Posts

Cyber Attack

3 More Reasons You Are an Easy Cybercrime Target

Cyber AttackLast week, we gave you three reasons why you, as a small or midsize business, are a viable and desirable target for cyber criminals.

If those reasons don’t give you enough reason to act, here are three (3) more reasons SMBs, and you, a target for cyber criminals…

SMB data is increasingly networked

  • All of your systems — databases, email, documents, marketing, point-of-sale, and more — are likely running on a single network.
  • Access to one of your systems can lead to access to others. Target’s POS system was hacked using a security flow in the HVAC monitoring system running on the same network.
  • Moving data and systems into secure cloud solutions, and segregating network traffic minimizes the cross-over risk.

SMBs are using consumer products for business data

  • Consumer grade services are often more affordable, but often lack the security and data protection features of the higher-priced, business versions.
  • Separate work and home and use solutions designed for business, and, make sure to configure the security and privacy setting accordingly.

SMBs are often lax when it comes to security

  • Many small businesses operate in an environment of trust; people know and trust one another. This trust can be exploited by a disgruntled employee or an outsider.
  • Keep user identity management and passwords private and secure; Manage administrator and “super user” passwords so that they are unique, complex, and secure.
  • Keep servers and systems with sensitive data/access secure; enforce screen locking and passwords.
  • Educate your staff on security risks and behaviors.

 

Taking cyber security seriously is the first and best step in protecting your business, employees, and customers. Protection need not be overly complex; nor must reasonable protection be a budget busting expense. Reasonable measures balance cost and security.


Interested in ensuring you are protected, contact us for a free Cloud Advisor Session, or learn about our data protection solutions and our privacy solutions.


 

 

 

Cyber Attack

3 Reasons You Are an Easy Cybercrime Target

Cyber AttackAs we’ve mentioned before, more small and midsize businesses (SMBs) are falling victim to cybercrime.  According to HP’s Cyber Security and Your Business report, Cybercrime costs SMBs 4.2 times more per employee than larger businesses, and 60% of SMBs that experience a data breach are out of business in six months.

Why are SMBs, and you, a target for cyber criminals?

SMBs spend less on security while larger businesses are increasing their security protections.

  • Your business is an easier target because you are more likely to lack basic protections. In effect, you may attract cyber criminals because you are an easier target.
  • Budget for, and implement, reasonable protections covering user identities, access controls, user permissions, data loss prevention, and employee awareness and training.

SMBs do not have in-house security expertise.

  • Keeping up with risks and trends is time consuming above and beyond ensuring that your security measures are updated and working on a day-to-day basis.
  • Leverage technology and your IT partners for automated solutions and expertise, as well as on-going management of your security and privacy solutions.

SMBS are moving into the cloud.

  • Using cloud applications and storage makes sense. But, your data is no longer behind a physical or logical “firewall”.  Protecting your data means protecting the cloud systems and services you use.
  • Always select business-grade services over consumer services. Implement all security features, including 2 Factor Authentication. And, when possible, integrate access to cloud services into a single system for managing user identities. And, do not forget to train, and periodically remind, your staff how their awareness and actions can allow or prevent an attack.

 

Start the new year off right with a review of your IT security and data privacy policies, procedures, and systems.  Doing so is an affordable way to protect your business, your employees, and your customers from cyber crime. The cost of prevention is miniscule compared to the cost of a breach.


Interested in ensuring you are protected, contact us for a free Cloud Advisor Session, or learn about our data protection solutions and our privacy solutions.


 

The Google Apps / Gmail Breach That Isn’t

Health Check News over the past few days that hackers have posted almost 5 million email addresses and passwords on an online forum has caught the media’s attention in large part because about 4.7 million of the addresses appear to be gmail accounts.

This is NOT, however, a breach of Gmail or Google Apps.  

The information appears to be from other sites and sources for which users provide their email address as their login.  In fact, several people that have found their address on the list report that the information is not their login information for Gmail or Google Apps.  As reported by Mashable, your risk is low.

Given it is not a Google Apps or Gmail breach, are you at risk?

Maybe!  Google has already analyzed the list and found some users that may be using their Google account password for other sites.  Google has notified these users and is forcing them to change their passwords. For the bigger picture:

If you use the same username/email address and password for all of your services, and one service is breached, then you are at risk of hackers gaining access to some or all of your services.

If a service is breached and you have granted the service access to your Google Apps environment, your data may be at risk.

Recommended Actions

Step One:  It is not easy, but avoid using the same password for multiple services, sites, or accounts.  And don’t write passwords down to remember them.

Step Two:  Be careful when and how you allow services to connect with one another.  For example, LinkedIn needs your gmail.com password if you are going to import contacts. While this may be safe to do, other services may not be as trustworthy.

