Why Cybersecurity Matters

In 2021, a ransomware attack on Colonial Pipeline — the company responsible for nearly half of the US East Coast's fuel supply — forced a five-day shutdown. Petrol stations ran dry across multiple states. The company paid $4.4 million in cryptocurrency to get their systems back. The attackers got in through a single compromised VPN password that had no multi-factor authentication on it. One password. Half a country's fuel supply.

The actual cost of a breach

Most people think about cyberattacks in terms of data theft — credit card numbers, passwords, personal records. That's real, but it's only one dimension of the damage. The full cost of a breach typically has four parts, and the visible one is often the smallest.

The reputational damage is the one that boards are most afraid of, and rightfully so. You can recover financially from a breach. Recovering customer trust after you've made the headlines for losing their data is a multi-year project — if it happens at all.

Every industry is a target now

There's a persistent myth that cybersecurity is a tech company problem. That hackers go after banks and software firms, and that a regional manufacturer or a local hospital doesn't need to worry much. This was never fully true, and it's catastrophically wrong today.

In 2020, a ransomware attack on Düsseldorf University Hospital in Germany caused patient care to be diverted to other facilities. A woman in critical condition who needed emergency treatment died after her ambulance was rerouted to a hospital 30 kilometres away. That is a direct, traceable line from a cyberattack to a human death. Cybersecurity stopped being abstract a long time ago.

Attackers target organisations based on two things: the value of what they hold and the weakness of their defences. Small organisations with outdated systems and no dedicated security staff are frequently easier targets than large enterprises with mature security programmes — even if the payout is smaller. Ransomware groups run this as a business. They optimise for return on effort.

The threat landscape is getting worse, not better

The volume and sophistication of attacks has increased every year for the past decade. There are three structural reasons for this that aren't going away.

The attack surface keeps expanding. Every IoT device, every cloud workload, every remote employee laptop is a potential entry point. The average enterprise now has tens of thousands of assets connected to the internet. Each one is an opportunity.

Attacks are increasingly commoditised. Ransomware-as-a-Service means that technically unsophisticated criminals can now rent attack infrastructure, pick a target, and split the proceeds with the group that built the tooling. The barrier to entry for launching a serious attack has dropped dramatically.

Nation-state actors have raised the stakes. The 2020 SolarWinds attack — where Russian intelligence compromised a software update mechanism and used it to infiltrate US government agencies, intelligence services, and major corporations — showed that the most dangerous adversaries aren't individual criminals. They're well-funded, patient, and operating at a scale that's difficult to defend against.

Why organisations still get this wrong

Given all of the above, you'd think organisations would be investing heavily in security. Many are. Many still aren't — and the reasons are predictable.

Security is invisible when it works. When a firewall blocks an attack, nobody sees it. When a phishing email is quarantined, nobody gets a notification. Good security is the absence of bad events, which makes it hard to justify budget for something whose value only becomes obvious when it fails.

The "it won't happen to us" bias. This is especially common in smaller organisations and in sectors that don't see themselves as obvious targets — manufacturing, logistics, local government. The 2021 attack on a water treatment plant in Oldsmar, Florida, where an attacker remotely changed the sodium hydroxide level in the water supply to a potentially lethal concentration, is a useful corrective to that assumption.

Security is seen as a cost centre, not a risk function. The organisations that handle this best frame security as risk management — the same way they'd think about fire insurance or business continuity planning. The ones that handle it worst treat it as an IT expense to be minimised.

What a basic security posture check looks like

Here's a command that helps you quickly audit which ports are exposed on a Linux system — one of the first things an attacker would check, and one of the first things a defender should verify:

# List all open ports and the services listening on them
# ss = socket statistics (modern replacement for netstat)
# -t = TCP connections only
# -u = UDP connections
# -l = listening sockets only
# -n = show port numbers, not service names
# -p = show the process using each socket
ss -tulnp

Netid  State   Recv-Q  Send-Q  Local Address:Port   Peer Address:Port  Process
tcp    LISTEN  0       128     0.0.0.0:22            0.0.0.0:*          users:(("sshd",pid=892,fd=3))
tcp    LISTEN  0       511     0.0.0.0:80            0.0.0.0:*          users:(("nginx",pid=1134,fd=6))
tcp    LISTEN  0       511     0.0.0.0:443           0.0.0.0:*          users:(("nginx",pid=1134,fd=7))
tcp    LISTEN  0       128     127.0.0.1:3306        0.0.0.0:*          users:(("mysqld",pid=1421,fd=23))
tcp    LISTEN  0       128     0.0.0.0:8080          0.0.0.0:*          users:(("java",pid=2981,fd=12))
tcp    LISTEN  0       128     0.0.0.0:5900          0.0.0.0:*          users:(("Xvnc",pid=3102,fd=7))
udp    UNCONN  0       0       0.0.0.0:68            0.0.0.0:*          users:(("dhclient",pid=611,fd=6))
udp    UNCONN  0       0       127.0.0.1:323         0.0.0.0:*          users:(("chronyd",pid=714,fd=5))

Practice Questions

Quiz