Home Posts tagged Cyber-Criminals

Cyber Criminals Exploit Preventable Human Failures

By
Cybersecurity Special Coverage

Easy Targets

 

While the technology used to prevent cybercrime has certainly become more sophisticated over the years, Paul Savas has two simple words when it comes to the human side of cybersecurity.

“Be smart.”

Unfortunately, too many people simply choose not to.

“If it looks like something’s suspect, don’t open it. Don’t click on the links. So many times, these attacks happen to people who are letting their guard down,” said Savas, vice president of Comcast Business’ Western New England Region.

“How many of us get that Amazon text — ‘there’s a question about the order in your account.’ It’s a bogus text, and you should delete it right away,” he continued. “But so many people don’t. They’re curious. ‘There’s a link … I’ll click it.’ But you have to be smarter than that.”

Then there’s the problem of password laziness.

“They keep creating their own passwords. They’ll even keep a file on their desktop that says ‘passwords,’ kind of a spreadsheet. If I’m a hacker, I love that.”

“The biggest problem is common passwords,” said Sean Hogan, president of Hogan Technology in Easthampton. “So many people reuse passwords; they have a password that they’ve used forever, and they’ll do variations of that password. The problem is, once all the bots out there have that password or something close, they will figure out all your passwords within seconds.”

And he’s run into stubbornness when it comes to changing password habits.

“When I go out to see clients, it’s a constant struggle. One of our hardest adaptations is getting them to start going with password management or password vaulting. They keep creating their own passwords. They’ll even keep a file on their desktop that says ‘passwords,’ kind of a spreadsheet. If I’m a hacker, I love that.”

Allen Reed, assistant vice president and Information Security officer at Freedom Credit Union, has run into similar frustrations.

Allen Reed

Allen Reed says ‘trust, but verify first’ is a good rule of thumb for clicking email links.

“At the credit union, I’m always hammering employees: ‘don’t click that link, don’t open that attachment, don’t ever click until you have verified. Trust, but verify first.’ Yes, it’s inconvenient to make a phone call to someone: ‘did I receive an email from you?’ But that’s the world we live in.”

When he talks about cybersecurity with Freedom employees, Reed says he tries to “put a little fear in them” with examples of mistakes other businesses have made, and the financial consequences. “It gets them to think a little more clearly.”

But the topic isn’t just an occasional one at the credit union. “We institute cybersecurity-awareness training on day one of their employment. In fact, we’re audited from the federal financial sector every year to make sure every employee has had security-awareness training — at least annually, but most importantly, on day one.”

Even then, Reed regularly uses his metaphorical hammer.

“We all receive email all day, every day. And the staff has to be trained over and over,” he said. “It’s like when we were young children at the stove, and we were told, ‘don’t touch the stove.’ We had to be told a thousand times before it sunk in.”

And hopefully, the message took root before a serious burn. That’s what companies of all sizes and from all sectors are dealing with today: the possibility of being badly burned by a breach.

For this issue’s emphasis on cybersecurity, BusinessWest examines why even the best-equipped networks can be compromised because of simple human error — and what employers are doing to drive that message home.

 

Growing Threats

One problem, Reed said, is that cyberthreats have changed over the years.

“In 2005, you were worried about your average teenager sitting in the bedroom after school thinking about how hack into the CIA mainframe; they did it more for the joy of it, to be proud of it.

“Today, we’re talking about nation-states attacking. We’re talking about a government providing monetary resources, building out multi-story buildings, hiring their own citizens and providing them with pay, to attack other nations. That’s what we’re dealing with today. They attack 24/7/365.”

And their efforts have become savvier, Savas said.

“Don’t underestimate the bad actors, because they are so far ahead when it comes to social engineering and how to employ technology. They do research on social media, and they know things about you, like your dog’s name. That’s a pretty easy password to figure out. So don’t make it easy to guess.”

Sean Hogan

Sean Hogan

“You know the environment that the client has is pretty darn secure, but when you’re having people from the outside log in from their own equipment that is not secure, you’re really running the risk of a breach.”

Some companies have unknowingly voided their cybersecurity insurance policies because they lacked a certain level of protection — not just hardware and software, but training and compliance. “Every level of protection has a cost,” Savas added, “and some companies are gambling and not being fully protected.”

Indeed, Hogan said many advances in cybersecurity are being driven by insurance companies, which are not happy about paying out for preventable mistakes.

“They don’t want the exposure,” he went on. “And they’re going make it harder to pay off cybersecurity insurance — because that is paying out constantly. They are losing money on that; they’re realizing they sold a lot of policies where people are not doing what they should be doing. And the hackers have caught up.”

