Merriam-Webster Dictionary defines the Industrial Revolution as a rapid, major change in the economy (as in England in the late 18th century), marked by the general introduction of power-driven machinery or an important change in the prevailing types and methods of use of such machines. From the 18th century until today, we recognize a total of four Industrial Revolutions, of which the last one is occurring today.

The First Industrial Revolution used the power of water and steam to mechanize production. The Second used electricity to create mass production. The Third used electronics and information technology to automate production.

Now the Fourth Industrial Revolution presents a continuation of the third, digital revolution which has been taking place since the mid of last century. It is characterized by a combination of technologies blurring the boundaries between the physical, digital and biological spheres. It is a combination of artificial intelligence (AI), robotics, Internet of Things (IoT), 3D printing, genetic engineering, quantum computing and other technologies.

In view of its scope and complexity, the transformation will not be similar to what humanity has ever experienced before. We still do not know exactly how it will unfold, but one thing is clear: the response must be integrated and comprehensive, and include all global policy stakeholders, from the public and private sectors, the academic community and civil society.

The advantages it brings are increased productivity, efficiency and process quality, greater safety of workers by reducing jobs in hazardous environments, more frequent decision-making using data-based tools, improved competitiveness through the development of customized products… All the above stated contributes to heavy dependance on modern technological solutions, where failures of such systems have far-reaching financial and reputational consequences. New risks are emerging, and can have great impact on business and even the survival of the companies themselves. Facilitated precisely from the technologies brought to us by the Fourth Industrial Revolution, Cyber threats are becoming one of the most significant and growing risks.

It is estimated that between 90% and 95% of all successful cyber attacks start with a phishing e-mail.

Currently, the dominant danger in this area is ransomware, threatening to become a new global threat, given the consequences it can produce. It presents malicious software which locks a computer, tablet or smartphone, followed by a ransom demand in order to unlock the device. The software is usually included in a masked email attachment. Once opened, it encrypts the hard drive by preventing access to or reading of anything stored on it. More advanced versions have the ability to navigate the network, by encrypting back up data, thus leaving individuals and the companies themselves completely out of operations and unable to recover without paying ransom. The ransom payment is effected on the so-called dark web, without any guarantees of successful decryption.

One of the more notorious global attacks occurred on June 27th, 2017 with the so-called Petya ransomware, where the targets were large companies which suffered huge losses. Some of our principals were also victims, and hence Mondelez estimated that the attack reduced sales growth by 3 percentage points in the second quarter due to the inability to deliver and invoice. On the other hand, Reckitt Benckiser estimated a decrease in annual income by a whole percentage point. The biggest challenge and threat in this case lies in the fact that there was no desire for financial gain but only destruction. The latest example of the American company Colonial Pipeline shows that the danger of ransomware is increasing, and that the cyber attacker is more and more targeting individual companies. Colonial Pipeline is the largest American company for transfer of refined oil to the United States, which was forced to suspend all its operations, on May 8th of this year, due to the attack. They were also forced to shut down Internet services until system recovery and until, it was in their opinion, safe to restart them.

Given that they distribute almost 2.5 million barrels per day, which re- presents almost half of the distribution of diesel, gasoline and jet fuel on the East Coast, the long-term unavailability of the system will lead to unavailability or price increases in 12 countries. This domino effect is applicable to every company and its business.

The answer to the question why e-mails are so suitable for a cyberattack can be found in their mass use and in us users, as the weakest point of any defense against cyberattacks. Since e-mail was invented by Ray Tomlinson in 1960, it has become one of the most useful inventions for personal and business use. It is estimated that 306.4 billion e-mails are currently sent or received daily. If we had to send so many letters by mail in the past, all the pigeons and horses in the world would not be enough, which goes in favor of the need for a Fourth Industrial Revolution. According to estimates, the average number of sent and received business e-mails per day per user in 2020 was 127, of which 98 emails were received and 29 sent. Estimates say that 20% of all emails received were spam, which means that every 11 seconds an employee clicks on a link or opens an attachment and their company quickly becomes infected with ransomware. The growth of this type of attack is relentless, and its goals are different – large or small organizations, government or private sector.

Our company was also not spared from the ransomware attack. No matter how hard we try to improve antivirus and other technological solutions, on a monthly basis, there are a few clicks on malicious links or e-mail attachments. Just one such click can lead to a complete cessation of operations lasting a few days or even weeks. E-mail phishing campaigns we have had since 2017 show that awareness of cyberattacks is growing, but that we still have to constantly work on education. Namely, in 2017 we had a situation where 37% of users opened a potentially malicious e-mail, and in 2021 this number dropped to 2.6%.

Progress is obvious, but when you consider that just one wrong click is enough for a complete breakdown, it is clear we must all be careful. Therefore, the next time you receive an external e-mail requesting an action from you, first check who is sending it and from which e-mail address, and then contact your ICT colleagues to check before taking any action. It doesn’t require a lot of commitment, and it helps you protect both your own and company data.