(03/21/2023) – The cloud’s Shared Responsibility Model places most of the security and data protection burden on you. Our webcast explores 3 key questions and the shared responsibility model to help you plan, deploy, and manage effective, and cost-effective, security..
(02/21/2023) – A sound Hybrid IT strategy creates better collaboration, cost efficiencies, security, and resiliency. Review your hybrid business strategy and supporting IT services. Address your business, technology, security, and cost challenges.
(01/24/2022) – Cybersecurity requires policies, procedures, supporting technologies, and a culture of awareness. This webcast is a deep dive into our Security CPR® model for preventing and surviving cyber attacks.
Cyber Security Ransomware Email Phishing Encrypted Technology, Digital Information Protected Secured
On December 2, 2022, a ransomware attack on Rackspace disrupted email services for thousands of businesses. The attack encrypted files throughout Rackspace’s Hosted Exchange environment, one of the largest in the world. The outage impacts mostly small and midsize businesses (SMBs). While Hosted Exchange is only 1% of Rackspace revenue, the incident was large enough to warrant a filing with the Securities and Exchange Commission. We can all learn lessons from the Rackspace attack with respect to cybersecurity and response.
In their SEC filing, Rackspace noted that their “… information security team had strong incident response protocols in place that led to the quick containment of the ransomware attack.” They were able to limit the damage to the Hosted Exchange service, protecting other aspects of the company’s operations and other services.
For SMBs like ours, speed is also necessary. Quickly identifying an attack and isolating effected devices is critical. An infected laptop can spread the infection to servers and through files sync’d into cloud storage (ie, OneDrive, Google Drive, Dropbox). From there, every connected device is vulnerable.
Rackspace is NOT recovering customers’ Hosted Exchange service. The company is moving these customers to Microsoft 365.
Paying the ransom is not always possible. Paying a ransom does not guarantee that your get your data back.
As of December 12, 2022 — a full 10 days after the attack, Rackspace disclosed that about two thirds of its customers have been transitioned to Microsoft 365. Nearly one third of customers remain without email service. Rackspace is effectively abandoning its Hosted Exchange service.
The logistics of identifying recoverable data and understanding interdependencies is complex. Managing data restoration across multiple devices, systems, and data sets is challenging. Some data will be lost. Understanding which data, and how much data, has been lost is challenging.
Rackspace has hired staff and contracted with many Microsoft Fast Track service providers. Even so, call wait times are still averaging about 30 minutes. Rackspace is setting expectations, repeatedly telling customers that data recover will “necessarily take significant time”.
Starting with a clean system gets your systems up and running. How effectively can your run your business without your data? Data recovery takes time, even from backups. While emails may be relatively easy to live without, what is the impact if your accounting system is unavailable for days or weeks?
While Rackspace is a leading technology firm, they have hired outside firms to investigate the attack and remediate the incident.
Most IT firms servicing SMBs do not have the expertise or staff to respond to a cyber attack. Expertise and resources will be needed for investigations and forensics, data recovery, systems restoration, communications, regulatory reporting and compliance, and customer service.
Rackspace is actively promoting that it maintains sufficient cybersecurity insurance to cover the costs of the incident. Their SEC filing, however, does not indicate if or how they plan to compensate customer for their losses.
You will spend money … lots of money … beyond the cost of getting your data back, your systems restores, and your business back up and running. Regulatory filings, communication, legal services, and litigation can be a crushing burden that threatens. More than half of SMBs fail within six months of a significant cyber attack.
Looking at the lessons from the Rackspace Attack informs how we should think about protecting our businesses and ensuring we can return to normal operations quickly and efficiently. Here are resources for you to learn more.
Earlier this year, we blogged about how Streamlining Security for SMBs can protect you from the most common and the most expensive types of cyber attacks without breaking your budget. We held a webinar on the same subject.
