We’ve talked about some of the more common threats that all businesses need to be careful of, but how dangerous is the web and how much of a risk is the current landscape?
Today we’ll talk about a few of the most widespread threats that need your attention.
Windows 7 End of Life
When it first came out, Windows 7 was very popular and it still is. Now, when we say popular, that isn’t an exaggeration. According to some estimates, nearly 70% of all PCs are still running Windows 7! When support officially ends in just a few short months, that’s going to leave a lot of people open to attacks.
In case you weren’t aware, the single largest reason for upgrading is security related. So, when Microsoft stops updating security on these systems, it’s just a matter of time before your system becomes an easy target for hackers.
Marriott’s Data Breach
Don’t think hackers only target little old ladies on 15-year-old computers. It appears that Marriott Hotels, one of the largest chains in the world, is going to be fined the equivalent of $123 million for a breach that exposed the private information of over 332 million customers. Even though it can be argued that the hotel chain was the victim, they are the ones who are responsible for what happens on their servers.
What makes this even scarier is that while the company spends quite a bit on their security, they still didn’t detect the breach for nearly four years. This goes to show that the amount spent on a security system doesn’t mean anything unless it is well implemented and monitored.
LockerGoga
This year, one of the biggest trends in ransomware is the targeting of specific industries. Why is this so scary? Well, the most dangerous enemy is someone who knows how to hit you where it hurts most. In the case of LockerGoga, this particular software is designed to cripple manufacturing firms, specifically, by causing their automation systems to go offline. This disruption is key to the firm’s efficiency. As of this writing, LockerGoga has already affected industrial manufacturing facilities in two continents, nearly shutting down production completely. And it also seems that hackers are upping the ante, demanding ransoms in the hundreds of thousands of dollars.
Heartless Hackers
While not excusable, it’s still understandable why someone would want to hack business: money. But if you’re a medical or charitable organization, you should be fine, right? Not so fast! For reasons that are not always clear, this year has been especially difficult for data breaches in this sector. In Europe and Asia, tens of thousands of records have been compromised for organizations range from charities for abused children to HIV clinics. Here in the US, at least 145,000 individuals who were seeking treatment for addictions at various facilities had their information stolen from a single server in April. One would think that even hackers would have some sense of decency, but as the saying goes, “There’s no honor among thieves.”
Your Staff is your Biggest Risk
We all know that Hackers and other criminals are working hard, finding ways to break into your business. But their job gets more difficult if your employees are trained in the dangers of cybersecurity. Employees who open the wrong attachments on emails cause about 70% of all malware infections. Up to 50% of your sensitive data, along with your client’s data, can be breached through your employee’s smartphones, tablets, and laptops. And don’t get me started on poor password management.
Not Even Your Donuts Are Safe
Earlier this year, Dunkin Donuts experienced its second hack in six months. In this case, the information wasn’t that sensitive — mostly related to their DD Perks program — but it just goes to show that very little information can be considered untouchable. What is odd about this particular instance is that the information went right onto the Dark Web for the highest bidder to purchase. This may not seem like a problem until you read between the lines. This information contained usernames and passwords, which wouldn’t matter unless someone really wanted that free cup of coffee you earned. However, since many of us reuse the same username and passwords for various accounts, it could be just a matter of finding out what other services you use — or even which bank you do business with — before the thieves gain access to your most critical information.
Unfortunately, we don’t live in a safe world. It seems that at every corner someone is trying to breach computer systems to mine any tiny morsel of value. The most important lesson we can learn is to not let your guard down. As a business owner or someone who works within an organization, don’t feel that there’s something special about you or your system that would make you invulnerable or unattractive to a potential data pirate. As long as there is a single penny to be made, it seems that someone is willing and able to jump at it.
Invest in the best cybersecurity you can get. Don’t be the next company to have your data sold on the Dark Web.
We still see the same scene in horror movies: the main character runs into the house, slams the door, locks the deadbolt and sighs in relief — but somehow the killer still sneaks up and attacks them from behind!
If you own a small business you just might find yourself in a similar situation. Sometimes small business owners spend large amounts of time and resources physically protecting their operations just to let the most dangerous threats sneak in through the figurative back door.
Today we’re going to talk about the 8 biggest security threats to small business in 2019, in no particular order. While a few of them are new, some past risks are still very much in play.
Phishing
Not only is this the number one threat to cybersecurity, it’s also still on it’s way up. Phishing attempts were reported by 48% of small businesses in 2017 — up from 42% just one year prior. All indications point to this trend rising as it requires the least amount of resources and knowhow to attempt.
