Four Important Lessons from the WannaCry Ransomware Attacks

The recent WannaCry ransomware attacks put cyber security on the front page of every newspaper in the world. Now, everyone knows what ransomware is and how destructive it can be, but will anything change? Following are four critical lessons that both organizations and individuals should take away from WannaCry.

No Organization is “Too Small” or “Unimportant” to Be Hacked

Too many businesses still think that only national or multinational firms, or companies in certain industries, have to worry about cyber security. However, hackers do not discriminate, and neither did the WannaCry ransomware. WannaCry, which took advantage of vulnerabilities in old, unsupported versions of Windows, sought out victims according to the operating systems they were running, not the size of their enterprises. While infections at large organizations like Renault, Telefonica, and the NHS grabbed the media’s attention, small businesses were hit as well. Often, small organizations are even more susceptible to hackers than multinationals because small firms are more likely to be running wildly outdated operating systems or have a “homemade” website that may or may not be secure.

Still not convinced that your small enterprise needs to take cyber security seriously? Consider the following: Over 40% of cyber attacks target small businesses, and the U.S. Securities and Exchange Commission reports that 60% of small firms will go out of business within six months of a data breach. There is no such thing as a business that hackers “don’t care about,” and the fallout from a hack can be catastrophic.

You Must Back Up Your Systems & Data

The best way to defend against an attack like the WannaCry ransomware is to take proactive steps to ensure it doesn’t happen in the first place. However, if an attack does occur – or if your computers are damaged in a fire or a natural disaster – a backup can mean the difference between reopening your doors immediately and your company being shuttered for days, weeks, even months. Because ransomware is often programmed to snake its way through an enterprise’s entire network, make sure that your backup drives are isolated from your main systems. Even better, partner with a secure cloud backup provider that is, at a minimum, compliant with AT-101 SOC 2.

Update, Update, Update

For all the havoc it wreaked on government entities and private-sector organizations, the WannaCry ransomware left nearly all home computers unscathed. This is because individuals, unlike organizations, are more likely to be running modern operating systems, and WannaCry took advantage of vulnerabilities in old versions of Windows, some of which Microsoft stopped supporting years ago. About 98% of victims were running Windows 7, which was first released in 2009. Yet none of these infections had to happen. Windows 7 is still being supported by Microsoft, and the company issued a patch for the OS in March. Apparently, though, a lot of users never downloaded it. In some cases, this may have been due to a mysterious flaw in Windows 7 that causes some machines to spontaneously stop auto-updating.

In today’s threat environment, clinging to antiquated operating systems and software is downright dangerous, as is not regularly updating modern systems. Software and OS updates often contain important security patches addressing new and emerging threats.

You’re Probably Better off Outsourcing Your Cyber Security

Cyber security moves at the speed of technology, and technology is advancing at the speed of light. New threats are emerging daily, and just keeping up with it all is a full-time job. Most businesses simply don’t have the in-house expertise, time, or budget to handle all of their cyber security needs in-house. Outsourcing your cyber security, risk management, and compliance to an experienced, reputable firm such as Continuum GRC is cheaper and far safer than attempting to protect your systems on your own.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance with all applicable laws, frameworks, and standards.

[bpscheduler_booking_form]

Why Your Employees Keep Clicking on Phishing Emails, and How You Can Stop It

The 2017 Verizon Data Breach Report is out, and it’s full of great news – if you’re a hacker. The study, which examined over 1,900 breaches and more than 42,000 attempts in 84 countries, showed that cyberespionage and ransomware are on the rise. The manufacturing industry is particularly vulnerable to having intellectual property and company secrets stolen by cyber spies. How do these spies and garden-variety hackers get into enterprise systems? Quite often, the Verizon report found, it all starts with a social engineering attack, most commonly a phishing email.

“Business Email Compromise” Scams Costing Firms Billions of Dollars

Verizon found that social engineering methods were used in 43% of reported breaches, and of those, 93% were in the form of a phishing email. Once hackers have successfully phished their way into an organization’s network, the next step is usually (95% of the time) to install malware.

Not long after the Verizon DBIR hit the virtual stands, the FBI came out with its own damning statistics regarding a phishing variant known as a “business email compromise” (BEC). In a BEC scam, hackers get hold of the login credentials for an email account belonging to a high-ranking company executive – once again, this is usually accomplished through phishing – and use it to send what appear to be legitimate emails requesting that employees or vendors make wire transfer payments. BEC scams, the FBI reported, saw an astounding 2,370% spike in “exposed losses” over a two-year period ending December 2016, totaling $5 billion.

Keep in mind that this $5 billion figure doesn’t count losses from other types of phishing emails, such as email spoofing or the compromise of personal email accounts. The brazen Google Docs phishing scam that ensnared approximately one million victims last week cost the state of Minnesota alone an estimated $90,000, as state employees scrambled to deal with the attack instead of doing their jobs.

