It makes sense that Cybersecurity Awareness Month falls in October. One of the scariest things a business owner faces is the fear of falling victim to a cybercrime. So, what are the business implications of a cyber-attack? Loss of data/intellectual property, damage to reputation, loss of productivity, increased expenses, lawsuits, and more.
Here are some facts:
In just the last year, cybercrime has increased by 40%.
60 % of cyber-attacks are targeted at small – to medium-sized businesses.
But… only 30% of small- medium-sized business owners consider themselves “very concerned” about ransomware.
Hackers who once went after the Targets and Amazons of the world are now going after smaller businesses who likely don’t have the necessary tools or support needed to prevent & recover from cyber-attacks.
Unfortunately, it is no longer a question of if your company will fall victim to a cyber-attack, but when, so it is imperative that your business invests in quality cyber support.
Some of the things you can do internally:
Require regular password changes
Implement two-factor authentication
Make sure anti-virus software is up to date
Educate your employees on best practices
These are all great ways to add an extra barrier of protection to your network, but the best way to prevent a cyber-attack from occurring is to outsource your cybersecurity support to a managed services provider. Today, we have security threats coming at us from every direction. A good MSP can monitor your network 24/7, 365 days a year to prevent attacks before they happen. If a cyber-attack does still occur, they will have a team of experts in place to make sure you recover as quickly and painlessly as possible.
As Cybersecurity Awareness Month comes to an end, it is important to make sure cybersecurity remains a priority all year round. If you are curious about where your network stands in terms of security threats and/or other IT-related issues, reach out to me at email@example.com to schedule a free network assessment. Visit https://www.nowmicro.com/managedservices to learn how Now Micro can become your managed service provider.
October is Cyber Security month! When you exclaim that this month’s focus is security to most admin and IT stakeholders, you’re likely to receive a chuckle or an eye roll. They know the truth of the matter. Our mindfulness of security can’t be limited to a singular month.
It’s an ongoing process that literally never ends.
Who then is Cyber Security month for? I’ll give you a hint. They interface with your organization’s data, devices and services daily and often don’t regard security as their first or even third priority. You got it; Cyber Security month is all about making your users more aware of the threats your organization faces.
We often spend a lot more time discussing our plans to harden servers, implement new identity security policies or protect our users’ credentials with MFA. Don’t get me wrong, those things are essential in today’s world, but it’s hard not to notice a gap in those strategies. That gap is the users.
Most experts estimate that 70% – 90% of malicious breaches start with or include some form of social engineering. Our users are every organization’s largest attack surface and softest target. Bad actors know this and are increasingly aggressive and cunning in their attempts. Every user holds something a bad actor would like to get their hands on.
Take a user who doesn’t need access to any data or systems but needs email to communicate. If that user leaks credentials, it can still be a treasure trove for a bad actor in the form of a global address list harvest or intel derived from exfiltrated emails that allows them to refine and target spear-phishing attempts. When we read about a large breach in the news, we often picture a group coordinating an attack to launch all at once when it’s far more likely that attack started very small and happened over time.
So how do we go about hardening our users? It would be nice if we could just apply a patch or update their firmware, but a more tactful approach is needed. We believe that process is three-pronged.
Your organization culture around communicating anything IT-related is very important and often overlooked.
Simply making your users aware of the current threats and where to report them can go a long way to thwarting social engineering. Be consistent with your communications. Set up a shared mailbox so multiple crafting IT-related messages can appear as one unified voice. Apply templates to your emails, so the appearance is consistent. Be concise; not enough or too much information can be harmful. Stick to the who, what, why, and how of the threat. Don’t forget to include where a user should go to report social engineering attempts.
This can mean different things depending on the size of your organization. In smaller organizations, it may mean taking 10 minutes during a company meeting to show examples of social engineering attempts. In larger organizations, it may mean contracting a professional trainer to speak to individual business units or even training leaders in those units to talk about threats to their teams.
The benefits of a simulated penetration test against our networks are obvious, but we can also apply this approach to our users. An attack simulation targeting your users with social engineering or a fake malware payload will not only give your organization an idea of its vulnerabilities but is also one of the best ways to raise your users’ awareness. The approach of an attack simulation with training and communication as a fast follow can grab your users’ attention far better than any of these components on their own.
How do I simulate attacks?
Just like network penetration testing, there are plenty of tools to help you launch attack simulations and parse the data you receive.
Microsoft 365 Defender P2 – If you happen to have Defender P2 or an M365/O365 A5/M5/E5 plan, you have a very robust set of tools for simulating attacks.
Choose from a wide variety of templated attacks that help target specific business units, just like a seasoned spear-phisherman.
Simulate malware payloads and malicious links with a variety of different delivery methods.
Automatically assign pre-built training modules to users that click malicious links or input their credentials.
Robust after-action reporting to help you know where to invest in training.
Now Micro Security Awareness Training – If you don’t have Microsoft Licensing, you’re not out of luck, Now Micro has the tools to simulate attacks against your Microsoft or Google environments.
Phishing Security Tests
Automated Security Awareness Program
Security Hints & Tips
Automated Training Campaigns
Phish Alert Button (Ability to report & delete phishing emails)
Phishing Reply Tracking (Track if a user replies to a simulated phishing email & what information)
Monthly Email Exposure Check: Monthly reports show which email addresses are exposed on the Internet and are a target for phishing attacks