FAQ:

On the Hook for Hackers?

 

 

Once you are hacked, you have to worry about what data was lost, where it went to, and whether it’s being used maliciously.  That, along with towering legal fees, the embarrassment of having to inform all your clients and vendors about the hack, not to mention your damaged reputation, is enough to make your head spin.

Now an U.S. appeals court has confirmed that the U.S. Federal Trades Commission (FTC) can fine organizations that employ poor I.T. security practices.  

You can bet that other countries will follow suit and make organizations libel for their poor I.T. security.  

The ruling was part of a lawsuit between the FTC and hotel chain Wyndham, who was hacked 3 times in 2008 & 2009.  Wyndham lost credit card data for more than 620,000 customers, not to mention the $10.6 million they lost due to the fraud.  

FTC outlined specifics of Wyndham’s “poor I.T. security” including:  

• Wyndham allowed its partner hotels to store credit card information in plain text.
• Allowed easily guessable passwords in property management software
• Failed to use firewalls to limit access to the corporate network
• Failed to restrict third-party vendors from access to its network.

You’re probably shaking your head right now, wondering how a big organization like that could make such huge mistakes…

Unfortunately, these are very common I.T. security steps for organizations to skip unknowingly.

63% of credit card breaches involve the compromise of data that was not known to be stored.  

This means that despite your policies about the handling of credit card data, there is the very real possibility that you have unsecured cardholder information on your servers or desktops.  Odds are your staff put it there for what they perceive as valid business reasons.  Eg.  A department may keep a list of credit card numbers that are billed monthly in an excel spreadsheet instead of figuring out how to use the secure system that’s been installed to manage this.

The top 25 worst passwords represent almost 3% of all passwords in the world.  

This isn’t surprising when you consider that roughly 75% of surveyed people fail to follow best practice guidelines when creating complex passwords for new and existing accounts.  It is estimated that every person has approximately 19 passwords.  That’s a lot of easy passwords to hack…

A firewall is a business’s 1st line of defense.

While many internet services already provide firewall protection, most small business owners are unaware that the vast majority of standard firewalls only monitor incoming traffic by default, giving them a false sense of security and enabling CyberCriminals to view outgoing traffic that may contain credit card information, customer transactions, and other financial communications.

63% of the 2013 Trustwave Global Security Report were linked to a third-party component of I.T. system administration.

Granting access to an outsider lowers your security level.  If they have feeble controls, they become the weakest link in your security chain.  If a hacker compromises their system, he or she can use that as a backdoor into your network.

With so many businesses being hacked, and with CyberSecurity being more important than ever, now is not the time to skimp on your I.T. security budget.

The costs are simply too great.

But you can see how easy it is to miss important I.T. security steps.  

We understand that I.T. is not your forte, and you’re just too busy doing your own job to keep up with all the I.T. ‘stuff’.  That’s where we step in.  

We handle everything I.T., so you don’t have to.

 With any of our Monthly Service Plans, you can be sure your I.T. is handled.

We Make I.T. Work!

 

Ask About Our “Core Security Solution” Package!

 

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks

“I’m Just a Mid-Sized Company.  No Hacker is Going to Attack Me, I’m Not Big Enough”

Or

“No Hacker is Getting Through…I’m Too Smart to Fall for Their Tricks”

 

Those are just a couple of the excuses we hear often when we suggest extra security measures against hackers and CyberCriminals.

Let’s answer both of those excuses, one at a time.

 

Excuse #1:  

“I’m just a small- to mid-sized company.  No hacker is going to attack me, I’m not big enough.”

Many small- to mid-sized companies believe CyberSecurity is a problem only for large high-profile corporations, or those that conduct mainly financial transactions.  Or those executives are naive; they think a serious breach never will happen to their system.  When in fact, these things are happening all the time.  No one talks about it, because they’re embarrassed they were tricked & would rather keep it quiet.

In fact, small and mid-sized businesses may be more vulnerable to attack, because criminals know these businesses do not take substantial preventative measures.

Companies with 250 or fewer employees accounted for 31% of CyberAttacks last year.

Hackers have probably infiltrated many mid-sized businesses already, and the malware sits undetected in their network, incrementally collecting data that shows how to access other systems or stealing proprietary product information.

Part of the problem, is that a controller likely set up the I.T. department, and no data security specialist has been appointed.  Or, the “I.T.” person wears too many hats & can’t keep up with the latest malicious code and software patches.

Another part of the problem is that executives may believe that CyberCriminals can’t be stopped, so they are strictly reactive and focus on damage control instead of prevention.

Network entry points for hackers often are the same as for larger, and smaller, companies:  passwords that are easy to guess, lost laptops, vendor access, uninstalled security updates and patches, and employees accessing social networking sites (such as Facebook, Twitter, and LinkedIn) on company computers.

Hackers are resourceful, and if they want in, they will keep trying until they find a way.  Some of the most resourceful breach points:  videoconferencing, networked printers, thermostats (one leading retailer’s attacker gained access to the company through its heating and cooling system vendor).  Hackers even once invaded an oil company via an online menu at a nearby Chinese restaurant.

The potential ramifications of CyberHacks for small- to mid-sized companies are the same as larger ones – possibility of fines or lawsuits, expense of notifying victimized clients, expense of loss of clients’ confidence, loss of business.  However, the small- to mid-sized business will feel the damage more.

According to a 2014 study:

The average cost of a data breach was $5.9 million for all U.S. companies.

The most common causes were malicious or criminal attacks (44%), employee negligence (31%), and system malfunctions (25%).

Still feeling safe?

 

Excuse #2:  

“No Hacker is Getting Through…I’m Too Smart to Fall for Their Tricks”

The Pentagon thought they were too smart to get hacked too…until they got hacked.

The Pentagon has divulged that its computer networks were penetrated by suspected Russian hackers using spear-phishing tactics.  The hackers got into their unclassified email network used by the Joint Chiefs of Staff office with approximately 4,000 military and civilian employees.  Although the email system hacked was unclassified, emails can be extremely sensitive (especially at the most senior levels of the Pentagon), and offer details into planning, schedules, or personnel.  

Andre McGregor, a former cyber special agent at the FBI, who is now the Director of Security at Tanium, a CyberSecurity firm, states:

“If you are able to get all that information from three or four individuals’ emails or communication, you have an entire picture of what’s been worked on the classified side.”

The hackers came in through a spear-phishing attack, in which the attacker crafts an email designed to trick the receiver into opening an attachment that contains malware, or clicking on a link to a compromised website.  Once the attack was detected, the Pentagon shut down the computer network, to prevent additional data from leaking.  

The Pentagon, Anthem, Sony, Target, and Home Depot all thought they were too smart & too hackproof.

 

Think You Should Worry Now?

 

What You Can Do To Prevent CyberHacking?

1. Partner with a trusted I.T. firm, to gain relevant advice for your CyberSecurity infrastructure.  
2. Think twice about obtaining Cyber-Insurance – it often doesn’t cover much.  
3. Realize that CyberSecurity is a business issue, which should be considered part of your firm’s overall strategy.  
4. Monitor networks for unusually high traffic volume.  
5. Work with your financial institution to implement multi-factor authentication and dual controls for financial transactions.  
6. Strengthen administrative passwords.  
7. Educate employees about CyberSecurity and what to look for.
8. Do not rely on system users – clients or employees – for protection.

Ask About Our “Core Security Solution” Package!

 

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

 

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks