Category Archives: Cyber Liability

Spear Phishing: Targeted Cyber Crime

Posted on September 10, 2015 by Marijana Dabic

“Phishing,” a type of cyber attack in which a hacker disguises him- or herself as a trusted source online in order to acquire sensitive information, is a common scam that can put employees and businesses at risk. However, more resourceful criminals are resorting to a modified and more sophisticated technique called “spear phishing,” in which they use personal information to pose as colleagues or other sources specific to individuals or businesses. And, when attacks contain personal information, they are much more difficult to identify as malicious.

For businesses, the potential risk of spear phishing is monumental. The 2015 Internet Security Threat Report released by Symantec Corporation, a company that specializes in security software, states that, globally, 5 out of every 6 large employers were targeted in spear phishing attacks in 2014, and that there was an average of 73 spear phishing email attacks per day.

How to Protect Your Business

Though it is difficult to completely avoid the risk that spear phishing attacks pose, there are ways to prevent further damage to your business. For example:

Be cautious when you are asked to divulge personal information in an email. Even if it appears to be from a trusted source, it could be a hacker impersonating another person or group.
Only share personal information on secure websites or over the phone. When in a Web browser, you can ensure a website is secure when you see a lock icon in the URL bar, or when an “s” is present in the “https” of a URL. The “s” stands for “secure” at the end of the normal “http”.
Some spear phishing schemes use telephone numbers, so be sure to never share information over the phone unless you initiate the call to a trusted number.
Never click on links or open attachments from unknown sources. Even opening a file that seems familiar can give a spear phishing attacker access to personal information stored on your device.
Ensure that your company’s security software is up to date. Firewalls and anti-virus software can help protect against spear phishing attacks.
Encourage employees to think twice about what they post online. Spear phishing hackers often attain personal information through social media sites. Make sure that employees know how to keep this information private to protect their own security as well as that of your business.

Regularly check all online accounts and bank statements to ensure that no one has accessed them without authorization.

How Hackers Can Control Your Car

Posted on September 1, 2015 by Marijana Dabic

Fiat Chrysler Automobiles is recalling 1.4 million vehicles—not for a manufacturing flaw or a faulty part, but for a vulnerability to hacking. The company deemed the recall necessary after two software programmers demonstrated how easy it was to remotely tamper with a Jeep Cherokee’s radio, air conditioning, dashboard display, windshield wipers, brakes and transmission.

This hack is an example of what the security industry calls a zero-day exploit—a vulnerability in a piece of software that the vendor is unaware of. In the case of Fiat, hackers, through wireless access gained via the Internet, sent commands through the vehicle’s entertainment system, taking control of any number of vehicle functions. This could, in theory, be performed from a laptop across the country.

But this type of vulnerability isn’t limited to Fiat vehicles, as most auto companies produce models that are susceptible to breaches. Industry leaders like General Motors, Ford and Toyota are atop a long list of auto makers believed to be the most susceptible to hacking.

As vehicles become increasingly connected, the risk of hacking becomes more apparent and no longer limited to select models. By 2022, an estimated 82.5 million automobiles worldwide will be connected to the Internet.

Since the hack, Fiat has taken strides to prevent remote manipulation by distributing USB drives to vehicle owners that they may use to upgrade vehicle software and deter hackers—but that may not be enough. While automakers are aware of cyber risks and are even taking steps to prevent attacks, experts say that the auto industry is far behind when it comes to cyber security and that current solutions aren’t yet strong enough to thwart hackers.

Mobile Device Cyber Security

Posted on August 20, 2015 by Marijana Dabic

Because of their convenience, smartphones and tablet devices have become a universal presence in the modern business world. As usage soars, it becomes increasingly important to take steps to protect your company from mobile threats, both new and old.

The need for proper phone security is no different from the need for a well-protected computer network. According to the computer security software company McAfee, cyber attacks on mobile devices increased by almost 600 per cent from 2011 to 2012—and experts expect that number to continue to increase.

Gone are the days when the most sensitive information on an employee’s phone was contact names and phone numbers. Now a smartphone or tablet can be used to gain access to anything from emails to stored passwords to proprietary company data. Depending on how your organization uses such devices, unauthorized access to the information on a smartphone or tablet could be just as damaging as a data breach involving a traditional computer system.

Lost or Stolen Devices

Because of their size and the nature of their use, mobile devices are particularly susceptible to being lost or stolen. According to a 2012 study by the Ponemon Institute, nearly 40 per cent of organizations experienced a data breach as a result of a lost or stolen mobile device. Since most devices automatically store passwords in their memory to keep users logged in to email and other applications, gaining physical possession of the device is one of the easiest ways for unauthorized users to access private information.

