Category Archives: Cyber Risk Management

Estate Planning for Your Digital Assets

Posted on March 3, 2016 by Marijana Dabic

Technology has become more pervasive, and it’s become increasingly difficult to avoid having at least some kind of valuable data that has to be managed. Whether it’s important photographs, documents hosted in the Cloud, online banking accounts, or Web-based assets like social media accounts or websites, virtually everyone has some digital assets to track.

That can be a daunting task in its own right, but what happens to those assets if something should happen to you? If you haven’t taken the time to plan for your digital assets, your loved ones could find themselves unable to access your accounts. And, if one of those accounts is compromised by a data breach, hackers could use your online accounts as a “back door” into your bank accounts or other assets.

Estate planning for your digital assets is a crucial part of your overall estate-planning strategy. While it’s always best to consult with a financial planner or legal counsel when considering estate planning, there are some general guidelines everyone should follow when making plans for their digital assets.

Create an Inventory

“Digital assets” can refer to a broad range of things, but in general, it refers to any part of your digital identity that would require your successors’ attention. The first step in planning is making sure that you have an exhaustive, centralized inventory of your assets so that your executor, attorney or trustee knows where to find everything.

Hardware

Begin by making an inventory of your hardware. It may seem obvious, but don’t take this step for granted. Many people use a number of different devices in their day-to-day lives, with important data stored in each of those devices. Remember to create an inventory and make a note of hardware that may be company-owned, and also remember that pieces of old hardware—computers, cellphones, cameras, etc.—may have important data on them.

Tailor your inventory to your needs, but consider some of the following:

Computers, laptops and tablets (including username and login information)
Cellphones
Digital cameras
CDs, DVDs, flash drives, SIM cards, external hard drives and other devices that store data

In addition to making a list of the names and locations of all of your hardware, it could be helpful to your successors to map out the file structures of your data. Write out step-by-step instructions so your successors know how to navigate the file system on your hardware in order to access your important information.

Online Assets

Next, consider your online presence in its various forms. Though it may be daunting, consider every site for which you’ve created a user profile and determine whether or not your successors will need to gain access. In doing so, be sure to log website names, URLs, usernames and passwords:

The list will vary, but be especially mindful of websites that store your personal information or banking information. Consider the following:

Online backing accounts
Shopping sites (e.g., Amazon, the Apple Store, eBay)
Social media accounts (e.g., Facebook, Twitter, LinkedIn)
Cloud-hosted email accounts (e.g. Gmail, Yahoo, Outlook)
Cloud Storage (e.g., Dropbox, Google Drive)
Organizational sites and apps (e.g., OmniFocus, Evernote, Pinterest)
Subscriptions (e.g., Netflix, Audible, Hulu Plus, HBO Go)

Work

Depending on your job, it might make sense to create a separate inventory for any work-related information that might be among your digital assets. This will vary widely from profession to profession, but as telecommuting becomes more commonplace, it’s an increasingly important consideration. In some cases, it’s a matter of keeping sensitive information secure. In other cases, it’s simply a matter of making sure your successors have access to the work you’ve been doing on projects that they might need to take over. Consider the following:

Client files
Spreadsheets
Online databases or software
Projects tasks, notes or drafts

Everyone’s digital assets are bound to be different, which is why making an exhaustive inventory is so important.

Provide Access to Your Assets

Once you have an inventory of your digital assets, it’s important to make sure you provide your successors with access. You’ll want to choose someone you can trust to handle sensitive personal and financial information, as well as the task of carrying out your wishes. It could be a trusted advisor, an attorney, or a family member or friend.

Whomever you choose, make sure you keep records naming that person and his or her responsibilities along with the rest of your estate planning information. Just because someone has your hardware or knows your passwords doesn’t mean that he or she is authorized to use them. Certain laws may prohibit others from accessing or using your digital assets, so having proper documentation is essential.

Write Out Instructions

Once you’ve created an inventory of your assets and assigned the appropriate executor or trustee, you’ll want to document your wishes. It may seem tedious, but it’s important to take the time to be detailed. After all, you wouldn’t want someone mistakenly selling or deleting important documents or photographs.

Planning for the Future

Estate planning may conjure unpleasant thoughts about death, but it’s important to plan now so that your wishes can be carried out and your loved ones and colleagues can continue on without undue stress.

It’s also important to make sure you have the people and the resources that you need in order to make sure your wishes are carried out as you’d like.

Young Employees and IT Security

Posted on February 10, 2016 by Marijana Dabic

Hiring young employees can bring fresh talent and innovation, giving your company an edge over your competitors. But that edge can quickly be erased, as young workers also bring additional technology risks. According to the 2011 Cisco Connected World Technology Report, a study involving almost 3,000 college students and young professionals under age 30, 70 per cent of young employees frequently ignore their company’s information technology (IT) policies.

Millennials have grown accustomed to sharing everything about their personal lives on Internet sites such as Facebook® and YouTube®. This poses a dilemma for an employer: If young employees don’t safeguard their own personal information, how can you entrust them with your company’s sensitive data? Companies with the need to be Internet-savvy must hire young talent, but are these employees worth the risk?

Eye-opening Statistics

The Cisco report says that 80 per cent of young employees either don’t know about their companies’ IT policies or they think they are outdated. Additionally, 25 per cent of those in the study had been a victim of identity theft before age 30.

Why are young employees negligent about IT security? The study found that some young employees’ attitudes and beliefs towards IT policies include the following:

They forget about the policies.
They think their bosses aren’t watching.
They believe the policies are inconvenient.
They think they don’t have time to remember the policies while they’re working.
They feel the need to access unauthorized programs to get their job done.
They believe security is the IT department’s responsibility, not their own.