Our Security CPR® managed security service model outlines the three critical aspects of cyber security communication/education, protection/prevention, and recovery/response. Our eBook, 15 Best Practices for Cyber Protection, dives into the model.
To discuss your security footprint, risks, and options, contact us by email, via our website, or by scheduling time directly with one of our Cloud Advisors.
In today’s digital landscape, the threat of ransomware looms large, posing a significant risk to businesses and organizations of all sizes. Ransomware, a malicious form of cyber attack, can swiftly encrypt critical data and hold it hostage until a ransom is paid. These attacks can disrupt operations, compromise sensitive information, and inflict financial losses. In the face of this evolving threat, having a robust ransomware response plan is imperative.
At Cumulus, we understand that responding to ransomware is complicated. With the continuing increase of successful cyber attacks against small businesses, we hear a lot of debate on two aspects of your ransomware response to a successful attack.
Both of these questions have pros and cons. How and when you answer these questions can have a long-lasting impact on you and your business. Read on to learn about top ransomware response plans, how to prevent a ransomware attack, and other vital information to keep you and your business safe.
The debate about if and when to contact law enforcement often centers around what happens after law enforcement gets involved. Typically, you would contact your local police department which, in turn, would contact the cyber crimes unit of your state police (if your state has one) and/or the FBI. You can also report a ransomware attack directly to the FBI or the Cybersecurity and Infrastructure Security Agency (CISA).
The biggest risks to involving law enforcement are the effects of a criminal investigation. You may not be able to repair and rebuild your systems until a forensic investigation is complete. In some cases, your computers may be considered evidence as part of a criminal investigation. By delaying your access to your computers, these actions can disrupt your ability to recover those systems.
The biggest advantages to involving law enforcement is the assistance the cyber security agencies can provide during the investigation and recovery. The FBI Cyber Division, CISA, and the National Cyber Investigative Joint Task Force can help identify the specific attack. For known variants, they often have valid decryption keys. If involved quickly enough, the FBI and other agencies have a history of recovering at least some ransoms and thefts (e.g. the Colonial Pipeline incident).
If you have cyber insurance, you may not have a choice about reporting the attack to law enforcement. Your carrier may require you to involve law enforcement as a condition for processing your claim. Your insurer may also mandate a forensic analysis to fully understand the scope of the attack and the necessary steps to recovery.
Responding to ransomware, you want to move quickly and correctly. Wiping and rebuilding systems, restoring your data from backups, and recreating missing or damaged data takes time and money. Decrypting the data can be faster and easier. Paying the ransom is tempting. Your insurance carrier may also pressure you to pay the ransom to lower the cost of the claim.
To the latter point, paying ransom to an organization or government on a sanctions list, including those tied to terrorist activities, violates US law (18 USC 2339A, 2339B, 2339C). In October of 2020, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) issued a warning that “Ransomware Payments with a Sanctions Nexus Threaten U.S. National Security Interests” and could result in civil and criminal actions.
When responding to ransomware, you will need to work with your cyber insurance carrier. Contacting law enforcement early is more likely to help your recovery than hinder it.
These benefits can mitigate the damage and help speed recovery.
Paying the ransom should always be a last resort. To avoid violating US law and facing the risk of criminal charges or civil sanctions, paying a ransom should not be done without consulting law enforcement.
For more information about cyber security and protecting your business, visit our Resource Center, or schedule an introductory call with one of our Cloud Advisors.
As owners and leaders of small and midsize businesses (SMBs), we have limited resources for IT and cybersecurity. We should not be surprised, therefore, that SMBs face the biggest threat from ransomware and other cyber attacks. Beyond the cost and risk of ransomware and encryption attacks, SMBs face business email compromise (BEC) attacks and threats to disclose regulated information. Recovery costs, fines, and legal actions resulting from a successful attack can destroy your business. And yet, many SMBs remain unaware of the risk and/or lacking reasonable data protections and security. This post intends to debunk five (5) cyber security myths for SMBs.
