Four Ways to Improve Cybersecurity and Ensure Business Continuity

David Discenza

Four Ways to Improve Cybersecurity

Cyber-attacks on businesses have become common place. In fact, it’s estimated that a cyber-attack occurs every 39 seconds. Who are the targets of these attacks? You might think that it’s large corporations and, in a way, you’d be correct. Cybercriminals are smart, though, and know that large corporations invest millions of dollars in cybersecurity for their information technology systems. A “frontal assault” isn’t likely to work but gaining access through a “back door” provided by a vendor or supplier will.

security wordpress 101

Polling from Insureon and Manta finds that only 16 percent of small business owners think they are susceptible to a cyberattack. Yet, 61 percent of attacks occur at smaller businesses. So what can small to mid-sized businesses do to improve their cybersecurity?

Four steps immediately come to mind:

  1. Acknowledge that your company is a target for cyberattacks

The first step in solving a problem is to first admit there is one. As stated above, most small to mid-sized businesses do not believe they are a target for cyberthieves. Consider the following well-known case study.

In late 2013, the Target corporation reported the credit card information of 40 million customers had been stolen by hackers. Cyberthieves had gotten access to Point Of Service (POS) credit card readers in their stores. So, when a customer swiped their cards on a purchase, the hackers stole the information. Target only learned about the breach when they were contacted by the US Department of Justice. The company had missed their own internal warning of the breach. In January, Target upped the number of compromised cards to 70 million, creating a huge public relations nightmare for themselves.

How could this happen? The hackers did their homework. 

  1. Scoured Google to find the names of all the vendors with whom Target does business.
  2. Found information online of the structure of Target’s computer network infrastructure
  3. Discovered detailed information about the POS system used by Target in a case study found on Microsoft’s website.
  4. Likely sent an email using false credentials containing Malware to all of Target’s vendors.

The malware was designed to steal passwords. That email was opened by a Target vendor and the malware was released into their computer system. The vendor did have anti-virus/anti-malware software in place; however, it was the free version which only ran when someone thought to scan the network and it wasn’t licensed for corporate use. The hackers got the passwords necessary to access Target’s network through a vendor portal. Armed with the knowledge gleaned from their search, they were able to attack Target’s POS system and steal the credit card information of 70,000 customers.

If your company is a vendor or supplier to a larger firm, then you’re a target. That takes us to the second step in this process.

  1. Understand that your employees are your weakest link

The most common form of cyberattacks is the “phishing” email which employs elements of social engineering. Social engineering is the use of deception that counts on the trust of the person being attacked in order to succeed. Let’s say you receive an email from your boss with an attachment that instructs you to open the attachment. You do as you’re instructed because the email is from your boss. When you click on the attachment, nothing happens. So, you click on it again with the same result. While it may seem to you that nothing has happened, in fact you’ve introduced a virus into the computer network. Yes, it’s that simple.

Here’s something else to consider. 60% of cyber-attacks that occurred in 2016 came from within companies. Of those 60% of attacks, three-quarters were intentional. This means that unhappy employees are striking back at their employers through the computer network. There are steps you can take to reduce this threat:

  • Require the use of “strong” passwords that contain numbers, capital and lowercase letters, special characters like @,!,$,(, ) , and are at least eight characters in length
  • Require the changing of passwords several times a year
  • Physically secure laptops by using a docking port that’s secured to a desk
  • Institute and enforce a policy of screen locking computers when a person is away from their desk
  • Do not allow sensitive information to be stored on laptops or phones; use a “cloud” service instead
  1. Your employees are your front line of defence

Employees can be your front-line of defence in the war against cyber thieves. This is not a problem for your IT staff alone. Everyone in your company has to take responsibility for cybersecurity because everyone with an email address is a target.

Here are some best-practices your company can follow:

  • Invest in a cyber-awareness training program and make it mandatory for everyone from the C-Suite to the custodial staff
  • Recognize employees who find and eliminate cyber threats
  • Provide remedial training for any employee who inadvertently falls for a cyber attack
  • Make cybersecurity activities a part of your employee annual review
  • Immediately terminate network access for everyone who leaves the company regardless of the reason

Bring your Human Resources policies in line to recognize and deal with this threat. Termination should be considered for those employees who repeatedly ignore your cybersecurity policies.

  1. Include cyberattacks in your business continuity planning

Business continuity planning is about making certain your business can survive and recover quickly from a disruptive event. Recent experiences in Atlanta and Baltimore where municipal Government was shut down because of ransomware should be on every business person’s mind. As of early July 2019, Baltimore still has yet to fully recover from the attack.

A cyberattack against your business isn’t just against your business. By extension, it’s also an attack against your customers, your vendors, and your suppliers. You probably can’t run your business without your IT systems, so how will you fill, place, and ship orders, run payroll, and do all the things that rely on your computer network if you’re the target of a cyberattack?

Here are questions you need to ask:

  • Are all your critical business processes documented?
  • Do you have manual workarounds documented for those processes that rely on your computer network?
  • Have you practiced using those manual workarounds, so you know they actually work?
  • How will you communicate with your customers, vendors, suppliers, and any other stakeholders to assure them that you have the situation in hand?

It’s imperative that you invest in business continuity planning. Cyber-attacks will increase as a threat, and you must be prepared to face this threat head on. Taking these steps will allow you to do so, address your employees and vendors’ cyber Vulnerabilities, and protect your organization and its customers.

By David Discenza

Johan

Why the digital infrastructure is a matter of national interest!

Digital Infrastructure National Interest When the Internet was born, it promised a form of democracy and guarantee that everybody could be part and setup their ...
Mark Banfield

A Seamless Customer Experience Is Essential to Success in Today’s Digital Economy

Implement A Seamless Customer Experience The need for digital interaction has never seemed more critical than it does today. As the coronavirus continues to spread, ...
Atman Rathod

How APIs and Machine Learning are Evolving? 

Machine Learning Continues to Make API Development Better  For any developer, API or Application Programming Interfaces come as the helpful components to add valuable features ...
Miha Kralj

SaaS Native – Design, Delivery and Management of Applications

Going cloud native, the right way Moving from a traditional IT organization to one that’s cloud native is an inevitability for all businesses. This is ...
Martin Mendelsohn

Who Should Protect Our Data?

Who Should Protect Our Data in The Cloud? You would think that cloud service providers are safe havens for your personal data – they all ...
David Gevorkian

Why Web Accessibility is Important and How to Avoid Lawsuits

Why Web Accessibility is Important In today’s digitally driven world, those with disabilities are normally the ones experiencing difficulties when using and navigating the web ...
Patrick Joggerst

Why Platforms Matter as UCaaS Adoption Continues to Soar

UCaaS Adoption Continues to Soar Industry analysts agree – the unified communications-as-a-Service (UCaaS) market will continue to grow by leaps and bounds in 2020 and ...
Robert Van Der Meulen

Focusing on Online Gaming Security During Development

Online Gaming Security Infrastructure Updated article: June 2nd, 2020 There are millions of gamers around the globe and as of 2018, video games generated sales ...
Brad Thies

SOC Reporting Requirements You Need to Know in a Cloud Environment

SOC Reporting Requirements Security lapses in some of the world's biggest companies continue to appear in news headlines, and information security is top of mind ...
Mor Cohen Tal1

The Top 2 Challenges of Next-Gen Applications

Challenges of Next-Gen Applications When you think of why customers move to the cloud, there are a few key things that they're trying to achieve ...