To prevent someone from accessing information on a lost or stolen device, the phone or tablet should be locked with a password or PIN. The password should be time sensitive, automatically locking the phone out after a short period of inactivity. Most devices come with such security features built in. Depending on your mobile provider, there are also services that allow you to remotely erase or lock down a device if it is lost or stolen. Similarly, it is possible to program a mobile device to erase all of its stored data after a certain number of login failures.

Malicious Attacks

Mobile devices are just as susceptible to malware and viruses as computers, yet many businesses don’t consider instituting the same type of safeguards. Less than 20 per cent of mobile devices have anti-virus software installed, which is practically an invitation to thieves or hackers to pillage whatever information they want from an unprotected device. Furthermore, it doesn’t matter what operating system the devices have, whether it be Android, Apple’s iOS, Blackberry or Windows Mobile—all are vulnerable to attacks.

As reliance on these devices continues to grow, so will their attractiveness as potential targets. Third-party applications (apps) are especially threatening as a way for malware to install itself onto a device. These apps can purchase and install additional apps onto the phone without the user’s permission. Employees should never install unauthorized apps to their company devices. Apps should only be installed directly from trusted sources.

Hackers can use “ransomware” to restrict a user’s access to their device’s data, contacts, etc., and then demand a ransom to get it back. Even if the user pays the ransom, there is no guarantee that he or she will get the data back. Employees should know to never pay the ransom if this type of software finds its way onto a company device.

A big difference between mobile devices and laptops and other computers is the ability to accept open Wi-Fi and Bluetooth signals without the user knowing. Hackers can take advantage of this by luring devices to accept connections to a nearby malicious device. Once the device is connected, the hacker can steal information at will. To prevent this, make sure all mobile devices are set to reject open connections without user permission.

Preventive Measures

While the current mobile device security landscape may seem lacking, there are plenty of ways to be proactive about keeping company devices safe from threats.

Establish a Mobile Device Policy

Before issuing mobile phones or tablets to your employees, establish a device usage policy. Provide clear rules about what constitutes acceptable use as well as what actions will be taken if employees violate the policy. It is important that employees understand the security risks inherent to mobile device use and how they can mitigate those risks. Well informed, responsible users are your first line of defence against cyber attacks.

Establish a Bring Your Own Device (BYOD) Policy

If you allow employees to use their personal devices for company business, make sure you have a formal BYOD policy in place. Your BYOD security plan should also include the following:

Installing remote wiping software on any personal device used to store or access company data.
Educating and training employees on how to safeguard company data when they access it from their own devices.
Informing employees about the exact protocol they must follow if their device is lost or stolen.

Keep the devices updated with the most current software and anti-virus programs.

Software updates to mobile devices often include patches for various security holes, so it’s best practice to install the updates as soon as they’re available.

There are many options to choose from when it comes to anti-virus software for mobile devices, so it comes down to preference. Some are free to use, while others charge a monthly or annual fee and often come with better support. In addition to anti-virus support, many of these programs will monitor SMS, MMS and call logs for suspicious activity and use blacklists to prevent users from installing known malware to the device.

Back up device content regularly.

Just like your computer data should be backed up regularly, so should the data on your company’s mobile devices. If a device is lost or stolen, you’ll have peace of mind knowing your valuable data is safe.

Choose passwords carefully.

The average Internet user has about 25 accounts to maintain and an average of six-and-a-half different passwords to protect them, according to a recent Microsoft study. This lack of security awareness is what hackers count on to steal data. Use the following tips to ensure your mobile device passwords are easy to remember and hard to guess:

Require employees to change the device’s login password every 90 days.
Passwords should be at least eight characters long and include uppercase letters and special characters, such as asterisks, ampersands and pound signs.
Don’t use names of spouses, children or pets in the password. A hacker can spend just a couple minutes on a social media site to figure out this information.

Cyber Liability: Protect Your Email

Posted on July 24, 2015 by Marijana Dabic

Email is a critical part of everyday business, from internal management to direct customer support. The benefits associated with email as a primary business tool far outweigh the negatives. However, businesses must be mindful that a successful email platform starts with basic principles of email security to ensure the privacy and protection of customer and business information.

Set up a spam email filter.

It has been-well documented that spam, phishing attempts, and otherwise unsolicited and unwelcome email accounts for more than 60 per cent of all email that an individual or business receives. Email is the primary method for spreading viruses and malware. Consider using email-filtering services that your email service, hosting provider or other cloud providers offer. A local email filter application is also an important component of a solid anti-virus strategy. Ensure that automatic updates are enabled on your email application, email filter and anti-virus programs. Additionally, ensure that filters are reviewed regularly so that important email and/or domains are not blocked in error.

