EVER-INCREASING CYBER THREATS IN THE IGAMING INDUSTRY AND BEYOND

In this article Leon Allen, Cybersecurity Director from Continent 8 Technologies, discusses the latest threats facing businesses as well as key areas of focus when it comes to mitigating a cyber attack.

Cyber attacks are rising at an unprecedented rate. In recent months we have seen public transport group Go-Ahead have its systems breached while NHS services were disrupted by an attack, reportedly impacting patient referrals, appointment bookings and other operations. Cybercrime is hitting the news all too frequently.

From these headlines, it is clear that no business is immune and companies of all sizes are being hit by increasingly sinister and sophisticated events that have the potential to take them offline, causing disruptions to products, services, revenues and reputations. In fact, the average cost of a data breach in 2022 is USD$4.35m, a record high.

We have seen this increase on our own platforms and no more so than with DDoS (Distributed Denial of Service) attacks.

Our stats show record-breaking attacks on our customers, with Q4 2022 being the most attacked quarter ever for Continent 8. In fact, we saw more than a 400% increase in DDoS attacks when comparing Q4 2021 with Q4 2022.

The National Cyber Security Centre (NCSC) published an important study in 2021 into cybersecurity practices within the UK gambling and lottery sector, and it makes for a very interesting read.

Conducted by Ipsos MORI, it takes a close look at the attitudes towards cybersecurity, the key threats organisations are up against, the level of preparedness and the increased risk of falling victim to an attack faced by those that rely heavily on third parties.

Some of the key findings in the report include:

1) Attitudes towards cybersecurity: The report noted that the majority of stakeholders saw cybersecurity as a “very important function” within their organisation because it could directly impact customer trust and confidence in the products and services they offer. They further noted that cybersecurity was a “high priority” within the organisation but that it was a “competing priority” and that it was seen more as part of the IT function than as being integral to the overall success of the business.

2) The types of threat being faced: The report identified four of the most prevalent threats being faced by organisations in the gambling and lottery sector. It’s no surprise that Distributed Denial of Service (DDoS) attacks made the list, but the most prevalent threat identified was credential stuffing (i.e. using previously stolen credentials).

Other threats highlighted include phishing and ransomware, which was identified as the “most severe threat” both in terms of an organisation’s ability to defend against a possible attack and in terms of the impact it could have.

3) Levels of preparedness: Those interviewed for the report said they felt they were “well prepared to deal with cyber attacks” but many noted challenges when it came to ensuring that cybersecurity was taken into “consideration at every step of the product development” and ensuring better ownership of risks.

Employee awareness was also considered to be good, but this can only be achieved by continued training through a mix of mandatory courses as well as fictitious attacks (such as phishing campaigns) to test and improve the resilience of the wider workforce.

4)Third-party and supply chain management: One of the most interesting findings to come out of the report was the reliance on third parties, and in particular game studios and content providers, and the impact this has on security.

All of the organisations interviewed for the report used a large number of third-party providers, ranging from between 75 and 10,000.

The report highlighted a number of risks of using third parties to such a great extent, including the confidentiality of user data as well as the increased risk of cyber attacks against their own systems and networks if a third-party provider were to become compromised.

But what can a business do to protect itself? A defensive, layered approach to security, with safeguards that encompass people, processes, and technologies is the ideal.

These are the key areas of focus when it comes to mitigating a cyber attack.

1) Primary defences

Ensure your primary forms of protection are in place and are as robust as possible.

Primary defences include utilising a private network for hosting and communication, enterprise DDoS and Web Application and API protection (WAAP) and ensuring your public and private cloud environments are secure.

2) Endpoint protection and Security Information and Event Management (SIEM)

Given the new normal of remote and hybrid working practices, ensuring an organisation’s infrastructure is not breached, no matter where the perimeter may now be, is crucial. Just as crucial is ensuring if something untoward happens (such as a breach), the appropriate teams are immediately notified.

If it has not been done already, it’s essential to find out how endpoint protection and security event management can be applied to your infrastructure.

3) Awareness and education

It has been widely reported that phishing attacks, and other scams targeted to exploit our natural human fears, have increased significantly, especially with more people now working from home.  

As such, companies need to ensure that all staff members, from the board to senior executives and all employees, are trained when it comes to cybersecurity, DDoS, ransomware and phishing.

Organisations need to strengthen their defences today to give themselves the best opportunity to successfully protect themselves against an attack.

The Continent 8 team, including Leon, will be attending ICE London, 7-9 February, and will be on hand to discuss their layered cybersecurity solutions – Stand N3-110.

Leon Allen, Cybersecurity Director at Continent 8 Technologies