Page 8 - EngineerIt July 2021

CYBERSECURITY

Awareness and training are key

in defending against blended

cybersecurity threats

Cyber threat awareness training is key to creating a human firewall. Many of these attacks
require human intervention at some point, so they can be mitigated, to an extent, through
proper training and awareness.

hile blended cybersecurity A botnet is a network of private computers which is infected with the malicious software
threats are not new, they are and controlled without the owner’s knowledge. They could then launch denial of service
Wfairly sophisticated and multi- (DoS) attacks or use your infrastructure to generate spam,” says Pinnock.
staged in nature, meaning that they are He adds that the main difference between blended and normal cybersecurity threats
difficult to protect against and can pose is that the former use multiple methods to propagate and attack a system or organisation,
a considerable threat to organisations’ making this a complicated and multi-stage attack that is difficult to prevent. Like normal
IT environments. A blended threat threats, blended threats tend to exploit the same channels and vulnerabilities, because
typically uses and exploits multiple threat actors know they work. Pinnock says that in some 90% of cases, blended attacks
vulnerabilities in an attack chain, says will use email as the initial threat vector, with the remainder generally using the web.
Brian Pinnock, senior director of sales
engineering (EMEA) at Mimecast,
adding that the severity of a blended
threat will depend on the specific
vulnerabilities that are targeted.
“For example, a threat actor or
cybercriminal will launch a phishing
campaign against an organisation by
sending emails with infected links that
redirect to malicious websites. When
a user clicks on these links, they could
download a piece of malware like a
trojan that spreads laterally and creates
a backdoor into various systems. There
are various malicious activities they
could undertake, such as ransomware,
data theft or the creation of a botnet. Brian Pinnock Simeon Tassev

EngineerIT | July 2021 | 6