After experiencing a record number of cybersecurity incidents at the end of 2021, New Zealand businesses have seen a huge drop in attacks in the first three months of this year, the latest quarterly report from the government’s Computer Emergency Response Team (CERT NZ) has shown. The organisation, however, reminded companies to not let their guard down when it comes to cyber care.
“CERT NZ figures show a decrease in [cybersecurity] reports this quarter,” said director Rob Pope. “Although this may sound like good news, it doesn’t mean we can approach our online security with any complacency. It’s quite the opposite, in fact.”
The agency’s data reveals a 41% decrease in the volume of cyber incidents it has responded to from 3,977 between October and December last year to 2,333 in the first quarter of 2022. These incidents have caused $3.7 million in financial losses – a 44% decline from the previous quarter’s $6.6 million. Figures also show that less than a third of all incidents have resulted in monetary losses.
According to CERT NZ’s first quarter report, phishing and credential harvesting has remained the most common incident category, followed by scams and fraud, unauthorised access, and malware.
The agency, however, noted only marginal movements across each category, with reports of credential harvesting increasing by 0.1%, scams and fraud dipping by 0.5%, and unauthorised access decreasing by 3.8% compared to Q4 2021 numbers. The only exception is malware reports, which registered a remarkable 95% drop. CERT NZ attributed the decline to the conclusion of the Flubot malware campaign that peaked in the country at the end of last year.
Here’s a breakdown of the top cybersecurity incident categories based on CERT NZ’s latest data landscape report:
Phishing and credential harvesting accounted for more than half, or 59%, of all incidents CERT NZ has responded to, making it the most reported category from January to March. During the period, the agency received 73% more reports of such incidents compared to any other category.
Scams and fraud took up almost a quarter, or 24%, of all cybersecurity incidents reported to the agency in the first quarter of the year. The majority of these incidents involved buying, selling, and donating goods. Tech scams involving phone calls was the next biggest category, which saw a 53% jump from the previous quarter. Extortion or blackmail, dating scams, and scam phone calls rounded up the top five categories.
Read more: New Zealand sees surge in cyber fraud cases
Incidents of unauthorised access dropped almost 4% from Q4 2021. The category’s impact has been mostly felt in the sectors of public administration and safety, and transport, postal, and warehousing. At least one incident related to unauthorised access has cost businesses more than $100,000.
After topping the list of the most reported incidents in the final quarter of last year, malware cases slid an astonishing 95% in the first three months of 2022. CERT NZ attributes the massive decline to the conclusion of the Flubot campaign, which wreaked havoc on businesses in the second half of 2021.
At the beginning of the year, Pope said that the agency has witnessed how attackers were using a range of new methods to “try to get their hands on” people’s finances and personal information. These include the use of phishing as a stepping-stone to other types of attacks and taking advantage of the rising popularity of non-fungible tokens (NFTs) to carry out various kinds of scams.
“But while attackers use ever-evolving methods, our advice to help safeguard from these attacks remains constant,” Pope noted. “We need to keep doing what we know works best and continue to improve our cyber defences.”
To help prevent businesses from falling victim to cyberattacks, CERT NZ has published a guide, which highlighted ways on how companies can protect their data, network, customer information, and reputation. Here are 11 practical steps firms can take to keep themselves safe from cyber threats, according to the agency.
To keep their systems safe, businesses must make sure their devices are still supported by the manufacturer and software updates or patches are installed as soon as they are available.
“Patches aren’t just about adding new features to software, they often fix security vulnerabilities, too,” CERT NZ explained. “Attackers could use these vulnerabilities to gain access to your system. Installing patches, which fix them is a simple way to prevent this happening.”
Implementing 2FA is one of the most effective ways of protecting a company’s system and its customers’ accounts, according to the agency.
“It means that anyone who logs in to your system will need to provide something else on top of their username and password, to verify that they are who they say they are,” CERT noted. “You can implement it on internal systems and your customer-facing systems.”
Key systems that would benefit from enabling 2FA, include email services, cloud aggregator services – including Office 365, GSuite, or Okta Cloud Connector – document storage, banking services, social media accounts, accounting services, and any system that stores customer, personal or financial data.
Keeping data safe is crucial for every business and in the event it gets compromised, companies must ensure they have a backup, so they can have it restored. CERT NZ shared two tips on how this can be done properly:
Read more: Majority of companies targeted by malware pay the ransom
Logging can help businesses find out when an incident may be about to occur – when there have been multiple failed logins to their network, for example – or when an incident has happened – like a logon from an unknown IP address.
“Logs record all the actions people take on your website or server,” CERT NZ explained. “Set up alerts to notify you if an unusual event occurs. Make sure someone checks the logs when an alert comes in.”
The agency advised companies to set up logs for the following:
Companies must also take the time to create an incident response plan to get their business back up and running quickly if they were targeted by a cyberattack.
“Having a clear plan in place will help you through what could be a stressful time,” CERT NZ wrote. “It’ll help your team respond to an incident quickly and improve your business’s resilience.”
Default credentials are login details that give the user administrator-level access to a product and should only be used for the initial setup, then changed afterwards, CERT NZ explained. However, the agency said this does not always happen, which leads to issues later.
“Default credentials are easy to find or guess or find online,” the group warned. “Attackers could use them to get into your system.”
Using cloud services to manage a firm’s IT needs yields several benefits, including getting access to software without needing to purchase it themselves, accessing company data from any device at any time, and having storage space and backups for their data.
“There’s a lot of cloud services providers out there, and you need to make sure you choose the right one for your business,” CERT NZ wrote. “It’s important to know that they take your security needs and your data seriously. Before you commit to a particular provider, make sure they can give you the kind of services and protection you need.”
A company’s risk level is often based on the amount of data that they have. Because of this, CERT NZ advised businesses to only collect customer data that they really need.
“The more you collect, the more valuable it is to an attacker,” the agency noted. “This means you carry a higher risk if you’re targeted by a security incident. By only collecting what you need, you reduce your risk.”
Enabling anti-malware software on any device that accesses business data or systems prevents malware, including viruses or ransomware, from being downloaded, CERT NZ noted, adding that businesses must implement this both in company-owned devices and any BYOD units that belong to employees.
To do this, according to CERT NZ, companies must configure network devices, such as firewalls and web proxies, to secure and control connections in and out of their business network. They can also use a 2FA-enabled VPN if they need to remotely access systems on their network.
“A lot of business takes place over email, and it can be hard to tell when an email recipient’s behaviour is ‘phishy’,” CERT NZ cautioned. “If you're doing business online and you get an unusual or unexpected request, check it manually before you go ahead with the transaction.”
According to the agency, this means that businesses need to check the request with the person or company they are dealing with through another channel – by phone or through text messaging, for example. Having manual checks can help prevent businesses from getting caught up in online scams and fraud.
“If we all put in the mahi and take one step at a time to improve our online security, this will go a long way to keeping ourselves better protected and help build a more cyber resilient Aotearoa New Zealand,” Pope said.
He also advised individuals and businesses to visit the CERT NZ website for more practical advice and information on how they can stay safe online.