While note every attack is successful, one global report states that 86% of SMBs have been hit by ransomware attacks, with 20% attacked more than six times. With fewer resources and less focus on cyber security, SMBs represent an attractive target for attackers. The increase in remote work and use of remote desktop protocols creates additional opportunities for attackers. Securing and managing these services requires time and attention.
The impact of a successful ransomware attack continues to increase. According to Verizon’s 2020 Data Breach Investigations Report, the average cost of a successful ransomware attack grew from an average of $34,000 to just under $200,000.
Cyber attacks are inevitable. Protecting your business does not require expensive solutions. Your cost for endpoint protection for your devices, advanced threat protection for email, and security awareness training is pennies per day per person. You can deploy multi-factor authentication (MFA), local disk encryption, and the Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) protocols for free. You can deploy cloud-based business continuity and disaster recovery (BCDR) for less than traditional backup/recovery solutions.
Not all backup solutions are equal. Many backup/recovery solutions for SMBs run on the same servers and networks as your business systems. Ransomware and other cyber attacks will seek out and encrypt/damage backup servers to render your backups useless. Your backup/recovery solutions should be segregated from your production network and systems to shield them from attack. Business Continuity/DR solutions offer the additional ability to bring systems back on line in an alternate cloud data center while you recover your primary systems.
As with most security protocols, people are your first line of defense. As many as 93% of cyber attacks begin with a phishing attack. People click on links, unwittingly downloading malware or sharing usernames and passwords.
Security awareness training should be a standard practice within your business. The training is a proven way to reduce risk, decrease infections and help desk requests, reduce the chances of a security breach and strengthen the overall security posture.
Cyber Resilience is the ability to withstand security attacks and land on your feet, no matter what happens. Cyber resilience protects your business, customers, and employees from ransomware, business email compromise, and other potential issues and attacks.
While some gaps in security will always remain, you can affordably improve your cyber resiliency.
To overcome these 5 small business cyber security myths, review your security footprint, and improve your resilience, please contact us by email, via our website, or by scheduling time directly with one of our Cloud advisors, with any questions or concerns regarding this service update.
Cyber Security Will Change CompaniesIT change management is a structured process for evaluating proposed IT system or service changes. This procedure is carried out prior to implementing the requested change on an organization’s network, reducing or eliminating network outages.
At a recent security and risk management summit, Gartner shared their views of how cyber security will change companies. While Gartner’s predictions focus on larger enterprise, several of their observations will likely hold true for small and midsize businesses (SMBs) when it comes to change management in cyber security processes.
Here are some observations and our view of how they will impact small and midsize businesses.
Through 2023, government regulations requiring organizations to provide consumer privacy rights will cover 5 billion citizens and more than 70% of global GDP.
Privacy regulations will continue to expand as more nations pass legislation establishing privacy requirements. Within the US, we expect more states to follow California, New York, and Massachusetts with varying levels of regulations. Along with the regulations come the potential for fines and increase civil litigation, making it vital to pursue cyber security change management. In many of the statues, the protection is afforded the customer based on the customer’s location, not the location of the business.
For SMBs, establishing and maintaining a sound change management cyber security footprint is essential. Beyond the cloud infrastructure technology tools, businesses need to educate employees and have the policies and procedures in place. These policies and procedures should define expectations for employees and for how the business will respond to an incident.
By 2025, 80% of enterprises will adopt a strategy to unify web, cloud services and private application access from a single vendor’s SSE (Security service edge) platform.
Protecting access to systems is more challenging as the proliferation of usernames and passwords continue. As the human element can be the greatest security challenge, Identity and Access Management (IAM) solutions will become the norm.
For SMBs, Single Sign-On (SSO), centralized identity/password vaults, and other tools are available and are, generally affordable. Many SMBs current hesitate given the incremental cost per user per month. As the cost and risk of missing becomes greater, we expect SMBs will see value of Identity and Access Management solutions. These solutions will become the norm within a cyber security strategy, not an add-on.
