"I'm just a hairdresser – who would ever want to hack me?"
Cybersecurity professionals like myself get asked variations of this question all the time. It seems common sense that no-one would bother to hack a small high street hairdresser with just a handful of staff.
However, if you think about the question more deeply, there are many reasons why even small businesses may be hacked. Threat actors vary by company, location, size, type, sector and another important consideration: supply chain.
Automated attacks
A vast number of cyber attacks, from over a decade ago until the present day, are completely automated. Someone sets up a tool that goes after a WordPress vulnerability and it goes out scanning a massive range of public IP addresses.
If you look at any websites access log, you will see various attacks, trying to attack software which is not even present. The automated script will get lucky occasionally.
Masking identity/proxy
If you ask an ex-black hat hacker who would want to hack a hairdresser, they will tell you one main reason: to hide their identity when they hack the real target.
Instead of using a paid VPN or proxy service, which could be corroborated back to the true IP, you can bounce the attack through many zombie servers. Hack random targets and use SSH tunnelling to confuse so it looks like x company hacked you.
Ransomware
Ransomware has been used to target companies and organisations of all sizes, including the NHS, large American finance firms, sheriff’s departments, and (yes) hairdressers.
Cryptocurrency mining
I have seen this personally going after FTSE 100s website infrastructure.
Banking trojans
Every firm has a bank account. Malware can be used to capture logins and pinch money.
Client records
Can involve spear-phishing, more general phishing, identity theft or the request of phoney invoices to be paid.
Staff records
In addition to the motives above, staff records can be used to find out where someone lives in order to burgle their house.
Supply chain
Imagine the hairdresser offers services to Claridge's hotel – them the hackers could gain information on UHNWI clients. Let's look at two quick scenarios to better illustrate the value of hacking a small constituent of a larger supply chain:
An aerospace engineering manufacturer:
The company supplies Boeing and Airbus (which isn't giving much away since they have thousands of suppliers). They make parts for engines and sell them directly. Boeing and Airbus have a massive supply chain and perhaps the company in question has new design plans to steal, or how about the designs to the end part so someone could make it cheaper?
Multinational property management firm
They own property globally and rent out floors and offices. All the properties are known to the public and you cannot remotely steal a building. The main target then is cash, and this company has tonnes of it! They get heaps of emails requesting a money transfer to fictitious suppliers. It only takes a few to get through the spam filter for criminals' payday.
Try one of our courses
Visit qa.com/cyber for more information on how they can help solve the Cyber Security skills gap.