How to Protect Yourself from Cyber Threats: A Cloud Expert’s View

Cybercrime has become one of the defining business risks of 2024. Lusine Mkhitarian, a cloud technology expert, explains why most serious incidents still begin with something mundane, such as a stolen password, an unpatched server or a convincing phone call, and what companies can realistically do about it.

Governments are spending more on defence. The White House requested around $13 billion for cybersecurity at US civilian agencies for the 2025 fiscal year, up from $12.7 billion requested a year earlier. In the UK, the Bank of England’s Systemic Risk Survey published in October 2024 found that 80% of respondents now rank a cyber attack among the five biggest risks to the UK financial system. That is a ten-point rise in six months, and second only to geopolitical risk.

Companies are following suit. In an Infosecurity Europe survey published in February 2024, 69% of security professionals said their budgets had grown or were set to grow this year, by anything from 10% to 100%.

“Bigger budgets are welcome, but they don’t automatically buy resilience,” says Mkhiyarian. “When I assess a company’s security, I start with three questions. Who can access your most critical data? How quickly would you notice if that access were abused? And how long would it take to restore operations from a clean backup? Most organisations can answer the first. Far fewer can answer the other two with any confidence.”

The cost of getting it wrong keeps rising. IBM’s Cost of a Data Breach Report 2024 put the average breach at $4.88 million, up 10% on 2023 and the sharpest annual increase since the pandemic. In financial services the figure was $6.08 million. Research by Rubrik Zero Labs found that 94% of IT and security leaders at large companies had dealt with a significant cyber attack in 2023.

Ransomware: faster, more targeted, more expensive

Ransomware remains the most disruptive threat. According to Chainalysis, victims paid a record $1.1 billion to ransomware groups in 2023 and another $460 million in the first half of 2024, including a single payment of $75 million. In Sophos’s State of Ransomware in Financial Services 2024, 65% of financial firms said they had been hit in the past year, almost double the 34% recorded in the 2021 edition.

“What catches people out is the speed,” says Mkhiyarian. “Once attackers have administrator rights across a domain, encrypting an entire estate is a matter of hours. Mandiant’s latest figures show the median time an intruder spends inside a network before being detected fell to ten days in 2023, and in ransomware cases it is shorter still. Detection and the first containment steps have to be automated. There is simply no time for an alert to sit in someone’s queue overnight.”

The most visible group of 2023 was Scattered Spider, which hit MGM Resorts and Caesars Entertainment within weeks of each other. MGM said the attack would cost it around $100 million in lost quarterly earnings; Caesars reportedly paid a ransom of about $15 million. Law enforcement is starting to push back. In February 2024 an operation led by the UK’s National Crime Agency took down LockBit’s infrastructure, and in November US prosecutors charged five alleged members of Scattered Spider.

The damage often spreads well beyond the victim. When LockBit hit ICBC Financial Services, the US broker-dealer arm of China’s largest bank, in November 2023, some US Treasury trades could not settle and the firm reportedly had to send settlement details to counterparties on a USB stick. Security researchers linked the intrusion to Citrix Bleed, a vulnerability for which a patch had been available for about a month. Earlier that year, an attack on ION Trading UK forced a number of derivatives brokers to process trades by hand for days.

“ICBC is the textbook case,” Mkhiyarian says. “Citrix Bleed was well known and the fix existed. But that flaw let attackers steal active session tokens, so patching alone wasn’t enough. You had to patch, terminate every open session and then look for evidence that someone had already got in. Internet-facing devices such as VPN gateways and firewalls have become the favourite entry point precisely because they sit outside most monitoring.”

Why finance is in the firing line

Financial services remain the most targeted sector. Financial firms accounted for 17% of the intrusions Mandiant investigated in 2023, ahead of business and professional services at 13%. The IMF warned in April 2024 that extreme losses from cyber incidents have more than quadrupled since 2017 to $2.5 billion, and that attacks on financial companies make up nearly a fifth of the total.

“Banks are attractive for two reasons,” says Mkhiyarian. “The data is valuable, and the system is so interconnected that a problem at one institution quickly becomes a problem for its counterparties. That’s why regulators now talk about operational resilience rather than security alone. The question is no longer whether you will be breached, but whether you can keep delivering critical services while it happens.”

Many institutions are still catching up. In an IMF survey of central banks and financial supervisors in 51 countries, 56% said they had no national cybersecurity strategy for the financial sector and 64% did not require firms to test their cyber defences. In KPMG’s 2023 Banking CEO Outlook, 71% of bank chief executives named cybercrime among their most pressing concerns, yet only 54% said they were well prepared for an attack, down from 66% a year earlier.