Microsoft Document Scams
There’s nothing safer than opening up a Word document, right? Think again! For the past few years, scammers have been getting creative with coding that allows them to gain access to your computer, which is why Microsoft has been having to work overtime to create new patches. However, since many companies delay updating their software, this remains a prime option for criminals.
Ransomware
Currently, over 1,100 different variations of ransomware are being tracked around the world. The FBI has stated that there has been a sharp uptick in these attacks recently and they advise that the practice will continue to grow rapidly the coming years. So far this year, not just businesses, but entire cities have paid ransoms to get their data back.
Cryptojacking
As cryptocurrencies such as Bitcoin have exploded on the scene, their demand and value have gone up as well. Although you can’t physically mint a Bitcoin as you could a dollar bill, they are “created” in a process known as mining. This is a resource-intensive practice that requires computing power that thieves often lack. The solution? Hijack other computer systems to do the computing for them, taking a toll on bandwidth and slowing down networks.
Internet of Things (IoT) Attacks
Technology is rapidly increasing, not just in computing devices, but in everything that’s become a computing device. With IoT technology, you can connect your servers to your security system, HVAC system — even the microwave in your break room! While this allows everything to be connected and consolidated in one place, it also creates vulnerabilities. Most of these devices have very weak security protocols in place: who would want access to the toaster in the office next door? But as they are often connected to the main network, it creates a backdoor that can — and has repeatedly been — exploited.
Mobile Devices
Many small businesses feel safe doing business on their mobile devices only to have them be one of their weakest points. While most of us have been lectured about using unsecured Wifi ad nauseam, the most recent threat to mobile computing is our reliance on the Cloud. In the past few years, companies such as Apple, Google, and Microsoft have made cloud backups a standard part of their services. Since so much information is stored in one location, it creates a prime target for criminals to attack and gain access to your information. While that may not be a problem if you’re just backing up family photos or text messages from your sister, any important documentation or other data for your business may have also found its way onto these mega servers without you even realizing it.
Undertrained Employees
What has been mentioned to this point is just a sample of the ever-evolving external cyber threats to your business. While an easy fix might be to hire someone who just graduated from a reputable university, the truth is, that may not be enough. A recent study showed that 40% of companies surveyed said that having employees with an applicable degree has shown not to be good enough to keep their systems safe. That same survey showed that less than 25% of applicants for cybersecurity positions were deemed qualified. If that’s how things look in your company, you may feel safe today, but might be in danger for what’s coming over the horizon. It is estimated that training someone to do the job well takes over six months!
Understaffed Security
In line with the last point, an estimated 69% of companies will have an understaffed cyber threat team, with a large portion of this being companies with absolutely no one in this role at all. What does this mean for a small business? Either people with no experience will have to fill this position, or there is nothing in place to protect valuable data from hackers.
The killer hiding in the back seat, sneaking in through the back door, or — even worse — he’s already in the house, are all clichés. Do you know what else is cliché? Letting your small business fall victim to cyber-attacks. While not all attacks might be avoidable, you’re much safer from attacks if you’re prepared. Updated security software and regular data back-ups are invaluable in this process. Awareness of the latest threats is also key. Just like in the movies; when a killer is loose, no one should feel safe.
Here’s an alarming statistic for Small Business owners: 65% of cyber-attacks are aimed at small to medium businesses.
If you’re a small business owner, you’re aware that your company might be vulnerable to attacks by hackers. Even if they haven’t found a way to break into your system yet, you can be sure someone is trying to find a way to steal your precious data. Hackers enjoy a challenge, to a point. If they can’t crack your system the first time, it’s more than likely that they’ll keep trying.
If they can’t get in they’ll eventually go away, but that doesn’t mean they won’t be back.
There is a good chance a hacker is watching your business right now. And a chance someone has already breached your security. According to one study, it takes an average of six months for businesses to realize that they have been, or are being, hacked. It then takes up to 55 days to confront and suppress the attack. By then it’s too late: the damage has been done.
But why do hackers target small businesses? Some of the reasons are obvious, and some may surprise you. Here is a list of 6 reasons why Small Businesses get hacked:
Not every hacker wants to be famous. Most don’t care about getting their conquests splashed all over the news. Many hackers attack small to medium businesses because those groups are less likely to report security breaches. The first reason for not reporting the breach is that the damage to their reputation can be much more expensive than the temporary loss of revenue, or the price of the ransom they’ll pay to retrieve their data. The second reason attacks go unreported is because law enforcement agencies are not cybersecurity experts.
Businesses go through cycles; some good, some bad, but hopefully at the end of the day those cycles will all lead to company growth. While planning budgets, new hires, and equipment purchases for growth, frequently the security updates and back-up (BDR) hardware needed to protect that growth will fall through the cracks. Your old security software probably won’t be good enough to take you safely into the future. Sure, it got you where you are, but don’t rely on it just because it’s been “good enough” up to now.