By 2025, 60% of organizations will use cybersecurity risk as a primary determinant in conducting third-party transactions and business engagements.
With increased concern and scrutiny from customers, consumers, and regulators, businesses are under increasing pressure to monitor and protect against third-party cyber security risks. This trend will impact SMBs in two ways.
- Given the prevalent use of business email addresses as identities for third party applications and services, SMBs will monitor for reported breaches. Third party breaches give cyber criminals an attack vector.
- Larger enterprises will see businesses in their supply chains as potential security risks. They will increasing include cyber security requirement in vendor authorization process and in contracts.
SMBs need to be ready to meet the security and risk management demands — people, process, and technology — of their customers.
By 2025, 70% of CEOs will mandate a culture of organizational resilience to survive coinciding threats from cybercrime, severe weather events, civil unrest and political instabilities.
As businesses adapted to the COVID-19 pandemic, the inability of most businesses to respond to large scale disruptions exposed flaws in traditional business continuity planning. The pandemic put a spotlight on the need for business resiliency and continuity plans for businesses that had not yet considered continuity to be a priority. The level of planning to address the threats from cybercrime will need to be the same as the planning for other disasters and business disruptions.
For SMBs, leveraging cloud solutions will remain the most cost-effective business continuity option. Moving systems and applications into cloud services increases security, adds redundancy, provides geographic diversity, and provides better remote access than on-premise systems. SMBs are at greatest risk from local or regional issues. Managed cloud services … even if only a “lift and shift” of existing servers and applications … will be accepted as a cost-effective way to improve cyber security processes, security and resiliency.
We expect small and midsize businesses will need to expand and change their cyber security footprint and processes. They will need to improve resiliency. Appropriate solutions such as cyber insurance and breach response are available and are affordable. Businesses can meet their security, resiliency, continuity, and operational needs effectively and affordably. The inherit advantages of cloud services and solutions make this possible.
To evaluate your requirements and readiness for better security and resilience against cyber attacks and other business disruptions, contact us for a consultation, or book some time with a Cloud Advisor. The consultation is free and without obligation.
Slide Deck | Source: Cumulus Global —
Cyber Insurance is a tool, not a solution. This deck is from our June 2022 3T@3 Webcast: A Cyber Insurance Primer and discusses the what and why of cyber insurance and how it fits into your cyber security and incident response plans.
Streamlining IT Security for SMBsStreamlining IT security is a more balanced message about why and how to protect your business. Over the past year, we have covered the on-going, and increasing, threats to small businesses. We often highlight the scope and severity of the risk, including how security trends will affect small business. Hopefully this information, along with cost-effective solutions, prompts you to act. At times, we may appear to be fear-mongering.
Sound business practices, not fear, should be your motivation to protect against cyber attacks.
The market is awash with cyber security solutions. These range from single-protection products to complex advanced security monitoring and response services. The number of options, and competing claims, is overwhelming.
Focus protections on the most common, and most damaging, types of attacks.
We know that:
As such, small and midsize businesses should focus on preventing these types of attacks. Plan to limit your security approach and spending to prevention and recovery from these risks.
Make sure your team knows how to spot an attack and what to do if they suspect an attack. They should know the risks and steps you are taking to protect your business.
Periodically sharing articles or updates may be sufficient to strengthen your business. Subscribing to a security awareness training service is an affordable way to provide this education. Your cyber insurance policy may require this service.
To protect your business from the greatest risks, put the following solutions in place:
Specific to business email compromise attacks and ensuring your legitimate emails are not flagged as dangerous, ensure your domain configuration include the following protocols and services:
Even with protections in place, cyber attacks can be successful. Ensure that you can return to operations quickly, even as a full recovery may take time. Your ability to recover and respond should include:
Note that continuity services also protects you from the impact of hardware issues, theft, and other losses.
