Years from now, as we look back on 2020, this year will be remembered for many things: A global pandemic that put a vice-grip on this country, a hotly contested presidential election, and – by no means inconsequential – the rampant rise in cybersecurity incidents both here and abroad.

Just How Bad was 2020

Wondering how bad this year has been for cybersecurity? Answer: Disastrous. Here is a recap of what amounts to the worst year on record for cybersecurity:

  • In the first nine months of 2020, a staggering 36.1 billion records have been breached in the U.S, according to a report issued by RiskBased Security, shattering the previous nine-month high of 8.3 billion set in 2019. In fact, the number of records exposed in the third quarter of this year alone was equal to the first nine months of 2019. Two breaches in 3Q2020 exposed more than one billion records each and four breaches exposed more than 100 million records. Together these six breaches accounted for approximately eight billion exposed records, or 22.3% of the records exposed through the end of the third quarter.
  • In March, during the early days of the coronavirus pandemic, Deloitte’s Cyber Intelligence Centre reported a spike in phishing attacks, malicious spam, and ransomware attacks that use COVID-19 to bait users. This has resulted in a greater number of infected personal computers, USB flash drives, and smartphones – leaving organizations large and small incredibly vulnerable. Many of these attacks attempt to trick employees to download ransomware disguised as legitimate COVID-19 applications.
  • In April, the FBI reported a 400% increase in cybercrime compared to pre-coronavirus days, and VMware Carbon Black reported a 148% in ransomware attacks from February to March alone.
  • In June, global CEOs ranked cybersecurity as the fourth-biggest threat to company growth in 2020 – rising a spot from the previous year – according to PwC’s 23rd Annual Global CEO Survey.
  • In August, INTERPOL released a report on the impact of COVID-19 on cybercrime, in which it stated that cyberattacks have shifted away from individuals and small businesses to major corporations, governments, and critical infrastructure.
  • Also in August, Microsoft released the results of a sprawling survey of 800 business leaders in the United States, United Kingdom, India, and Germany that showed how the coronavirus pandemic is accelerating the digital transformation of cybersecurity. The Microsoft survey reported that “an alarming number of businesses” are still impacted by rudimentary phishing scams.
  • In October, The Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, and the Department of Health and Human Services published a dramatic warning about “imminent” ransomware threats to American hospitals. The agencies held a conference call with healthcare security executives to emphasize the need to prioritize this threat.
  • If all the above weren’t enough cause for worry, then let’s add the increasing threat of insider threats to the list. According to the Cybersecurity Insiders 2020 Insider Threat Report, 70% of organizations are reportedly seeing more frequent insider attacks, both from malicious actors and unsuspecting employees who unwittingly infect corporate networks with USB flash drive, external hard drives, mobile phones, and other portable media.

Defensive Measures You Can Take Immediately

You don’t need a huge cybersecurity budget to bolster your organization’s network. The place to start is by implementing Zero Trust Security, which is a security concept centered on the belief that organizations should not automatically trust anything inside or outside its perimeters and instead must verify anything and everything trying to connect to its systems before granting access. No single specific technology is associated with Zero Trust architecture; it is a holistic approach to network security that incorporates several different principles and technologies.

With Zero Trust Security in place, lock down your endpoints. Endpoint device protection – also known as endpoint security – refers to the security measures taken to address threats faced by network endpoints, which are devices such as servers, workstations, laptops, and mobile devices. Endpoints pose a significant security risk because they have access to both the central server and the outside world. Thus, any flaw or gap in their security can lead to loss of crucial data from the server.

Securing your endpoints is a smart move, especially considering recent reports that portable media – USB flash drives, external hard drives, smart phones, and similar devices – are the source of a growing number of cyber-attacks. With the use of portable media on the rise as workers flip-flop from office-based to home-based environments, the threat associated with portable media is growing exponentially.

Locking the ports on your computers – as well as your networks – to make them inaccessible is affordable even for budget-strapped organizations. USB port locks, network module locks, LAN cable locks, and secure USB hubs for your attached USB devices are inexpensive devices that effectively thwart both malicious and negligent insiders.

With port locks costing as little as $4 each – and the average cost of an insider incident, according to the Ponemon Institute’s Cost of a Data Breach Study, now at $11.45 million – it just doesn’t make good business or financial sense to allow your computer and network ports to be accessible to anyone with a portable media device.

While 2020 was a bad year for cybersecurity, unless we rapidly implement defensive measures, 2021 will provide to be more of the same.