Protect sensitive information sent via email.

With its proliferation as a primary tool to communicate internally and externally, business email often includes sensitive information. Whether it is company information that could harm your business or regulated data such as personal health information (PHI) or personally identifiable information (PII), it is important to ensure that such information is only sent and accessed by those who are entitled to see it.

Email is not designed to be secure, so incidents of misaddressing or other common accidental forwarding can lead to data leakage. If your business handles this type of information, you should consider whether such information should be sent via email, or at least consider using email encryption. Encryption is the process of converting data into unreadable format to prevent disclosure to unauthorized personnel. Only individuals or organizations with access to the encryption key can read the information. Other cloud services offer secure Web-enabled drop boxes that allow secure data transfer for sensitive information, which is often a better approach to transmission between companies or customers.

Implement a sensible email retention policy.

It’s important to manage the email that resides on your company messaging systems and your users’ computers. You should document how you will handle email retention, and you should also implement basic controls to ensure information is retained for the necessary period. Many industries have specific rules that dictate how long emails can or should be retained, but the basic rule of thumb is only as long as it supports your business efforts. Many companies implement a 60- to 90-day retention standard if not compelled by law to use another retention period.

To ensure compliance, consider mandatory archiving at a chosen retention cycle end date and automatic, permanent email removal after another set point, such as 180 to 360 days in archives. In addition, discourage the use of personal folders on employee computers (most often configurable from the email system level), as this will make it more difficult to manage company standards.

Develop an email usage policy.

Policies are important for setting expectations for your employees or users, and for developing standards to ensure adherence to your published polices.

Your policies should be easy to read, understand, define and enforce. Key areas to address include what the company email system should and should not be used for, and what data is allowed to be transmitted. Other policy areas should address retention, privacy and acceptable use.

Depending on your business and jurisdiction, you may have a need for email monitoring. The rights of the business and the user should be documented in the policy. The policy should be part of your general end user awareness training and reviewed for updates on a yearly basis.

Train your employees in responsible email usage.

The last line of defence for all of your cyber risk efforts lies with the employees who use email and their responsible and appropriate use and management of the information under their control. Technology alone cannot make a business secure. Employees must be trained to identify risks associated with email use, how and when to use email appropriate to their work and when to seek professional assistance. Employee awareness training is available in many forms, including printed media, videos and online training.

Consider requiring security awareness training for all new employees and offering refresher courses every year. You can provide monthly newsletters, urgent bulletins when new viruses are detected and even posters in common areas to remind your employees of key security and privacy do’s and don’ts.

Is a BYOD Policy Right for Your Company?

Posted on July 10, 2015 by Marijana Dabic

More and more employees—especially the young and technologically savvy—are no longer satisfied with company-issued tools to get the job done. Known as Bring Your Own Device (BYOD), businesses are finding that employees want to swap company equipment in favor of personally owned devices, such as laptops, tablets or smartphones that they are more comfortable using.

BYOD can be a money-saver for companies, reducing the amount spent on hardware and software purchases, maintenance and the cost of training employees to use the equipment. Especially for rapidly expanding companies, allowing personally owned devices could save thousands of dollars in upfront IT hardware costs for new employees. With BYOD, employees buy and maintain their own equipment. Companies can choose to compensate them by subsidizing or reimbursing their purchases, or offering flexible work schedules and the ability to work remotely.

In addition to saving money, BYOD can be effective for recruiting and retaining staff. With the freedom to choose the technology they are more comfortable working with, employees are more productive and satisfied with their jobs.

While BYOD saves some companies money, others could end up spending a lot more. Businesses that require the standardization of their applications, hardware and operating systems—meaning that some equipment must be integrated with others—could actually increase IT management costs if personally owned devices were added to the mix.

Adopting BYOD can expose companies to two major risks: IT security risks and data loss. This alone may be enough to compel a company to ban BYOD altogether. If you are considering adopting a BYOD policy, you should ask yourself whether the benefits are worth the risks. If your answer is yes, then employ risk management to mitigate those risks.

Category Archives: Cyber Liability

Spear Phishing: Targeted Cyber Crime

How Hackers Can Control Your Car

Mobile Device Cyber Security

Cyber Liability: Protect Your Email

Is a BYOD Policy Right for Your Company?

FOLLOW OUR BLOG

ABEX - AFFILIATED BROKERS EXCHANGE IS ON FACEBOOK.

CONNECT WITH US ON LINKEDIN