Deepfakes and fraud

Other sectors are just as exposed, and the tools are getting more sophisticated. In early 2024 a finance employee in the Hong Kong office of British engineering group Arup transferred HK$200 million (about $25 million) in 15 payments after a video call in which the company’s chief financial officer and several colleagues turned out to be deepfakes. In May, fraudsters tried to impersonate WPP chief executive Mark Read, using a voice clone and YouTube footage in a fake Microsoft Teams meeting. That attempt failed.

Online payment fraud is growing too. Juniper Research estimates that merchants lost $38 billion to it in 2023 and expects cumulative losses to exceed $362 billion between 2023 and 2028.

“Deepfakes don’t break your technology, they break your processes,” says Mkhiyarian. “The fix is unglamorous and effective: no payment or change of bank details is ever approved on the strength of a call or a video alone. You confirm through a second, pre-agreed channel, and you give junior staff explicit permission to slow down a ‘CEO’ who is in a hurry.”

Regulation is raising the bar

Regulators are responding with tougher rules. In the US, the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022 will require critical infrastructure operators to report significant incidents to CISA within 72 hours and ransom payments within 24 hours; CISA published its draft rule in April 2024. Since December 2023, SEC rules have required listed companies to disclose material cyber incidents within four business days of deciding that they are material.

The EU has gone further. NIS2, which member states were meant to write into national law by 17 October 2024, extends mandatory cybersecurity requirements to 18 sectors, makes management bodies accountable for cyber risk and introduces staged reporting: an early warning within 24 hours, a fuller notification within 72 hours and a final report within a month. Only a handful of countries met the deadline, and on 28 November the European Commission opened infringement proceedings against 23 member states. From 17 January 2025 the Digital Operational Resilience Act (DORA) applies to banks, insurers, investment firms and other financial entities, covering ICT risk management, incident reporting, resilience testing and the management of technology suppliers. In the UK, rules for critical third parties to the financial sector take effect on 1 January 2025.

“DORA is often treated as a compliance project, but its real value is that it forces the board to answer uncomfortable questions,” says Mkhiyarian. “Which services are critical? Which cloud and software providers do they depend on? What happens if one of those providers fails tomorrow? If you can’t produce a register of your ICT dependencies and a tested exit plan, you don’t really know your risk.”

Identity is the new perimeter

Hybrid working and the move to the cloud have dissolved the old network boundary. “Security models built around an office and an on-premises data centre assumed that anything inside the firewall could be trusted,” says Mkhiyarian. “Today every user, device and workload has to prove who it is, every time, and get only the access it needs for as long as it needs it.”

This is the core of Zero Trust, set out by the US National Institute of Standards and Technology (NIST) in SP 800-207. In practice it means strong authentication, checks on device health, least-privilege access and network segmentation, so that one compromised laptop or account does not give an attacker the run of the network.

Simplicity matters as well. Forcing staff to change passwords every few months tends to produce predictable variations rather than better security. NIST’s draft update to its digital identity guidelines, published in August 2024, would stop organisations from requiring periodic password changes unless there is evidence of compromise. Mkhiyarian would go further: “Move administrator and remote access to phishing-resistant authentication, meaning FIDO2 security keys or passkeys. Push notifications and SMS codes are better than nothing, but attackers have learned to bombard people with prompts or simply talk the help desk into resetting them.”

Legacy systems make the change harder. Wendy Nather of Cisco has compared older architecture to a layer cake, in which each new application depends on the layers of infrastructure beneath it, so altering one layer risks breaking everything above.

The cloud: safer by default, not by magic

For most organisations, the cloud raises the security baseline. Providers patch the underlying infrastructure centrally, and the major platforms tightened their defaults in 2024: Microsoft began enforcing MFA for Azure portal sign-ins in October, AWS started requiring MFA for root users, and Google Cloud announced that MFA will be mandatory for all users during 2025.

“Moving email, collaboration and other commodity services to the cloud frees internal teams to focus on what is unique to the business,” says Mkhiyarian. “But the shared responsibility model is where companies get hurt. The provider secures the platform. You are responsible for identities, configuration and data. Encryption, segmentation and tight access policies are your job, not theirs.”

The 2024 attacks on Snowflake customers showed what that means in practice. Using credentials stolen by infostealer malware, some of them years old, a group Mandiant tracks as UNC5537 accessed data belonging to up to 165 organisations, including AT&T, Ticketmaster and Santander. Snowflake’s own platform was not breached. The affected accounts simply had no multi-factor authentication.

The wider data tells the same story. In the Thales Cloud Security Study 2024, human error and misconfiguration were the leading cause of cloud data breaches (31%), and failure to use MFA was a factor in 17%. Nearly half (47%) of corporate data held in the cloud is sensitive, yet fewer than 10% of enterprises encrypt 80% or more of it. IBM found that 40% of breaches in 2024 involved data spread across several environments, which makes them harder to detect and contain.

