Wrapping Up Cybersecurity Awareness Month!

When it comes to protecting your organization from cyber-attacks there is no one-size-fits-all solution. Organizations across all industries need to assess their specific technologies to adopt a cybersecurity posture that meets their needs – especially with more employees working remotely.

Let’s dive into some of the most common forms of cyber threats, what you can do to prepare your organization, and why you need a disaster response plan to better prepare your organization for the inevitable.

Common Cyber Threats:

Phishing is when someone tries to trick you into giving them your personal information, such as your password or credit card number. They might do this by sending you an email or text message that appears to be from someone you know, or by creating a fake replica of a website, with the intention of getting users to click or reply.

Malware is software that can damage your computer and steal your information. Malware is installed on a device when a user clicks on a link, which is disguised as a friendly attachment. Once the malware executable is installed on the device it can wreak havoc on files, settings, & potentially hide in the background collecting the users’ activities on the device. If left unnoticed, this can further infect other devices on the same network and disrupt normal operations.

Ransomware is a type of malware that locks up your files allowing the sender to demand payment to unlock them. The best defense against an attack like this is to have a robust backup solution in place. Without a backup of your data, you are vulnerable to cyber threats such as this one.

Social Engineering is a type of cybercrime in which criminals use manipulation to trick people into performing actions or sharing confidential information. This can include anything from clicking on a malicious link to revealing sensitive information. Unfortunately, social engineering is becoming increasingly common, as cybercriminals learn to exploit human error and publicly available information from social media platforms.

There is no off-the-shelf solution that can protect an organization from all phishing, malware, and ransomware attacks, but there are some important steps that can be taken to improve security and reduce the likelihood of a successful attack.

Enhancing Security:

First, it is important to have a strong and up-to-date security system in place, including firewalls, intrusion detection/prevention systems, and anti-virus/anti-malware software. This is a system that needs to be monitored regularly for critical alerts and patches for virus definitions. All devices in your organization should be scheduled to receive updates to ensure the operating system and third-party applications are not susceptible to the latest security exploits.

Organizations should also have a backup plan for critical data in case of a successful attack. If a hacker successfully collects enough user information, they can access that user’s account, along with any files they may have access to. Your backups need to be protected from an attack on your computer, network, or user accounts. There are dozens of reputable vendors that provide encrypted cloud-based backup solutions to ensure that your information is protected in the event of an attack. This key element can make or break your business if you are not prepared.

Creating a Business Continuity and Disaster Recovery (BCDR) plan involves having a process in place to maintain or quickly resume critical business functions in the event of an outage or disaster. Organizations should also have a plan in place for how to respond to an attack, including how to contain the damage and restore any lost data. This plan should be regularly tested and updated as needed.

How do you build an effective BCDR plan?

Risk assessment and mitigation: Organizations should first identify and assess the risks that could potentially impact their business’ operations. Once risks have been identified, appropriate mitigation strategies should be put in place to minimize the impact of these risks.

Business continuity planning: A robust business continuity plan should be developed to ensure that the organization can continue to operate in case of a disruptive event. The plan should detail how the organization will maintain critical functions and keep key personnel safe.

Disaster recovery planning: A disaster recovery plan should be in place to ensure that the organization can recover from a major disruptive event. The plan should detail the steps that must be taken to restore critical systems and data.

Communication and coordination: In the event of a disruptive event, it is crucial that the organization has a plan in place for communicating with employees, customers, and other stakeholders. The plan should also detail how the organization will coordinate its response with local, state, and federal agencies.

Training and testing: Employees should be trained in the organization’s BCDR plans and procedures. The plans should also be regularly tested to ensure that they are effective.

Employee Training:

Additionally, employees should be educated on how to recognize phishing emails and other suspicious activity, and they should know what to do if they believe they have been targeted by an attack. Implementing a Cybersecurity Awareness Training (CSAT) program is ideal for every organization, as it keeps your employees up to date on the latest security threats, and identifies how to identify malicious emails and how to respond to these threats. Another feature of these programs is to schedule random simulated phishing emails to your users, so you can assess how each user responds to certain types of phishing emails and social engineering tactics. Customized training plans can be set for users who need a little extra training.

The list of cybersecurity threats and countermeasures that organizations can take to protect themselves is constantly evolving. It’s important that your company has a dedicated role in implementing and maintaining these programs as they continue to change.

Security Tips:

Here are 9 general security tips to help you protect your business:

• Train your employees in cybersecurity best practices.

• Create and enforce strong passwords for all accounts (these passwords should be complex and not reused). You can use a Password Manager to ensure your passwords are unique and secure.

• Use multi-factor authentication whenever possible. By requiring you to use multiple forms of authentication, cybercriminals will have a harder time gaining access to your account, even if your password is compromised.

• Keep your software and operating systems up to date.

• Use only trusted websites and apps. Be cautious of subtle methods of information gathering, such as quizzes that ask for personal details.

• Be cautious of email attachments and links. Hover your mouse over links before you click. When you hover your mouse over a link, you will be able to see the URL that you will be taken to if you click.

• Back up your data regularly.

• Implement security measures such as firewalls and antivirus software. Keep security software up to date.

• Monitor your network for unusual activities.

TIP! When verifying that a website is safe to visit, it’s important to look at the first few letters of the website’s URL. Many URLs will either begin with HTTP or HTTPS. The difference between these is that HTTPS is secure, while HTTP is not secure. Websites that use HTTPS are encrypted, which means the information on these sites is protected against unauthorized users.

Cybersecurity is important for businesses of all sizes. If you are ever suspicious of an email, message, or link you received, it is good practice to contact the sender directly, or your IT Manager, to confirm the content is safe. This should always be done outside of the channel of communication in question.

Every employee is an important part of their organization’s human firewall. Use strong passwords, use multiple layers of security, and be aware of what data you share and who you share it with. If your personal information is ever shared in a data breach, quickly change your passwords, and reach out to your IT team for guidance. Stay safe!