The Hacks Will Continue Until Proactive Cyber Security is Prioritized

Why do employees keep clicking on phishing emails? In most cases, it’s because they don’t know any better. Despite living in an increasingly connected world, the majority of Americans have little or no understanding of cyber security best practices, especially how to identify phishing emails. They aren’t learning about cyber security best practices on their own time, and their employers aren’t teaching them, either. Companies are handing their employees login credentials, maybe installing a firewall and anti-virus package, and hoping for the best.

While technical controls such as anti-spam filters, network segmentation, and avoiding private email servers unless your organization has the in-house staff and expertise to manage them are important, the best way to protect an organization against phishing is to address the human factor and teach employees about cyber safety. Some points to remember:

• All employees must be trained on cyber security best practices, not just certain groups. Too often, enterprises will comprehensively train their IT staff and other upper-level staff members, only to have a receptionist or an intern get phished. White-collar workplaces need to take cyber safety as seriously as blue-collar environments take physical safety; anyone in the organization who touches a computer for any reason needs to know how to operate it safely, including part-time workers, temps, and interns.
• Cyber awareness training requires continuous education. The threat environment changes daily, and employees must be kept up-to-date on the latest dangers and how to avoid them.
• Penetration testing is an important part of training. By sending fake phishing emails to employees and seeing who clicks on them, enterprises will know where their weak spots are, and employees who fall victim to the fakes will learn from the experience.
• Companies must have a specific procedure for reporting suspicious emails. If an employee receives an email that looks suspicious, they should know exactly who they are to alert and how. Employees must feel comfortable reporting any activity that doesn’t look quite right so that security personnel can investigate further.

There is no such thing as an organization that is “too small” or “unimportant” to be hacked. Some small organizations think they cannot afford proactive cyber security, but can they afford to lose tens, even hundreds of thousands of dollars to a breach? Securing your enterprise systems is just as important as locking your building’s doors at night; you cannot afford not to protect your network. Until everyone realizes this, the hacks will continue, and the losses will keep mounting.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance with all applicable laws, frameworks, and standards.

[bpscheduler_booking_form]

Hacked Companies Are Facing Data Breach Lawsuits Filed by Financial Institutions

Data breaches aren’t cheap to clean up. Just ask Rosen Hotels, whose costs to clean up a 2016 breach could end up exceeding $2.4 million. Shockingly, that’s below the $4 million average cited by IBM. In addition to direct costs, such as fines, labor to actually perform the cleanup, and bills from attorneys and PR firms, organizations are increasingly facing additional exposure in the form of data breach lawsuits – and not just from their customers.

Banks and credit unions, who must eat the losses when payment card numbers are stolen, are starting to fight back and demand reimbursement in the wake of POS system breaches. Fast-food chains Arby’s and Wendy’s, along with retailer Eddie Bauer, are facing class-action data breach lawsuits filed on behalf of financial institutions. Meanwhile, the Home Depot recently settled a similar suit for $25 million; this is in addition to the millions of dollars it is expected to pay for plaintiffs’ attorneys fees and the millions more it has already spent on fines and other cleanup costs.

Financial institutions aren’t the only parties that may file data breach lawsuits. Rosen Hotels is being sued by its commercial liability insurance company, which is alleging that Rosen’s policy did not cover data breaches. Additionally, the employee tax data phishing scam that was all the rage in 2016 reemerged just in time for the 2017 tax season, so the next round of lawsuits may stem from organizations’ own employees.

Preventing Breaches Is Far Cheaper Than Cleaning Them Up

Arby’s, Wendy’s, Eddie Bauer, Rosen Hotels, and the Home Depot have something in common, and it’s not just that their POS systems were hacked. All of them are examples of the high cost of reactive cyber security, which focuses on cleaning up after breaches happen instead of preventing them in the first place. This is the crux of the data breach lawsuits the banks are filing; they are alleging that hackers shouldn’t have been able to access these companies’ POS systems in the first place. They’re right. Hackers would not have been able to get in had the affected companies invested in proactive cyber security and implemented sound governance, risk, and compliance procedures.

The problem is not exclusive to large national or multinational corporations; it is estimated that 86% of small and medium-sized businesses woefully underfund their cyber security measures, and three-quarters have, at most, two staff members devoted to security (some have none). Yet as badly as companies the size of the Home Depot are being hammered by data breach lawsuits and other cleanup costs, they can afford to take the hit and keep going. A small business with razor-thin profit margins, or a young startup that’s not yet in the black, could be bankrupted by a data breach, especially if lawsuits are involved.

Often, it’s not that small businesses don’t care about being secure; it’s that they think they couldn’t possibly afford it. The good news is that proactive cyber security does not have to cost a small fortune. RegTech software solutions such as Continuum GRC’s IT Audit Machine (ITAM IT audit software) automate GRC and security processes and put world-class security, compliance, and risk management within the reach of small and medium-sized businesses.

Don’t be reactive and wait for a breach to happen and potentially bankrupt your business; be proactive and prevent hackers from getting in to begin with.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance with all applicable laws, frameworks, and standards.

[bpscheduler_booking_form]