Step Three:  Read and understand security permissions when you install apps on your mobile devices.  Many apps recognize and request access to other apps and services already on your phone.  Human nature is to say “grant” or “allow” without reading or fully understanding the implications, risks, or the trustworthiness of the app’s creators.


Note for Businesses, Governments, and Schools running Google Apps: Users installing 3rd party apps, particularly on cell phones, may be granting access to data stored in Google Apps.  To see if you have a risk, we offer a Google Apps Security Health Check that will document access rights and evaluate your level or risk, if any.  

Click Here for Information

 

5 Security Threats SMBs Should Not Overlook: Malicious Web Sites

Security Puzzle
As more services move into the cloud, users bring their own apps to their work environment, and we see more integration and interconnect between systems, the nature security risks and threats are changing.  

This blog series looks at some of these threats, why the should be of concern to SMBs, and how SMBs can mitigate the risks.


Many small and mid-size business owners look past security threats in the belief that their businesses do not have trade secrets or other information coveted by hackers.  This view is naive.  Small businesses are ripe for attack because they often have personal, credit, or medical information about their customers and their employees.

Your business may at risk even if you are not a deliberate target. Hackers and thieves cast wide nets to capture personal information for identity theft. For identity theft, your business IT is no different than home computers.

Many businesses respond that they have security in place.  A well managed firewall, a big name malware suite that updates periodically, and spam/virus protection for their email service.

Unfortunately, users are 20 times more likely to suffer a malware attack from a corrupted web site or a phishing attempt then through the “traditional” means of email and file transfers. While traditional malware tools may catch these types of attacks, web-based malware often behaves more like acceptable code.  The recent outbreak of “crypto locker” malware, which encrypts your data and holds it for ransom, is an example of just how ineffective traditional malware prevention alone can be.

The overlooked solution to closing the web-enabled malware threat is known and simple: web filtering.  Web filters not only track sites known to be risky, insecure, or containing malware, they analyze web traffic and behavior in real-time, identifying sites that may be compromised, including those hacked without the site owner’s knowledge.

For most SMBs, adding web filtering to the ecosystem is an affordable increase in IT spending, typically less than $3.00 per employee per month.   Given that a single malware event can take 20 to 60 hours to mitigate at a cost of thousands of dollars, web filtering is a value-add component for most IT ecosystems.


Cumulus Global can assist in selecting a web filtering solution for your business.  Please contact us, or complete the form below, for more information.

Guest Post: Two Customer Reactions to a Data Breach

Originally posted by Bob Siegel, CEO of The Privacy Ref, this article looks at how a company’s response to a data breach can do as much damage as the breach itself.

TD Bank has notified their customers of a data breach through the  loss of a backup tape. Initial reports have said that the tapes contain  the account information and Social Security numbers of more than 267,000 customers on the US East Coast. The tape was not encrypted so, while the bank is unaware of any misuse of the information, anyone who does obtain the tape could easily read the information it contains.

I was with some TD Bank customers the day the data breach was acknowledged. There were two comments made that I hear anytime a breach occurs so I wanted to share them to help you protect your brand image in the event of a data loss.

It took too long to notify customers of the data breach

The first comment the people I spoke with made was that six months was too long for the bank to notify customers that a data breach occurred. TD Bank has said that they were investigating the incident during this period. The customers I spoke with took the view that the bank either had the tape or they didn’t, so why did it take so long to be notified. The customers felt that the delay put their accounts at further risk as well as increasing their exposure to identity theft.

Notice of a data breach to your customers needs to be timely. The definition of timely rests on the perception of the customer. Any time beyond the customers’ perception of timely may be seen as the investigation not having been a priority or, as seen by the comments above, that you are putting the customers at additional risk.

The more complex a breach is perceived to be the more time customers will tolerate for notification. For example, an intrusion into your systems is perceived to take longer to investigate than something that has been misplaced.

More should have been done to protect against the data breach

Hindsight is 20/20 and we begin thinking “if only we had….”. Hopefully we wil learn from each others’ experiences and improve our own programs.

In this case more should have been done to protect the data. TD Bank has customers in Massachusetts.  MA 201 CMR 17.00 provides standards of protection for personal information for residents of this commonwealth. Under this statute, the encryption of personal data that resides on portable devices is required. Personal information under the Massachusetts law includes financial account information or social security number in conjunction with first name or initial and last name. Massachusetts includes tapes as portable storage devices.

In my conversations with the bank’s customers they began to question the overall security procedures used in the bank’s data processing. This may be a large leap in thinking, but one that someone unfamiliar with IT practices may make.

Privacy professionals today recognize that for any organization it is not if a data breach will occur, but when will it occur. How the public perceives your communications about, response to, and the circumstances of the breach will have an impact on your brand image. Preparing a response plan before a data breach occurs is something every organization should do to minimize any impacts, including  brand damage, that may occur.