So, when we think about the term ‘internet’ on the scale of business security and cybersecurity, we need to think of any system that is connected to any other system. A user’s phone or computer could be a system. Just like a company database, website or cloud server could be a system.

Intrusions without a website

What are some of your business systems that are not a ‘website’?

Email comes to mind. Your database(s) are another. Add in more advanced systems like DNS servers, cloud servers and internal business devices like printers, routers and scanners, and there are a LOT of points of intrusion.

And this is not considering your own website.

A website, truth be told, is simply a front end for back end data and information. In most cases, a website is not the final target of an attack on your business and customers.

The security of your business depends on hardening and securing all of these. These services, these devices and these servers, and the methods used by them to communicate with each other are imperative to your business.

Securing every part of communication

What parts of your business systems need secured when it comes to cybersecurity? ‘Everything’ might be too general, right?

But it is the answer – everything needs security.

Start with basic tasks: a user on your website, you sending and receiving emails and the devices that you use.

Does your website use strong passwords to log into the web server control panel? Do you use https/tls over standard http for transmitting data? Do you update and upgrade your CMS (WordPress, Joomla, etc)?

Does your email use encryption, standard? When you send, receive, reply and forward emails, do you use encrypted methods?

For devices, a large consideration must be made on our growth, as a culture, to the ‘internet of things’, or IoT. This mentality allows many to plug into a whole mess of systems, without apparent consequence. But without proper constraints on access, and use of simple logic, you can be hacked.

Take for instance public wifi…

What WiFi is, and why public WiFi is a no-no

WiFi is a facility that allows one more devices to connect to a central device, and communicate with one another. These devices can be smartphones or laptops, as well as computers, printers, smart appliances, televisions, game systems and more.

WiFi is designed and used for convenience. In my home, I can eliminate 100+ feet of cabling with my WiFi setup. That is a cost, and a headache, which can be magnified in business environments.

One thing to note – never, ever use public WiFi for the best security possible.

Public WiFi, even when using a strong VPN solution, still allows for an external actor to send and receive your signals.

If you do use public WiFi, here are some things to remember:

• Never place orders using your credit card on public WiFi
• Never log into confidential websites, servers or programs via public WiFi
• Never use a device that houses sensitive material
• Or, the best one, never use public WiFi!

Access controls: Stopping the Big Bad Wolf

We all remember the story of the Big Bad Wolf and Little Red Ridinghood, right? In case you don’t remember, Red was going to her grandmother’s house, skipping along just living life. At the same time, the Big Bad Wolf was eating the grandmother and then taking part in some fun cross-dressing.

His goal?

To eat Little Red just like he ate grandma.

A good lesson can be pulled from this children’s tale…

Never assume good or bad; always lock down access with access controls.

After all, hackers are the Big Bad Wolf. If you want to be grandma, then take a wait-and-see plan with your security. Or, you can be the woodsman!

Basic access controls

Let’s talk a little bit about some of the ways we can use access controls, starting with two words: blacklisting and whitelisting.

Blacklisting is a term used to designate a person or thing in a negative way, adding it to a list of ‘not allowed’ visitors. This is an effective method of preventing those bad players from entering your system.

However, it has a major drawback…

Blacklisting is a reaction, not a proactive action.

Think about that for a second. You cannot blacklist someone until after they have done something to show that they should be blacklisted.

If you need something more proactive, then use whitelisting. Whitelisting allows us to designate users, by IP or by login, that are allowed to enter the system.

In other words, while blacklisting allows everyone and then blocks the bad, whitelisting blocks everyone assuming they are bad and lets in only those allowed.

Our recommended method of access, or, YES TO ALL!

Do we recommend blacklisting or whitelisting?

The simple answer is ‘yes’ – technically, we recommend both. Bad actors might be masking themselves as ideal employees, or could become ideal employees or vendors that have become hacked.

The measure of placing whitelisting as standard, and using some type of blacklisting for malicious activity can save your business!

How hacking ‘really’ works

If you think hacking works exactly like this clip below, then you might need to rethink your security.

The fictional tale of “Acid Burn” and “Zero Cool” isn’t 100% accurate for what a hacker, as well as a hacking group, actually does. Things have changed, even in their fictional world.

Hacking starts with one of two different scenarios: a hacker stumbles across something they can exploit in a company or person, or they target a specific person, group of people or organization.

The first, looks to randomly find a known exploit. This exploit could be publicly known, or only known to the hacker – usually called a ‘zero day’. The exploit then exposes some or all access or data to the hacker.

In other words, they are looking at random for an exploit of technical know-how.

There is a spinoff to this that we will talk about later, and that is looking at random for an exploit of a person.

The second way, targeting a group, is usually what you will see with many masking, phishing, whaling, spear-phishing, whaling and bitcoin-for-malware attacks. This specifically uses flaws and exploits in people to create the ability of the scammer or hacker to enter a system.

Both types of hacking use exploits (whether it is in the software or the people) to gain access into a system.

Sometimes, the only thing to do is talk

Information is power. The more information that you and your employees have when it comes to cybersecurity, and security in general, the stronger your company is for your customers.