For a limited time, our Rapid Security Assessment is free of charge. Complete a 3 minute survey and receive a detailed report benchmarking your basic security services with respect to the most common cyber attacks against small and midsize enterprises.
To learn more, please join us on May 17th at 3:00 PM ET for Streamlining Security, our May 3T@3 Webcast or schedule a no-obligation call with one of our cloud advisors.
Speaking at a recent CRN-hosted security summit for midsize enterprises, Paul Furtado, Gartner’s Vice President of Midsize Enterprise Security stated, “The only thing harder than defending yourself against a cyberattack is telling your executives and your partners why you didn’t do enough to protect yourself.” His comments reflect current security trends from our historic “Trust but Verify” security model to one that is “Never Trust; Always Verify” — also known as Zero Trust.
Expectations are changing and our tolerance for breaches is dropping. More than 56% of successful attacks exploit known vulnerabilities with patches available for more than 90 days. Frankly, many of us are failing at the fundamentals of IT security and this needs to change.
While smaller in size, SMBs remain prime targets of cyber attacks. With “Ransomware as a Service” readily available, finding and attacking vulnerable small businesses is inexpensive and effective. SMBs are more likely to have fewer security protections; SMBs are less likely to be able to recover from an attack and more likely to pay ransoms.
Here are 7 security trends that warrant our attention and action:
As the name implies, Zero-Day Exploits take advantage of newly discovered security holes before our tools and systems can be updated to prevent an attack.
Next Gen solutions are needed to protect from attacks on devices, in the flow of email, and in web traffic.
Insider risk refers to every account that has access into an organization’s environment such as service accounts, custom integrations, and API accounts. Insider threats, meanwhile, are the small percentage of insiders actually doing something that will cause a security incident, intentionally or not. For example, the increased use of QR codes allows attackers to create malicious QR codes that install keyloggers and screen grabbers to steal identities and multi-factor authentication tokens.
We need Security Awareness Training to help individuals understand the risks and build safe habits.
As noted, security expectations are changing. State and federal laws are changing. Passed by the Senate this year, the Strengthening American Cybersecurity Act will require businesses to report significant cyber events within 72 hours and ransomware payments within 24 hours. These requirements lay on top of other federal regulations, multiple states’ privacy laws (CCPA, MA PII, etc.), and industry regulations (PCI-DSS, etc.).
With cyber insurance and cyber response services in place, small businesses are more likely to avoid fines, losses, and legal actions.
Internet of Things devices, and similar automation technologies are popular and often lack basic security features.
As IoT-based solutions move into smaller businesses, we need to secure and monitor devices and the networks on which they run.
Bad actors know that attacks on supply chains can be more effective than attacking an intended target.
If your smaller business is in the supply chain of a larger company, expect security to become an issue. They are likely to request — or demand – additional security measures as a condition of your business relationship. And, be ready to demonstrate (prove) that you actually do what you claim on the security checklist.
Data mining enables attackers to not only go after your business, but your vendors and customers as well. Imagine attackers telling your customers their private data will be released if you do not pay the ransom. Even more common, imagine your customers receiving emails “from” (impersonating) you instructing them to send money.
We need to start protecting unregulated data in the same ways we protect regulated data. Encryption, for example, does not prevent a breach but ensures the data cannot be used.
It would be nice to think we are past the ransomware pandemic, but we are not. Over 80% of ransomware attacks are on small and mid-size businesses. Because attacks have moved beyond encryption to data exfiltration, attackers are likely to understand your business and set ransoms that are steep, but payable (often 1% to 1.5% of annual revenue). Businesses hit by ransomware average more than 20 days of significant business disruption. On average, they permanently lose more than 35% of their data.
A response and recovery plan that includes business continuity ensures that you can keep your business running while you recover from and respond to an attack.
Please contact us to evaluate your security footprint and needs, and discuss possible next steps, or schedule a no-obligation introductory call with one of our Cloud Advisors.
