Yes, Luke Skywalker and his rag-tag band of rebels attacked the Death Star with their tiny ships, but it was an analysis of the Death Star plans that revealed a weakness in the battle station. Plans that were STOLEN and couriered to the Alliance by Princess Leia.
Sure, the movies seems to start with a huge destroyer, a tiny rebel ship, the defiant princess. But right before that, there was probably some guy with a thumb drive who cracked into the Death Star mainframe, downloaded the plans, and sold them. Probably in a seedy spaceport bar with a great band.
So the actual “star war” began through an act of cybercrime. A crime from the perspective of the Empire. All in the good cause of freedom if you’re on the side of the rebellion. But this is real life and there are real bad guys out to get your data.
Download our free Asset Protection Checklist to find the gaps in your internal and external data security.
Your Company Data Breach Won’t Turn Out As Well
A 2013 Forrester Research study is often quoted to show that “only” 31% of data breaches are due to loss or theft by employees. You would think that since this is such a simple leak to fix, and because there seems to be such an increase in criminal attacks (especially of large organizations), that a more recent update of the report would show this has decreased.
Instead, the “Forrester Report: Understand The State Of Data Security And Privacy: 2015 To 2016″ shows an increase in the percent of data breaches caused by employees. The report also says that “56% of internal incidents were due to inadvertent misuse or accident.” The other half were malicious and intended to cause harm to the company… or gain to themselves.
Have we become so familiar with computers that we think nothing bad can happen? What happened to the cautious days when people thought they’d “blow up the computer?” Computer guys and the family tech guru spent hours reassuring Grandma and the office Luddite that no, of course they’re not going to erase everything or ruin the Internet or blow up Alderaan.
They were wrong. You can destroy a system with the click of a button. And the most likely source – by a small margin – is going to be your most diligent, hard-working, and most trusting employee. The other source will be the disgruntled insider.
Stormtrooper FN-2187 bailed at his earliest opportunity. He would have taken some Death Star plans with him if he could have, we’re sure.
We know that you are a kind and benevolent leader, so it’s most likely that your company data breach will come at the hands of one of most diligent, hard-working employees. Most of whom report not getting any cyber-security training at all. Here is a quick guide to some of the best ways you can train and help prevent accidental breaches and losses caused by your employees.
It’s impossible to guarantee you’ll never get a virus or lose data to a network or server problem, but you can take some relatively simple precautions to greatly reduce the chances and massively decrease the damage they cause.
Download our free Asset Protection Checklist to find the gaps in your internal and external data security.
Regularly Train and Drill Employees
Your employees are thoughtful, kind, law-abiding citizens. They probably don’t even know that this type of scam exists or how incredibly costly it could be.
You need to make sure that every single employee knows what phishing emails are, how to detect them, and how to not get suckered in by them.
Once you’ve implemented regular internet security awareness training, you also need to test them. Sorry, but your employees – everyone’s employees – are the weakest link when it comes to network and internet security. Breach after breach has been announced due to lax security and downright dumb actions of insiders in organizations that you think would know better.
Everyone knows that a Nigerian prince didn’t leave them $50,000,000. Those are easy to spot and unfortunately lulls people into thinking the scammers have learned their lesson. Oh, they have. The hackers have gone pro and their attacks have become ever more sophisticated.
The latest version takes advantage of the tax-time rush. The IRS released an alert in March, 2016 to alert payroll and human resource professionals of a emerging phishing scheme deliberately targeting them.
IRS Commissioner John Koskinen, warned: “If your CEO appears to be emailing you for a list of company employees, check it out before you respond. Everyone has a responsibility to remain diligent about confirming the identity of people requesting personal information about employees.”
Test and train your team with a simple simulated attack that rolls out harmless “phishing” emails to employees to see who “bites” and needs a refresher in how to spot phishing emails.
Ban Free, Generic Email Accounts
No one in your organization should be using Yahoo.com, Hotmail.com, Comcast.net, ATT.net, or Earthlink.net email accounts for their official business email. First, it doesn’t say “grown-up business,” especially if it’s an address based on inappropriatehobby@hotmail.com. Second, it tells people that you don’t have control over your brand image or your digital identity.
Third, and most important from a security standpoint, these email accounts are one of the two most likely entry points for viruses and ransomware. They aren’t managed or filtered for anything but the most obvious and crude malware attachments. You have no control over these messages or what they allow into your system.
Your I.T. support cannot help you manage or monitor what’s coming in through these services. A Hosted Exchange email environment can be rigorously monitored and managed and can be adjusted for more security and caution as needed.
If your employees have a personal Yahoo, Hotmail, etc. account, they shouldn’t be accessing that from their work computer either. Anything they click on, download, or let into the system is going into your network.
Sure, you can tell them to not do it, but that probably works as well as telling them to not leave their leftovers in the refrigerator. Unlike that problem, we do have an inescapable solution for keeping employees off of their dangerous personal email accounts.
Ironically the websites which prompted the rapid improvements in the Internet are among those that pose the most danger to users. Not stupid cat videos: porn sites. Even the “legit” sites are rife with malware, for example, embedded in downloads they say are needed to view videos.
Email attachment viruses are easier to avoid; don’t open anything you haven’t specifically verified is from a legitimate sources. But Norton by Symantec reports that ransomware is mostly found on suspicious websites and comes through stealth download or by clicking on an infected link.
While your employees are too dedicated and thoughtful to visit the “naughty” sites that are designed to deliver this malware, there are plenty of other types of pages and downloads that offer threats and dish up malware, including peer-to-peer file-sharing sites like BitTorrent or video download sites.
Web filtering can block any device on your network from getting to any site you specify. We can customize your web filters to be as exclusive or inclusive as you want. We can also adapt it for certain departments. For example, we have a large client where their Internet only allows access to a handful of the sites that their employees need to do their jobs.
Everything else – such as time-sucks like Amazon, Facebook, or YouTube – is blocked. The controls are fine-tunable though, so the marketing department, for example, can be allowed access to social media.
Content filtering stops damaging attachments or downloads from any allowed source, which may be a website that’s not blocked. Legitimate websites which aren’t maintained can be infiltrated and used to generate spammy pages that may be there for malware or phishing purposes. The content filter acts as an additional layer of protection for your network.
Add Additional Layers of Protection
We can almost guarantee you don’t have enough protection to keep your network and your business safe. This article touches only on a few. There are additional strategies that we use and recommend including Intrusion Detection Systems, Unified Threat Management firewalls, Barracuda spam firewalls, and Backup and Disaster Recovery appliances.
It might feel a little bit like piling on sweaters until you can’t put your arms down, but the enemy here isn’t a light dusting of snow on the ground. It’s an entire underground industry designed to hold your data hostage, steal your money, and generally make your life miserable.
Get our free Asset Protection Checklist and evaluate your defenses. Every missing application represents a gap in your defenses and a potential data breach or malware infection. A gap that the bad guys (or good guys) are looking for and prepared to exploit.
Download our free Asset Protection Checklist to find the gaps in your internal and external data security.
Questions? Feel free to reach out to us at (559) 485-4335.
Photo “The Work Fridge on a Friday at Noon-Thirty” courtesy of TheeErin, via Flickr, Creative Commons BY-ND 2.0
VIEW ALL