Reed noted that, going forward, most businesses will not be able to get cyber insurance coverage until they move to minimum 15-character passwords. “We moved to that four years ago because I knew it was coming.”

And not just longer passwords — or, preferably, pass phrases that are easy for the user to remember but impossible to guess — but two-factor authentication, like a code sent via text or email to the user’s phone. “You have to do that,” Hogan added. “When we install a new environment for a client, they have to do multi-factor no matter what.”

In addition, “there are paid software programs that manage passwords for you and give you different passwords you can copy and paste into the program you’re trying to log into,” Reed said.

For those who choose their own passwords, replacing letters with symbols in a recognizable word — $ for S, ! for I, etc. — makes the password exponentially safer, Savas said, adding that length is still a better safeguard than complexity.

Hogan encourages password vaulting in password generation. “I never generate my own passwords. The client shouldn’t either. So when I go to create that password, I’m going to generate a password that’s going to be random; it’s going to be extremely complex. It’s not the name of my dog. It’s not the name of my car. It’s got nothing to do with me. And it’s going to be a password just for that one website, for that one portal. And then it gets saved to a secure vault.”

 

Common Sense

While all these procedures are smart, Hogan went on, they only work as long as a company’s employees follow them.

“Can I ensure that everybody’s doing this? No. Can it be a procedure that you mandate? Yes, you can mandate it. But tracking it is a little different. So we add a couple more things on top of all this. Besides password management, vaulting, and multi-factor authentication, then we do the dark-web monitoring and security-awareness training.”

But a lot of cyber protection still comes down to common sense. That includes what people choose to share online, Reed said.

“If you have your entire dossier of who you are on Facebook, Twitter, Snapchat, whatever, once that dossier is out there, that’s what criminals leverage,” he told BusinessWest. “That’s what’s going to convince your grandmother that you need help, because it really sounds like you.”

Or, convince you that your CEO wants you to click a dangerous email link.

“The hackers look at people that can approve wire transfers, ACH batches, you name it,” Hogan said. “They’re looking at owners, they’re looking at CFOs, they’re looking at controllers. We call that ‘whaling’ or ‘spear phishing,’ where they actually target a certain individual. And they’re very sophisticated. They come up with real information.”

Reed agreed. “If they’re going to impersonate the president or the CEO, the only way they’re able to leverage that person, with that crafty email, is if they spend months on social media learning about that person, gathering information to formulate the email. That’s what gets employees to click — because we all want to do what the CEO wants us to do.”

Much of this behavior, from smart password creation to avoiding phishing attacks, comes down to training, Hogan noted. And sometimes, even that’s not enough.

“We can talk until we’re blue in the face, but that doesn’t mean that somebody working at that company is going to follow those procedures properly,” he said, recalling a recent incident when a remote worker for a client used his own laptop to log into the company portal from a remote site, got a suspicious pop-up, and clicked on it, allowing a cyber attacker to navigate the company’s system.

“That’s a big issue. You know the environment that the client has is pretty darn secure, but when you’re having people from the outside log in from their own equipment that is not secure, you’re really running the risk of a breach.”

And many times, Savas said, companies don’t even know they’ve been breached. “The bad actors go in, look around, see if there’s anything worthwhile, then map out a strategy. And that, to me, is scary.”

On the plus side, he believes the message is getting across, and companies are buttoning up with proper training.

“More education is happening within organizations. Attempts are being made, but it all comes down to that individual user being educated, heeding those warnings, and being smart about the things they can control,” Savas explained.

“Confidentiality of the password, not opening attachments, not clicking those links. Those are the three elements that open up an intrusion,” he added. “A lot of it is preventable. The majority is preventable.”

Increasingly, It’s Artificial Intelligence vs Cyber-Criminals

By Contributor
Technology

Protecting Yourself from IT Threats

By Charlie Christensen

 

As hackers, organized crime syndicates, and state-backed bad actors aggressively pursue ways to compromise the world’s data; business owners, leadership, and IT professionals continue to seek ways to counter these ever-growing threats to their information technology infrastructure. In this article, I will explore some of these threats, as well as the advancements in anti-virus/malware protection that are working to defend corporate and personal data every minute of every day.

Lastly, I will provide you with some key steps you should take to protect your business and data assets from attack.

Charlie Christensen

Charlie Christensen

“The notion that you are just too small a company to worry about these threats, or that no one wants your data is a fallacy. Criminals are targeting small companies every day because they are easy targets.”

