The BOHH Breakdown, Part 1: How to Get Closer to a Cure for Cyber Hacks

In the first installment of the BOHH Breakdown series, BOHH Labs’ CEO and search and security expert Simon Bain, outlines the steps needed for the industry to prepare for the increasingly complex world of cyber warfare.


The incidents of cybercrime continue to rise every day at alarming rates. As ransomware, fraud, Point-of-Sale, phishing, keylogging, and malware-based attacks and more continue to gain traction, organizations are at increased risk of enduring costly hacks that grow more intricate and difficult to prevent each day.

Even though organizations have the industry’s best solutions: firewalls, VPN’s, SSL certificates, encryption, and authentication policies, we still see on a daily basis that millions, and in some cases billions, of records (for example, consumer information, money, and private personal details), are stolen from these so-called secure systems. 

So how do we go about fixing this?


Diagnosing the Problem

What’s wrong with cybersecurity today? Currently, most security solutions are merely analyses of the network that assess network holes and system weaknesses without patching or offering fixes. Simply put, the main focus and financial investment is on support for early detection and minimizing the impact of attacks; however, this does not address the root of the problem. 

In essence, it’s like getting a diagnosis from your doctor without receiving any guidance on treatments: “We noticed that you’re sick and the operation will be costly. Good luck.”

Immunizing the Disease 

Detecting security weaknesses is not enough to keep hackers, bent on stealing resources and consumer funds and information, from winning. 

Security systems need to evolve automatically with each new call; they need to be able to react to situations, like how the human immune system reacts to an incoming disease – much like an immunization can react when germs enter the body, rather than creating feeble and unrealistic goals to prevent the germs spreading disease in the first place. 

Similarly, data must be protected from within. It is up to organizations to try preventive measures initially, to stop the disease – in this case the hack – in the first place and to protect consumer data before there’s a threat.

Rebuilding the “System”

The first step the industry needs to take: Rethink the entire approach to protecting data.

Instead of only securing the network from the outside in, the focus must turn to tools securing the network inside out. This starts by turning a critical eye to the shortcomings of current solutions. 

• Firewalls help with external hacks, but cannot defend against internal ones and other sophisticated attacks. 
• Database encryption, perhaps among the most buzzed about solutions today, is also among the most insecure methods in use. 
• VPNs are of varying effectiveness that are only as good as the users’ knowledge of protocols and public Wi-Fi and password management.
• Two-Factor Authentication: Though this may seem more secure that just having a password, two-factor authentication technologies actually face many of the same risks as password-driven systems.
• SSL Certificates: Too often people think simply using SSL certificates protects them from all web security vulnerabilities. While SSL certificates offer an encrypted connection between the client server, many servers are badly configured and often expose data instead of securing it.

Current technologies still have a part to play in security, but they remain unreliable in a vacuum without addressing their vulnerabilities in the first place. 

Creating a Collaborative “Vaccine”

Improving security in 2017 requires industry collaboration. With all the detection solutions being employed currently, organizations must share the insights they learn during the nearly constant stream of hacks they face daily. 

Take virus protection – everyone shares that information publicly and within a few hours the virus is dead. Most organizations do not want to disclose to the public incidents of breaches for fear of damage to their reputation and customer loyalty, but without open communication organizations are not making progress when it comes to security analysis and preventing future hacks. 

While some organizations have started to unite behind closed doors and there are industry regulations emerging on how and when to report a breach, the industry as a whole needs to create a knowledge-sharing standard. The reality is that most hackers collaborate, so organizations should too.

If industry wants to take steps in improving security in 2017, we must reevaluate the approach and commit to investing in security by viewing it as an integral part of an organization’s livelihood and not just a routine, integrated process. 

Now that we’ve addressed how the industry can get closer to a cure, come back next Tuesday, when we will share with you how BOHH Labs is the way forward to secure organizations in the new wave of cyber warfare.