The full article was written by our Co-founder and CTO, Alan Duric and published in ITProPrortal on September 9, 2021

The global outbreak of Covid 19 and the resulting switch to online working and a new dependence on IT has seen cybercrime increase dramatically. According to research, UK businesses lost over £6.2 million to cyber scams this past year, with a 31 percent increase in the number of attacks during the height of the pandemic. Cybercrime will continue to damage businesses, institutions and governments unless a radical new approach to rebuilding security infrastructure is taken.

The threat posed by cybercrime is immense. According to Cybersecurity Ventures, cybercrime could cost the global economy as much as $10.5 trillion by 2025. But organizations seem resigned to this risk – 80 percent of organizations worldwide expect to experience a data breach in the coming year.

Cyberattacks haven’t just increased in volume, they’ve also grown in scale, potency and impact. Recent high-profile attacks involving SolarWinds, Microsoft Exchange and Colonial Pipeline have shown just how vulnerable we are and how crucial it is to make structural changes to ensure our future security.

Global leaders are finally taking action. US President Joe Biden’s recent Executive Order to undo years of security vulnerabilities is a major step forward, while German Chancellor Angela Merkel and French President Emmanuel Macron are also taking steps to protect critical infrastructures and invest in secure technologies.

However, in the UK, while the government is pledging to make data security a top priority, Prime Minister Boris Johnston is behind his counterparts in taking the threat seriously. The revelation by Dominic Cummings of the extent to which UK MPs share sensitive government data using mainstream tools such as WhatsApp, is testament to this.

At breaking point

Last year, the SolarWinds attack made headlines as the then-largest and most sophisticated US hack of all time. It compromised the private sector and affected many US government organizations, including critical agencies like the US Treasury. Unfortunately, the Microsoft Exchange hack earlier this year outdid it; experts believe it exceeded the SolarWinds hack in scale and consequence. This attack exposed the emails of 30,000 US organizations, with the full breadth of damage still unknown.

The increasing frequency of these attacks is alarming. Underlying weaknesses seem to be exposing organizations to unnecessary risk and making these types of breaches more likely – and more dangerous.

Three pillars for a modern security infrastructure

These attacks highlight common security weaknesses that must be addressed. We can no longer simply ‘patch’ over weaknesses; we need a new, security-first infrastructure that discourages future attacks and minimizes the impact of a successful breach. This alternative architecture must include three fundamental elements:

Zero Trust

The idea of zero-trust security has existed for some time, but it is now gaining traction. Zero trust methodology assumes that all data, devices, apps and users inside or outside of the corporate network are inherently insecure and must be authenticated and verified before being granted access. The key component to zero trust is that it is a holistic strategy, involving technical protocols such as multi-factor authentication and identity access management, as well as a hyper-vigilant mindset that is ingrained into how an organization defends against cyber threats. This approach requires a change in strategy throughout an organization, because it assumes that any vulnerability – even at an individual employee level – can cause significant damage if exploited.

End-to-end encryption (E2EE)

As cyberattacks increase, end-to-end encryption has become more important. Businesses are now seeking E2EE as a basic signifier of security. Unfortunately, many popular collaboration and email platforms either lack plans to employ E2EE, or are scrambling to add in basic security protocols after years of operating without them. In true E2EE, data is encrypted on the sender’s system or device and only the recipient can decrypt it. Many platforms have made false claims or utilized weak forms of E2EE, so it’s critical to pick the right form of encryption and to be transparent regarding which ones you deploy. For example, a decentralized solution using double-ratchet E2EE enables every individual call, message, and file to be separately encrypted on every device, with the keys generated from the device rather than from a central server. This protects even the smallest possible unit of information, creating a system that grows more complex – rather than more valuable – for hackers with every message.

Decentralized data storage and protection

Decentralization protects data assets at the edge rather than in a central fortress. This architecture gives organizations control without any risks related to how a vendor stores their data. Solutions that protect from the edge are better at protecting data from bad actors because there is no single large “payload.” The lack of E2EE (Microsoft, like other email providers, saves data in cleartext on its servers) and centralized data storage created a dangerous combination in Microsoft’s case. While it requires fewer resources for vendors to simply place a perimeter defense around a central hub, the major downside of this approach is that if an attacker can surpass those defenses and access the servers, all the data in that central hub is compromised. By contrast, on-prem or hybrid arrangements can be more secure. If this old infrastructure with centralized data storage and outdated security protocols remains in place, cyberattacks will continue to rise.

Taking steps to curb cybercrime

There are already platforms like Protonmail and Tresorit that employ this new security infrastructure. That’s a great start, but if organizations truly want to prevent cybercrime, a more fundamental change is needed.

In the same way that we cannot solve climate change with fossil-fuel-powered energy infrastructure, we will not solve modern security challenges using architecture from the 1970s. It will require a radical rethink and the use of new tools. It will also require politicians and technology providers to collaborate to bring about change. We applaud the steps being taken by Biden, Merkel and Macron to undo years of poor security practices in the public sector. By taking these difficult lessons on zero trust, encryption and data compliance to heart, digital infrastructure will become safer.

About Alan Duric

Alan Duric is a Co-Founder of Wire and serves as its CEO. He was an early pioneer of VoIP, and has founded multiple other initiatives such as Telio Holding ASA, now NextGenTel Holding ASA.

About Wire

Wire is the most secure collaboration platform, transforming the way businesses communicate at the same speed and with the same impact that our founders disrupted telephony with Skype. Headquartered in Berlin with offices in Switzerland and San Francisco, Wire’s award-winning collaboration and communications platform counts over 1,800 government and enterprise customers worldwide, including EY, Fortum, the German government and four other G7 governments. Recognized for its secure collaboration platform as a leader and high performer by G2 Crowd, IDC, Forrester and Gartner, Wire offers messaging, audio/video conferencing, file-sharing, and external collaboration – all protected by the most advanced end-to-end encryption.

Try our internal communications software for free today. Simply create a team and start communicating and collaborating securely in minutes. Looking for a walkthrough of our enterprise communication solution? Contact us today to learn how Wire fits into your organization.