As someone who understands the threats we as IT professionals see every day, it is my hope that I can use this opportunity to provide the average businessperson with a better understanding of what they should focus on most urgently in today’s technology environment, and how they can better protect their business from being compromised.

• Ransomware: This is every company’s worst nightmare and is a topic that we could dedicate an entire article on. In short, ransomware is an extortion scheme that costs businesses billions of dollars per year. It most commonly spreads via malicious email attachments or links, software apps, infected external storage devices, and compromised websites.

Ransomware searches out every computer on the network and seeks to encrypt the data it finds. The only way to get the data back is to pay the extortion, usually via cryptocurrency which is largely untraceable. Not content with simple extortion, cybercriminals are now adding an additional element to the ransomware scheme.

Attackers will now download your data prior to encryption, and if you refuse to pay, they will threaten to release your data into the public domain. If the thought of this doesn’t lead you to a few sleepless nights, it should.

• Phishing, spear phishing, and whaling attacks: I think by now we all understand phishing. An attacker uses social-engineering techniques, like an enticing looking link, to get the end user to disclose some form of personal information such as a Social Security number, information, credentials, etc. Spear phishing, however, is a bit more focused and targeted. A spear-phishing message might seem like it came from someone you know or a familiar company like your bank or credit card company, shipping company, or a frequented retailer.

Whaling, on the other hand, goes after high-value targets such as C-level leadership or accounts payable. A whaling attack might look like an email from the CFO asking you to initiate a transfer to pay a large invoice. This is an incredibly common attack vector and one that relies on your team’s ability to identify it. Education and vigilance are your best defense.

• Advanced persistent threats: APTs happen when an intruder gains access to your systems and remains undetected for an extended period. They seek to quietly extract data such as credit card data, social security numbers, banking information, and credentials. Detection relies on the ability to identify unusual activity such as unusual outbound traffic, increased database activity, network activity at odd times. APTs also likely involve the creation of backdoors into your network.

• Insider threats: Although we are fixated on external threats, internal threats are more common and can be equally as damaging. Examples of intentional and unintentional threats include:

Intentional threats such as employees stealing data by copying or sending sensitive or proprietary data outside the company. This may occur via email/FTP, USB drive, cloud drive (One Drive, Dropbox, iCloud), or some other means. Often, these happen because someone fails to comply with security protocols because they are perceived to be inconvenient or “overkill.”.

Unintentional threats might include an employee clicking on a phishing email, responding to a pop up asking for credentials, not using a strong password, or using the same password for everything. It could also be a system that was not patched, a port that was left open on a firewall, or forgetting to lock a user account after termination.

• Viruses and worms: Frequently considered to be ‘old school’ threats, these still exist and can cause tremendous damage. Users should be careful about clicking on ads, file sharing sites, links in emails, etc. Their purpose is to damage an organization, systems, data, or network. However, traditional anti-virus software is usually effective at controlling them.

• Botnets: Simply put, a botnet is a collection of devices that have access to the internet like PCs, servers, phones, cameras, time clocks, or other commonly found networked devices. These devices are then infected by malware that allows criminals to use them to launch attacks on other networks, generate spam, or create other malicious traffic.

• Drive-by attacks: These are infected graphics or code on a website that gets injected into your computer without your knowledge. They can be used to steal personal information, or inject trojans, exploit kits, and other forms of malware.

While this list might seem exhausting, it only represents a few of the more common attack methods that we see daily. It also helps explain the emergence of a new generation of security products and platforms. To better understand how we look at information security, let me borrow one of the examples I commonly use when speaking to businesspeople and groups about building an effective Information Security Program.

Think of information security as an onion. Like an onion, information security programs are comprised of layers (firewall, backup, AV, email filtering, etc…) of protection surrounding the core (your data). As we build an information security program, we need to put layers of protection between the threat and the asset we are trying to protect. While the details of an information security program are outside the scope of this article, for the purposes of this discussion you only need to understand that there is no single magic product that can protect you from all threats. Anti-virus, or even the new generation endpoint detection and response (EDR) products are but one layer of protection in an over-arching strategy to protect your business from modern threats.

A brief history of antivirus (AV) products has them coming onto the scene in the late 1980s, with familiar names like McAfee, Norton, and Avast. These early products relied on signature-based definitions. Much like you look up a word in the dictionary, these AV products could catch defined threats, but they would easily fail to prevent attacks that had yet been discovered; or worse, that they had not yet downloaded an update for that would allow them to recognize the threat. Traditional AV changed very little until several years ago with the advent of Next Generation Antivirus. NGAV uses definitions coupled with predictive analytics driven by machine learning to help identify undefined threats.