“For a start-up, cloud first is usually the right call, because you inherit security capabilities you could never build yourself,” Mkhiyarian says. “Large enterprises with a mix of on-premises systems, SaaS and several clouds face a different problem: visibility. You can’t protect what you can’t see, so continuous monitoring of cloud configurations and permissions is no longer optional.”

People: the most exploited vulnerability

Attackers rarely need to break technology when they can persuade someone to open the door. The MGM attack reportedly began with a phone call: the attackers found an employee’s details on LinkedIn, impersonated them to the IT service desk and talked staff into resetting their credentials. Research by Elevate Security found that 8% of employees are responsible for 80% of breaches caused by human error.

“An annual compliance video doesn’t change behaviour,” says Mkhiyarian. “What works is short, frequent exercises based on the attacks your company actually sees, combined with measurement. If you know who repeatedly clicks, or who has access to the most sensitive systems, you can give those people more support and stronger controls. The aim is to turn staff into an early-warning system, what the industry calls a human firewall, so that someone reports a suspicious call or email within minutes rather than days.”

Technology helps. Email security tools now use machine learning to flag lookalike domains and unusual payment requests, and many help desks have introduced stricter identity checks before resetting credentials, a direct lesson from the Scattered Spider attacks.

Suppliers and the supply chain

Every new supplier extends the attack surface. “Due diligence shouldn’t stop at a certificate,” says Mkhiyarian. “ISO 27001, SOC 2 reports and the Cloud Security Alliance’s STAR registry are a useful starting point. But you also need to know what data the supplier holds, how and when they would tell you about an incident, and what you would do if their service went down.”

2024 provided painful examples. In June a ransomware attack on CDK Global, whose software runs around 15,000 car dealerships in North America, sent many dealers back to pen and paper for about two weeks; the company reportedly paid a $25 million ransom. The same month, an attack on pathology provider Synnovis disrupted blood testing at major London hospitals and forced thousands of outpatient appointments and planned operations to be postponed. And in July a faulty CrowdStrike update crashed some 8.5 million Windows machines worldwide, a reminder that a supplier does not need to be hacked to cause havoc.

Mergers and acquisitions add another layer of risk. “When you buy a company, you buy its technical debt and possibly its intruders,” Mkhiyarian says. “A security assessment belongs in due diligence before signing, and networks shouldn’t be connected until you’ve confirmed the acquired environment is clean.”

Plan for the worst

“No defence is impenetrable, so recovery has to be designed in from the start,” says Mkhiyarian. “A response plan has to say who makes decisions, how people communicate if email and chat are down, and which services come back first.” She singles out three elements:

1. Isolated backups. Backups should be immutable and kept apart from the production identity system, so the credentials used to run day-to-day operations cannot delete them. In Sophos’s 2024 research, 90% of financial firms hit by ransomware said attackers had tried to compromise their backups, and almost half of those attempts succeeded.
2. Tested recovery. A backup is only as good as the last time it was restored. Regular restore drills show how long recovery really takes and whether that fits the business’s tolerance for disruption.
3. Rehearsed response. Tabletop exercises involving executives, legal, communications and IT make sure people know their roles before a real incident, including when to isolate systems and when to call in outside specialists.

Regulators are pushing in the same direction. DORA and the UK’s operational resilience rules require firms to identify their important business services, set limits on how long each can be disrupted and show that they can stay within them.

“In a severe incident you may be working on personal phones and spreadsheets for days,” Mkhiyarian adds. “Companies that have practised operating in a degraded mode recover much faster than those that improvise.”

The role of cyber insurance

Cyber insurance can cover incident response, data recovery, business interruption and legal costs. Critics argue that it encourages criminals by making victims more willing to pay. However, a 2023 study by RUSI, sponsored by the UK’s National Cyber Security Centre, found no compelling evidence that insured victims pay ransoms more often than uninsured ones.

“Insurance is a financial backstop, not a security control,” says Mkhiyarian. “Insurers have also become far stricter. Many now ask for MFA, endpoint detection and tested backups before they will issue a policy, which is a useful outside check on your basic hygiene.”

Priorities for 2025

Mkhiyarian’s advice for the year ahead is pragmatic:

• Treat identity as the perimeter: Zero Trust access, phishing-resistant MFA for privileged and remote access, and strict verification at the help desk.
• Patch internet-facing systems first, and assume they have already been probed.
• Keep backups isolated and immutable, and test restores regularly.
• Map critical suppliers and have an exit plan or workaround for each.
• Train staff continuously, with a focus on social engineering and payment fraud.
• Rehearse incident response with the board, not just the IT team.

“Cybersecurity is ultimately a question of business continuity,” she concludes. “The organisations that come through incidents best are not the ones with the most tools. They are the ones that know exactly what matters most to them and have practised protecting it.”