Four Ways to Improve Cybersecurity and Ensure Business Continuity

Four Ways to Improve Cybersecurity

Cyber-attacks on businesses have become common place. In fact, it’s estimated that a cyber-attack occurs every 39 seconds. Who are the targets of these attacks? You might think that it’s large corporations and, in a way, you’d be correct. Cybercriminals are smart, though, and know that large corporations invest millions of dollars in cybersecurity for their information technology systems. A “frontal assault” isn’t likely to work but gaining access through a “back door” provided by a vendor or supplier will.

security wordpress 101

Polling from Insureon and Manta finds that only 16 percent of small business owners think they are susceptible to a cyberattack. Yet, 61 percent of attacks occur at smaller businesses. So what can small to mid-sized businesses do to improve their cybersecurity?

Four steps immediately come to mind:

  1. Acknowledge that your company is a target for cyberattacks

The first step in solving a problem is to first admit there is one. As stated above, most small to mid-sized businesses do not believe they are a target for cyberthieves. Consider the following well-known case study.

In late 2013, the Target corporation reported the credit card information of 40 million customers had been stolen by hackers. Cyberthieves had gotten access to Point Of Service (POS) credit card readers in their stores. So, when a customer swiped their cards on a purchase, the hackers stole the information. Target only learned about the breach when they were contacted by the US Department of Justice. The company had missed their own internal warning of the breach. In January, Target upped the number of compromised cards to 70 million, creating a huge public relations nightmare for themselves.

How could this happen? The hackers did their homework. 

  1. Scoured Google to find the names of all the vendors with whom Target does business.
  2. Found information online of the structure of Target’s computer network infrastructure
  3. Discovered detailed information about the POS system used by Target in a case study found on Microsoft’s website.
  4. Likely sent an email using false credentials containing Malware to all of Target’s vendors.

The malware was designed to steal passwords. That email was opened by a Target vendor and the malware was released into their computer system. The vendor did have anti-virus/anti-malware software in place; however, it was the free version which only ran when someone thought to scan the network and it wasn’t licensed for corporate use. The hackers got the passwords necessary to access Target’s network through a vendor portal. Armed with the knowledge gleaned from their search, they were able to attack Target’s POS system and steal the credit card information of 70,000 customers.

If your company is a vendor or supplier to a larger firm, then you’re a target. That takes us to the second step in this process.

  1. Understand that your employees are your weakest link

The most common form of cyberattacks is the “phishing” email which employs elements of social engineering. Social engineering is the use of deception that counts on the trust of the person being attacked in order to succeed. Let’s say you receive an email from your boss with an attachment that instructs you to open the attachment. You do as you’re instructed because the email is from your boss. When you click on the attachment, nothing happens. So, you click on it again with the same result. While it may seem to you that nothing has happened, in fact you’ve introduced a virus into the computer network. Yes, it’s that simple.

Here’s something else to consider. 60% of cyber-attacks that occurred in 2016 came from within companies. Of those 60% of attacks, three-quarters were intentional. This means that unhappy employees are striking back at their employers through the computer network. There are steps you can take to reduce this threat:

  • Require the use of “strong” passwords that contain numbers, capital and lowercase letters, special characters like @,!,$,(, ) , and are at least eight characters in length
  • Require the changing of passwords several times a year
  • Physically secure laptops by using a docking port that’s secured to a desk
  • Institute and enforce a policy of screen locking computers when a person is away from their desk
  • Do not allow sensitive information to be stored on laptops or phones; use a “cloud” service instead
  1. Your employees are your front line of defence

Employees can be your front-line of defence in the war against cyber thieves. This is not a problem for your IT staff alone. Everyone in your company has to take responsibility for cybersecurity because everyone with an email address is a target.

Here are some best-practices your company can follow:

  • Invest in a cyber-awareness training program and make it mandatory for everyone from the C-Suite to the custodial staff
  • Recognize employees who find and eliminate cyber threats
  • Provide remedial training for any employee who inadvertently falls for a cyber attack
  • Make cybersecurity activities a part of your employee annual review
  • Immediately terminate network access for everyone who leaves the company regardless of the reason

Bring your Human Resources policies in line to recognize and deal with this threat. Termination should be considered for those employees who repeatedly ignore your cybersecurity policies.

  1. Include cyberattacks in your business continuity planning

Business continuity planning is about making certain your business can survive and recover quickly from a disruptive event. Recent experiences in Atlanta and Baltimore where municipal Government was shut down because of ransomware should be on every business person’s mind. As of early July 2019, Baltimore still has yet to fully recover from the attack.

A cyberattack against your business isn’t just against your business. By extension, it’s also an attack against your customers, your vendors, and your suppliers. You probably can’t run your business without your IT systems, so how will you fill, place, and ship orders, run payroll, and do all the things that rely on your computer network if you’re the target of a cyberattack?

Here are questions you need to ask:

  • Are all your critical business processes documented?
  • Do you have manual workarounds documented for those processes that rely on your computer network?
  • Have you practiced using those manual workarounds, so you know they actually work?
  • How will you communicate with your customers, vendors, suppliers, and any other stakeholders to assure them that you have the situation in hand?

It’s imperative that you invest in business continuity planning. Cyber-attacks will increase as a threat, and you must be prepared to face this threat head on. Taking these steps will allow you to do so, address your employees and vendors’ cyber Vulnerabilities, and protect your organization and its customers.

By David Discenza

Martin Mendelsohn

How Will COVID-19 Impact Security Talent?

New Security Talent As we emerge from the era of COVID-19, unemployment will recede, and new jobs will be created more rapidly than jobs were lost between March and May of this year. We’re already ...
The Top 20 Cybersecurity Startups To Watch In 2021

The Top 20 Cybersecurity Startups To Watch In 2021

20 Cybersecurity Startups Cybersecurity, privacy and security startups have raised $1.9 billion in three months this year, on pace to reach $7.6 billion or more in 2021, over four times more than was raised throughout ...
Big Data Explosion

Developing Machine Learning-based Approach for Optimizing Virtual Agent (VA) Training

Optimizing Virtual Agent (VA) Training Achieve NLU model’s precision, recall & accuracy up to 78% The success of any Virtual Agent (VA) depends on the training of its Natural Language Understanding (NLU) model prior to ...
Efficient Dispatch Operations with Spare Location Intelligence for DSPs

Efficient Dispatch Operations with Spare Location Intelligence for DSPs

Digitally transform operations of field technicians, design & planning team to reduce overall MTTR by 45% Most of the Digital Service Providers (DSPs) are struggling with the rising cost of repeat-dispatch and a higher Mean ...
Johan

Why the digital infrastructure is a matter of national interest!

Digital Infrastructure National Interest When the Internet was born, it promised a form of democracy and guarantee that everybody could be part and setup their company to contribute and make the Internet better. Today - ...
Patrick Joggerst

Payments Companies Will Always See ROI on Embedded Real Time Communications

ROI on Embedded Real Time Communications Without secure, real time communications applications, the financial services industry could literally come to a standstill. While transactions are driven by data, the human voice and human messaging continues ...