It’s no secret that occasionally, especially during growth phases, budgets get shifted around, and what was allocated for security last year may not be in the budget this year. An alarming 90% of small businesses admit to operating occasionally with no security system in place at all. No virus protection, no firewalls, no spam filters, and no back-up systems. The scary part is that the remaining 10% probably just didn’t want to admit it.
Here’s an alarming statistic for you: up to 95% of ALL cybersecurity breaches that hit small businesses are due to human error. You try to stay on top of cybersecurity training for your staff, but people come and go all the time and training is bound to get put on the back burner. Sometimes breaches happen because simple procedures aren’t followed correctly. Password hygiene is a basic skill everyone should know; things like how to create a password, and why you should never write down your password and leave it posted to your computer. Not opening attachments to emails is also important, since over 92% of all malware is delivered via email.
One study has shown that 53% of small businesses will pay the ransom to hackers upon contact with them. This is related to our first topic, “Under the Radar,” since the reasoning behind paying quickly should mean you’ll experience a shorter downtime. Paying the ransom is still no guarantee that you’ll get your data back. After all, these are criminals you’re dealing with. Plus, when you pay a hacker, you only encourage them to continue attacking businesses like yours.
Hackers are like sharks: they can smell blood in the water from miles away. Once the word gets out that you’ve been hacked, and that you’ve paid the ransom, you’ll have hackers lined up around the block. Like a lot of criminals, hackers are looking for the path of least resistance. Once they hear you’re an easy target you’d better prepare yourself for all kinds of cyber attacks.
It takes work to develop a comprehensive cybersecurity strategy, train your employees on what to look out for, and maintain regular data backups, but all these things and more are necessary in today’s cyber landscape. Almost every day there are news stories about companies getting hacked, corporations paying millions in ransom, and small businesses closing because of hacks. Companies like Apple, Amazon, Target, and Facebook can afford the best security available, yet they still get hacked. Make cybersecurity a priority for your business and you’ll increase your chances of staying off a hacker’s watchlist.
Dark Web: (noun)
Part of the World Wide Web that is only accessible by utilizing special software, allowing users and websites to remain anonymous or untraceable. It exists on an encrypted network that uses masked IP addresses to maintain anonymity for users and site owners. This way, people who use the Dark Web for illegal purposes can’t be traced.
As you can see by the above definitions, the Dark Web can be a shady place where illegal transactions take place. Things like drugs, guns, counterfeit money, and credit card numbers can all be found, bought, and sold.
Chances are that if your business has been hacked, some or all of the stolen information is for sale on the Dark Web. This is why small to medium business owners need to make sure their security software is regularly updated against new and stronger threats.
But is the Dark Web only used for bad things? The answer may surprise you. No. It is estimated that only about a third of the people who visit the Dark Web do so for illegal activities.
Before we go any further, I’d like to bring up a little more info on the Dark Web and some of its misconceptions. Did you know that the internet you use every day is actually just the Surface Web? Also called the Common Web, Visible Web, or the Indexed Web, it is just the portion of the web that the general public has access to. We assume that it is the majority of the internet because we’ve labeled it the World Wide Web, right? Well, the Surface Web is only about one-third of the entire internet. Everything we have access to is, in reality, just the tip of the iceberg.
Underneath the Surface Web is the Deep Web. Also called the Invisible Web or Hidden Web. It is a portion of the World Wide Web whose contents are not indexed by standard search engines. 99% of the information on the Deep Web cannot be found through search engines like Google or Bing.
The U.S. government uses both the Deep and Dark Webs to keep open channels to countries that are ruled by oppressive dictators, in case citizens of those countries want to send out news stories or ask for help. Media outlets, like the New York Times, host portals that allow people and whistle-blowers to send in news tips, anonymously.
That anonymity helps give people who are in bad situations or have no one in their lives to talk to, a means of expression and channels of help. There are groups for survivors of abuse that allow victims to name their abusers, and also to get support from other survivors. There are groups for people with every type of addiction, anything from food, drugs, to gambling. Some countries punish their citizens arbitrarily, for such reasons as sexuality or religion. The dark web offers opportunities for people to create communities where they can share stories and tips or plan to meet in person.
You can even join a chess club and play with people from all over the world. There are chat rooms, dating sites, and gaming forums where you can talk about anything, anytime, without the fear of being monitored. People can freely share their feelings, express their challenges and even find help from these groups.