The latest technology to hit the market is enhanced detection and response (EDR) or extended detection and response (XDR). These technologies continue to use traditional signature-based antivirus and NGAV, but they also introduce the use of artificial intelligence (AI).

AI is used to constantly analyze the behavior of devices so it can detect abnormal activities like high CPU usage, unusual disk activity, or perhaps an abnormal amount of outbound traffic. This new generation of software not only detects an attack and warns you that it is occurring, but it can also isolate the attack to the device(s) that are infected by automatically taking them off the network and protecting the rest of your network. Some EDR products like SentinelOne also have threat-hunting capabilities that can map the attack as it unfolds. This mapping aids IT professionals in the identification of devices involved in the attack; a process that can take days or weeks when performed manually. XDR even goes a bit further in that it looks beyond the endpoint (PC, laptop, phone) and looks at the network holistically.

A good example of how EDR systems are being used as a layer of protection is how SonicWall firewalls combine a physical firewall with a suite of security capabilities like content filtering, DPI-SSL scanning, geo-blocking, gateway antivirus, and more to filter traffic before it enters your network. Then, with the addition of their Capture Client product (a collaboration between SonicWall and SentinelOne), they integrate the power of SentinelOne EDR with the firewall’s rules. This allows you to extend protections beyond devices inside the network and include company devices outside the network as well. This helps to eliminate gaps in protection that can exist with remote users.

The notion that you are just too small a company to worry about these threats, or that no one wants your data is a fallacy. Criminals are targeting small companies every day because they are easy targets. Large companies have armies of highly educated and well-paid people protecting their networks. And while a large company might represent a big score, hackers can spend years trying to penetrate a large network. However, they know smaller organizations have limited budgets and staff to protect their network. This makes it far more lucrative to hit 50 or 100 small companies for $100,000 than a single large company for, say, $2 million.

Investing in modern security products, building a sound information security program, and educating your team will pay off in the long run, as the question is not if you will be attacked — but when. The cost of the systems to protect you is far less the frequently irreparable harm caused by a breach or infection.

Many people say, ‘I have cyber insurance,’ but fail to put the necessary precautions in place to protect their systems and data. Little do they know that when they filled out the pre-insurance questionnaire and answered ‘yes’ to all the questions, they gave the insurer the ability to deny the claim. If you do not have written policies, use EDR (or at least NGAV), have a training program in place, and use multifactor authentication to protect user logins, you could be sealing your own fate. Insurers are no longer baffled by today’s technology and are aggressively investigating cyber claims. In fact, we are seeing significantly increasing numbers of denied claims.

There is little you can do after the fact to offset missing protections or enforcement of policies. By taking the appropriate steps to protect your network and systems you can hopefully minimize the risk of falling victim to an attack and ensure that your insurer will cover such a claim. Insurance companies will go to great lengths to cover legitimate claims at great cost. In fact, they can be their own worst enemy. In many ransomware attacks, insurance companies will simply pay the ransom because it is more expeditious to do that than it is to pay for the actual remediation. This, of course, only encourages the criminals while leading to higher premiums and greater risk to our technology infrastructure.

To close, I’d like to leave you with a few things that you can do to better protect your systems, data, and network.

• Take the time to understand what protections you have in place and engage a professional to help you identify any gaps in your information security strategy;

• Educate your staff on information security best practices and the threat spectrum. An educated workforce is one of your best protections. There are several great training tools that are inexpensive and easy to implement, such as KnowBe4;

• Implement a next-generation firewall that utilizes deep packet inspection and take the time to dial in the suite of security features that are designed to stop threats before they get into the network;

• Move to an EDR system rather than relying on a traditional signature-based antivirus;

• Be sure that all systems with access to your networks (computers, network equipment, servers, firewalls, IoT devices, cameras, etc.) are patched regularly to eliminate vulnerabilities that can be easily exploited;

• Do not run unsupported operating systems, equipment, or applications;

• Establish a set of written information security policies, and make sure everyone understands that they need to live by them; and

• Limit those with administrative credentials on your network. If an administrative account is compromised, you have given away the keys to the kingdom. Make sure users only have permission to get to the resources they need to do their job.

 

Charlie Christensen is president of East Longmeadow-based CMD Technology Group; http://www.new.cmdweb.com/; (413) 525-0023.

News

Contact

Advertise

Events