Additional Risks to Consider

Young employees can compromise IT security by leaving their computers or other personal devices unattended, increasing the risk that that both the equipment and company data could be lost, stolen or misused. Sending work-related emails to personal email accounts and using computers and social networking sites for both work and personal reasons can also compromise IT security. Millennials are more apt to blur the line between using IT for both personal and work-related purposes, which can increase the risk of negligence.

Consider that not only young employees, but all employees can compromise IT security in the following ways:

USB flash drives. While these are convenient portable devices for storing information, they make it too easy to take sensitive information out of the office and can be misplaced easily because they are so small.
Wi-Fi networks. Whether it’s an employee’s personal Wi-Fi network at home or free Wi-Fi at the local coffee shop, it is important that employees use virtual private network (VPN) and take other security measures when they log in on networks outside of your company.
Laptop computers. Lightweight and handy for working remotely, laptops are also susceptible to viruses from improperly-secured Wi-Fi networks.
Smartphones. They provide information at your fingertips, but are also another portable way to take sensitive data out of the office.
Collaboration websites. Websites, such as a wiki or SharePoint® site, are great tools for employees working together on projects, but it’s critical that only authorized employees are logging in and accessing your company’s projects on these sites.
Social media tools. Sites such as Facebook and Twitter™ can benefit your business; however, negligent use, including sharing critical company information, can be a risk.
Other communication applications, such as peer-to-peer (P2P), Skype and instant messaging tools. These applications can be vectors for malware and a threat to information security.

Employers shouldn’t necessarily prohibit employees from using technology, as this list includes many tools they need to get the jobs done. It’s important to know the risks and educate young employees to use the technology properly.

Mitigating the Risks

Employers must find the balance between allowing young employees to use social networking websites and portable devices to do their jobs, while at the same time protecting company information. Employers should examine their exposures and consider what level of risk they are willing to accept. Other special considerations for managing young employees and mitigating the risk include:

Review your company’s IT policy. If it needs to be updated, ask recent graduates for advice on updating the policy to reflect current changes and trends in IT.
Make sure young employees (and all employees) are aware of your company’s IT policy and the consequences if the policy is not followed.
Create strong, trusting relationships between young employees and your IT department.
Create IT awareness materials so young employees are continually reminded of IT security risks and what they can to do prevent them.
Train new young employees on data protection and IT security risks, and provide refresher training for seasoned employees to ensure everyone is aware of the risks and the importance of safeguarding company information.

Cyber Crime’s Forgotten Victim—Your Company’s Reputation

Posted on January 15, 2016 by Marijana Dabic

Even though companies are finally starting to dedicate resources to prepare for cyber attacks, it’s possible that they may be overlooking a key exposure. While internal audits, hardware and software upgrades, and payouts to impacted customers can be costly, those costs can quickly be dwarfed by the damage a cyber attack can do to a company’s reputation.

The Dark Side of Social Media

Social media poses a huge threat to your company’s reputation. In the event of a data breach, traditional media coverage, blog posts and consumer reaction to the breach will dominate discussion of your company’s brand across social media platforms. Social media newsfeeds offer little to no distinction between legitimate news, biased reports, rumors and outright falsehoods, making the problem worse.

Additionally, social media is the perfect battleground for a competing interest to launch an attack on your brand. In fact, a white paper released by Hays suggests that the deliberate spread of false information about companies could be part of the next wave of cyber attacks launched by foreign governments.

Managing Your Reputation

In the wake of a cyber attack, it’s important to have a social media strategy in place and ready to roll out, as well as a team dedicated to monitoring social media in order to dispel any rumors and clarify any falsehoods. It’s also important to consider all avenues for mitigating your risk.

Are You Prepared for a Cyber Attack?

Posted on December 16, 2015 by Marijana Dabic

In its annual Global Information Security Survey, Ernst & Young found that more than one-third of organizations worldwide lack confidence in their ability to detect sophisticated cyber attacks.

The survey was designed to take a closer look at some of the most important cyber security issues facing businesses, and it found that the majority of cyber attacks come from criminal syndicates and “hacktivists.”

In addition, the survey identified two major vulnerabilities that all companies face: careless or unaware employees and outdated information security controls.

To help limit these vulnerabilities, Ernst & Young suggests that businesses clearly define their cyber risks and prioritize their cyber-security investments.

U.S. Officials Charge Three in Massive Cyber Fraud Case

Posted on December 10, 2015 by Marijana Dabic

In what’s being touted as the largest cyber fraud case ever uncovered, three suspects have been tied to an estimated eight-year hacking scheme that targeted 100 million customers of over a dozen U.S. companies.

It is believed that the hackers were involved in a variety of illegal activities, including manipulating publicly traded stocks, stealing email accounts, processing payments for pharmaceutical suppliers and running online casinos.

Initial reports suggest that the hackers were able to steal hundreds of millions of dollars from companies like JPMorgan Chase & Co., E*Trade Financial Corp. and more by using about 200 fake identity documents, among other tactics.

The case, which is being described as a new frontier for cyber fraud, illustrates that even global companies that spend large amounts of money on cyber security aren’t immune to attacks. The accused hackers face 23 counts of fraud and other illegal activities.

Category Archives: Cyber Risk Management

Estate Planning for Your Digital Assets

Young Employees and IT Security

Cyber Crime’s Forgotten Victim—Your Company’s Reputation

Are You Prepared for a Cyber Attack?

U.S. Officials Charge Three in Massive Cyber Fraud Case

FOLLOW OUR BLOG

ABEX - AFFILIATED BROKERS EXCHANGE IS ON FACEBOOK.

CONNECT WITH US ON LINKEDIN