Freedom of expression is alive and well in the crevices of the Dark Web. If you’re an artist you can share your passion with people who truly enjoy creativity and self-expression. Same thing for writers, poets, and musicians. There’s even a site where origami lovers post their beautifully folded ornate creations, and some of them are so intricate it’s hard to believe they started as a flat piece of paper.
You’re probably thinking, with all the negative and scary stuff on the Dark Web, I’ll never even try to access it. You want to stay safe and keep away from it, right? Well, sorry to tell you, but some of your daily excursions on the internet can only access part of the Deep Web, and even the Dark Web, because of the anonymity they provide.
For example, your company’s intranet is on the Deep Web so it cannot be seen by search engines. There are sites you may have joined that exist behind pay-walls or require special registration. Many databases and webmail pages are also tucked away below the Surface Net so your personal information is not exposed.
If you belong to a Facebook group, guess what? Yes, that group is on the Deep Web. Otherwise, anyone can search for that page, read the posts, and request to join. If you use online banking, that information is also on the Deep Web. Sites that host medical information and legal documents are hidden there as well. As you can see, there is a need for the Deep and Dark Webs because of the security they offer.
Freedom of expression, freedom of speech and freedom from censorship are things all of us enjoy, but, unfortunately, those things come with a price. If you choose to go to the dark side of the web, be careful. You just might find something beautiful, or you could accidentally stumble upon the worst aspects of human nature. Like everything else the world has to offer; when you’re exploring, be safe.
Here’s a quick test – what do these seemingly random alphanumerical groupings have in common?
That is a list of the Top Ten Passwords used in 2018. Recognize any of these? If you don’t, you’re not necessarily in the clear, but your chance of becoming compromised or hacked is far less than someone who uses one of these passwords. If you do recognize these, you’re certainly testing your luck.
These days, creating and remembering passwords has become increasingly more challenging. If we had only one device that required a password, we could probably manage it quite easily. But with every device we use, most programs we need to do our jobs, and sites that require you to change your password every few months, it is estimated that the average person must memorize up to 191 different passwords. No wonder we often choose to take shortcuts!
The problem is, over 80% of hacks are due to compromised credentials, otherwise known as stolen username and password information that are often traded on the dark web. In fact, in one month alone in 2018, Microsoft blocked 1.3 million attempts to steal password data, which would have led to dangerous phishing attacks, and other hacking attempts.
These harrowing statistics are why you hear the recommendations:
Pay attention to that last stat: 50% of all attacks involved the top 25 most used passwords. See what I meant when I said if you recognized anything on that list you’re testing your luck?
Following all these rules and regulations, you’ll end up with passwords that are about 16-characters long, impossible to memorize, and, unfortunately, are still completely hackable (much more difficult, of course, but where there is a will, there is a way). So, what do we do now?
Password Manager
The first shortcut is a password manager. You can store all your passwords in one place. This makes remembering all your passwords much easier, but there is one challenge. The password manager is also protected by a password. If you’re utilizing a software like this, make sure that this password is especially complex, so that hackers aren’t even tempted, especially in the case of a brute force attack. If possible, turn on multi-factor authentication, especially on your password manager.
Multi-factor authentication
Many sites utilize multi-factor authentication. This extra layer of protection connects to your phone, email, or other authentication source, rather than relying solely on a password. We recommend enabling multi-factor authentication wherever possible. Only caveat here is make sure your secondary authentication source is equally secured with a strong password. No sense in double protecting yourself with a wide-open source.
Random Password Generators
These sites come up with secure passwords for you, but are typically a random jumble of letters, number, and symbols that are darn near impossible to memorize. If you’ve got a strong memory, this might be a good starting point, but if you’re like most of us this may be more challenging than it’s worth.
How to craft the best password
Use a “Password Phrase” in place of random letters, numbers and symbols. Create something that’s easy for YOU to remember, but has no meaning to anyone else. For example I<3Fh@ck3rs43v3r!. Breaking this down, you get:
Easy for you to remember because you understand the phrase, but difficult for a hacker to decipher because it’s not real words. There’s no time like the present to get started and change your easy-to-hack passwords to something safer, because it’s always better to be safe than sorry.
Work at creating passwords that will be difficult to hack. Make sure to change them regularly. Never write them down, (especially on a Post-it Note stuck to your computer!). But most of all, make passwords an important part of your life. Don’t consider them a nuisance or a thorn in your side. Make a game out of creating passwords. Challenge yourself to be more creative each time you create one. Beat the hackers at their own game by making your password too time intensive to try and crack, and you’ll reduce your chance of your information showing up on the dark web. Worried about your information already being available due to past weak password use? Contact us. We’ll run a scan that reveals your vulnerabilities.
