By Charles Johnson | CEO, EDTS | Guest Contributor
For many business owners, the rebounding economy has introduced a devilish new challenge in the form of increasing cybercrime. Sophisticated hackers have begun targeting vulnerable businesses, with the Internet Crime Complaint Center reporting that hacking crimes were up dramatically in 2013. Witness:
• Target admitted that 110 million customer payment cards were compromised in a data breach.
• A payment processor for Goodwill stores in 20 states had malware on its systems for more than a year, enabling cybercriminals to gain access to credit card data; investiga- tors believe the security lapse resulted in more than 800,000 stolen credit and debit cards.
• Just last week, Home Depot admitted that millions of personal information records of store shoppers may have been compromised.
The rate of malware, or ransomware, attacks on small businesses continues to climb at an alarming rate. Mostly from abroad, ransomware blocks your access to data unless you pay an extortion fee. It’s organized, automated, and stealthy – and can crush an unprepared organization.
Mobile malware is adapting and evolving faster than security tools can learn to detect and evade threats; expect this to become a new frontier for bad guys as our society leans more on mobile access and devices.
Connected devices make life easy – for you and for bad guys. If you can access your home security system or baby monitor camera from your smartphone, an attacker may be able to do so as well.
With many small and mid-sized businesses deploying unencrypted wireless networks, and most having no security plan, too many organizations lack essential protection for their networks and sensitive data. With many organizations having scarce resources and insufficient time to monitor cybersecurity, they are particularly vulnerable to Web-based crime. Is your organization among them?
Unfortunately, it’s not only cybercrime that organizations have to worry about.
Many employees are negligent in protecting confidential information and equipment, and cybercriminals happily target them, creating dangerous data breaches that can cripple a business.
Employee email is indispensable to business, but unprotected email can expose your most sensitive intellectual property, financial information and customer data. Results can include monetary loss, company disruption and legal action.
Sixty-six percent of employees in a recent national survey said they no longer worry about losing their laptops or tablets because data is encrypted, incorrectly believing encryption fully prevents theft of information.
One-third of respondents said they frequently leave laptops or tablets with strangers while traveling, or leave them unattended in insecure locations. Two-thirds never use a privacy shield, and over half admitted to turning off encryption capabilities or recording passwords on paper.
To protect your organization, consider retaining a reputable third-party IT partner to conduct an IT security audit – a rigorous, comprehensive review of security that provides specific, actionable insight to mitigate risk.
Such an audit identifies critical information and security issues, and helps you develop a layered protection plan to strategically defend against both internal and external threats. And with threats of many kinds – viruses, worms, Trojan horses, spam, spyware, theft and corporate espionage – all around you, don’t “hope for the best” – especially when your organization can be held accountable for data security through regulation and contractual obligation.
An effective IT audit should include:
• External vulnerability scanning
• Internal vulnerability scanning
• Network/infrastructure configuration review
• Wireless assessment
• Current password policy and controls review
• Outbound traffic analysis
• Written IT policy review
Once completed, you should receive a written summary of findings, full details of all reviews and assessments, schematics and scan reports detailing your network and vulnerabilities that need to be addressed, and specific recommendations for improvements and remediation.
Finally, all too often we see IT audits conducted either by an in-house IT manager or an existing IT provider. Each has a vested interest in not detailing shortcomings – how would that make them look? – or may lack the essential skills, tools and methodology to implement an effective audit. Consider a third party with appropriate credentials like the CISSP (Certified Information System Security Professional) or CEH (Certified Ethical Hacker) to conduct your IT audit.
In today’s brave new world of hackers, phishing and Eastern European ransomware threats that can literally put you out of business, chances are you’ll be glad you did.
[Photo at top via Flickr/Creative Commons and cropped from original.]
