The third major area of concern is ransomware, which Sjouwerman said has grown tremendously as cybergangs compete for criminal market share. In a typical ransomware attack, which is mainly delivered through spam or phishing emails, the malware renders computer systems, devices or files inaccessible and holds the victim hostage until they make the payment, usually in the form of bitcoins.

Sjouwerman pointed out two recent, concerning developments in ransomware. One is a worm-like feature that is added to a particular ransomware strain, which essentially replicates itself over the network and locks machines.

The other is a new strain called Crysis, which encrypts personal documents found on a victim's computer and sends a few encrypted files to the control and command server.

"That is really bad because that gets you into data breach territory. That is one strain of ransomware that you do not want to get hit with," Sjouwerman told attendees.

Sjouwerman suggested credit unions consider employing the concept defense-in-depth in order to become a hard target. Defense-in-depth is a multilayered, holistic approach that uses specific countermeasures to create an aggregated security posture to help defend against cybersecurity threats and vulnerabilities.

The KnowBe4 CEO said, "If you are a sufficiently hard target they will go somewhere else. You need to defend the outside mushy, messy layer of humans and turn that into a human firewall. You need to continue with defending your perimeter, network, applications and data."

It is a constant struggle to enlighten decision makers about the risks that are currently out on the internet, Sjouwerman explained.

"Equipping somebody with email is very handy and customers expect it, but it opens up a massive hole in your defenses," he said. "Essentially, you need to train employees to spot the red flags."