Now, no amount of knowledge, and even staff, can prevent every attack on your company. In fact, there is a small percentage of data breaches that involve existing employees.

But, having informed employees exist in a digital world, is much different than employees who are completely untrained.

Where should you begin?

Begin with a simple conversation on security, safety and protecting access and information. Ask questions that can test their knowledge, and expand on what they know for a longer conversation.

Do they know what a ‘strong’ password is?

Do they know the difference between encryption and plain-text?

Do they know what compliance issues and regulations that are needed to be followed?

These are only a few topics to discuss. Having a formal plan in place for these types of trainings and conversations will grow into more training and more information. Over time, your employees won’t just think about security as part of the business, they’ll begin to think about security first – which is the goal.

What are phishing, whaling and spearing?

Phishing is the act of using ‘bait’ to get a target to do something. Normally, this ‘something’ is the volunteering of information that might not seem completely sensitive, but is. The information can used to gather more information, falsify legitimate employees or infiltrate larger systems.

Whaling is the act of phishing, but on a very high position. CEOs, COOs, CIOs and Presidents and Vice Presidents are usually the targets of whaling attacks.

Spearing is the act of mixing phishing and whaling together, with some hacking. You are targeting a very specific person, attempting to infiltrate their data on the business platform, and usually personally as well.

So which will your business see?

Your business, based on its size, could see all three. The most common is phishing. Some phishing is considered ‘blind’, meaning the hacker or scammer uses a general set of attack to grab something, anything. Other phishing is more targeted, using a business listing or vendor list as bait.

Too many definitions for you?

Let’s use an example from one of our clients, to show you what a phishing attack looks like and how to prevent it. This was a targeted phishing attack, that used the HR department as bait, for many administrative assistants.

We changed the names, and some tidbits, but you’ll be able to follow along, just the same.

Andrew just didn’t know

Andrew was a very good administrative assistant. Not only was he good at what he was hired to do, but he really became part of the whole team. Andrew aided his boss, Rebecca, in projects and with ideas to move them along. Andrew was, quite literally, on the fast-track for a promotion.

One Thursday afternoon, after Rebecca had left the office for a 3 week holiday, Andrew received an ‘immediate’ email from HR. You know that kind of email…’take action now, $(*#*%!’.

The email laid out exactly what was needed…

Andrew,

This is Carl Larc from HR. We know Rebecca left for vacation already, but we need her verification because someone contacted us regarding her last tax filing and w2. Can you fill out the enclosed DOCx, and send this back to us immediately. To be frank, my job is now on the line and I need this back before tomorrow. I’m leaving the office in a few, so just email it back and I’ll fix everything before heads roll, if you know what I mean.

Thanks,
Carl

Now, if you are in the security field, a whole host of flashing red lights just started going off in front of you. Likely, you would call “Carl” or someone else in HR and ask about this. You probably wouldn’t open the file either.

However, Andrew didn’t.

He opened the attached file. He filled in the fields needed, including some personal details on the w2 from Rebecca, and then sent everything back.

Then he waited for an answer from Carl.

But Carl never wrote back. Carl was never in HR. We found out “Carl” was actually somewhere in Indonesia, and likely had never even been to the United States.

Unfortunately, it wasn’t filling in the basic details of info that really hurt Andrew and the company. When he downloaded and opened the attachment, he inadvertently installed malware onto the company’s system. And, because his computer was given some serious access to certain systems and client data, his actions cost nearly 7 figures to the company in damage.

And, one final note, Andrew lost his job.

What happened to Andrew was a targeted phishing attack. The attacker used a people-exploit to circumvent normal safety and security protocols.

We later learned that the person claiming to be from HR had used Rebecca’s social media pages (specifically her Facebook page), to know when her vacation would begin. We also found out that Rebecca’s offices were targeted in a simple way – the company’s LinkedIn page had extensively promoted her being named the employee of the month and detailed her work with the company.

Some attacks are not as targeted, but are as effective.

In one situation, the attackers had built a list of all of the employees working at a company. They then simply used an email corresponding to their name, in the company (i.e., john.doe@somecompany.com). The attacker scripted something to run through the list, automatically sending emails to phish for targets.

“But, all we have to do is check where the email came from, right!?”

That is true. But when you have an immediate, do or die email, verifying carl@trustedcompany.com and not a malicious email like carl@trustecompany.com doesn’t always happen.

*Tip: Whitelisting can help, especially when using email filters to ONLY receive email from the company’s domain name.

The most important takeaway from these two examples is clear – never trusted, always verify. This doesn’t have to lead to a disrespectful action against customers. One phone call is quick enough to know whether a contact via email, phone or text is real.

Whaling and spearing: hooking the big one

In another instance, one of spearing and whaling, we had a CEO targeted and successfully infiltrated. The attacker had learned about the CEO, and their favorite college team. If you are like most people, you follow and post about your alma mater on Facebook and Instagram. They then slowly built smaller phishing attacks to lower level employees about the CEO.

In a few months, they were able to directly contact the CEO with what appeared to be acceptable authority within the company from other employees.

And that was that…