CommuniCloud has partnered with industry leading vendors, to create a Cyber Security Ecosystem of both technology and professional services. Technology alone will not solve every Cyber Security challenge.
CommuniCloud’s Professional Services empower an organisation to address the challenge of a Cyber Security threat. From the initial stages of protection through to advanced processes and policies, we are enabling users to work safely and at maximum efficiency.
In this article I’m going to discuss what I feel are the important areas in Cyber Security for small and medium-sized businesses in the coming months. A glossary of terms is included at the end.
Why does Cyber Security matter to me?
First of all, why does Cyber Security matter? In a business setting, where many activities are carried out online, it is really about the continued ability to trade. Imagine if you couldn’t access your bank account, accounting software, email, social media accounts, and website and e-commerce store? Or even worse, if someone else was actively using them? There is a real risk of losing money both through the direct actions of a hacker, such as the recent well-publicised incidents where false invoices are paid to incorrect bank accounts, or through the amount of time it takes to resolve issues, which is time you are not working on your business and may not be able to trade. In addition, if a hacker is impersonating you they can cause significant damage to your reputation and that of your business very quickly.
56 per cent of Australian businesses that reported a security attack have experienced Business Email Compromise (BEC) on a weekly, monthly or quarterly basis (ACSC Annual Cyber Threat Report, July 2019 to June 2020). This can result in significant hardship with the average loss being $30,000 (ACCC, 2018). You may feel that as a small business or an individual that you are not important enough to be targeted, but many of these attacks are automated, and they are just looking for an opportunity (much like a coronavirus!)
How do I know if I have been hacked?
I am often asked “How would I know if I’ve been hacked?” Unfortunately, the answer is that often you do not, at least not immediately. Many hacks are designed to sit undetected in your system and spend time observing and gathering information. The average time between a hack and discovery is 185 days (Ponemon Institute, 2018). There may be some indicators, so be aware if your computer seems to be running slowly, if you suddenly run out of disk space, or if unexpected pop-ups or banners appear. Another indicator is if friends, family, or colleagues report receiving spam from your email, messaging, or social media accounts. Advanced forensic tools are available to determine the source and extent of a cyberattack, but these are most applicable in commercial settings.
There are plenty of things that you can do to protect yourself, and you are likely to be doing at least some of these already. They do not have to cost money, but it is worth spending some time to make sure you have these in place.
Phishing
The main route where individuals are hacked is through a process called phishing. This can happen through phone, email, or messaging platforms and involves a process where you are tricked into giving up information or clicking on something that allows hackers to access your systems. Awareness and education are key in avoiding this, both for yourself but also your family and your employees. Some of the tactics used are phone calls from people saying they are calling from your bank or the ATO, or from companies like Amazon or Microsoft. They can sound extremely plausible so a high index of suspicion is vital. If it is a call (or message or email) you are not expecting, that is unsolicited, is trying to get you to take urgent action, or seems unusual in any way, then the safest course of action is to obtain contact details and hang up. You can then check the phone number or email address from an independent source and call them back on a number you know is genuine (eg. from contact details that you already have for your bank).
Updates
Install all the essential updates on your computers and mobile devices, including system updates for your phone and apps. Updates are important because they include protection against newly discovered threats. It is certainly irritating when those messages appear saying your computer is about to shut down for an update, and this seems to happen increasingly frequently and usually at an inconvenient time, but it is vital to install all updates as soon as practicable. In some instances, an update does not install correctly on the first attempt. In this case it is likely that another update needs to be installed first so when the cycle has finished just try again.
At my company, CommuniCloud, we often perform penetration tests for clients and one of the most common vulnerabilities we see is with unpatched systems. As a company grows and more devices are added to the network it can be difficult to maintain an up to date inventory and ensure that all these are maintained with a regular schedule for patching.
Antivirus Software
You probably already have antivirus and antimalware software installed, such as Windows Defender, Norton, or McAfee, amongst many others, but if this is not up to date you may as well not have it. Antivirus is also available for mobile devices and is recommended. Our mobile devices are now vital links to many parts of our lives and business; and vulnerable to a variety of threat vectors.
I am often asked if Apple devices and computers need as much protection as Windows and the answer is yes! Although the system is often regarded as more secure, it is a big target for hackers and there are plenty of resources being devoted to gaining access.
DNS Protection
This is less well known about than antivirus software but is becoming more popular. DNS is essentially a directory of the internet, so a DNS address tells your computer where to go. The good thing is that even you install DNS protection after the fact, it can detect breaches that are already present. This can help if you have got a virus or other malware on your computer, because these need to communicate with their source, and DNS protection means that your computer is prevented from visiting bad destinations. Cloudflare and OpenDNS have free options, and solutions are also available for larger enterprises such as Cisco Umbrella.
Internet of Things (IoT)
You may well have come across the term IoT which refers to devices that generally have little computational power but are connected to the internet. This could include things in your home, such as “intelligent” kitchen appliances, but may also apply to monitoring equipment in your grove. Vulnerabilities can arise because the data they are sending is often in the form of free text. This means it is not encrypted and is therefore open to interception and alteration. For example, you may be using a moisture monitoring system in your olive grove to guide your irrigation. It seems unlikely, but imagine a competitor or other hacker was able to change the data that you received and therefore you altered your irrigation on the basis of false information. When you are researching or using IoT devices it is important to ask the vendor questions about security.
In addition, if the devices are connected to your own network, hackers can use them to gain access before moving to more valuable areas. For example, in 2017 a group of hackers was able to steal databases from a Las Vegas casino via a smart thermometer in a fish tank installed in the lobby!
Top Tips for Good Cyber Hygiene
- Use a password manager such as LastPass or Dashlane. This can store all your passwords which are accessed using a single master password, and also generate secure passwords for you.
- Use multifactor authentication wherever possible. Google Authenticator and Authy are both apps that generate random codes for specific applications, or you can have a code sent to your mobile.
- Check your computer and mobile devices are up to date and are set to scan for updates (patches) and install them automatically.
- Check your antivirus software is up to date and is set to scan and update automatically.
- Avoid using free wifi, or if you must, use a VPN (such as VyprVPN). Organisations providing free wifi have no obligation to ensure that it is secure, but you can check their terms and conditions for more information. Using free wifi is high on the list of situations where people encounter malware.
- Do not share your login details for your systems with family or employees, and make sure each individual has their own login. For example, employees should have their own login to your e-commerce platform where required, and their permissions should be limited to what is essential for their role.
- Set up guest or staff accounts with separate passwords on your home and business wifi. This will reduce the risk of a device affected by malware being able to access your system.
- Be aware of the risks of sharing password and login information over email or messaging platforms.
- Be suspicious of anything you are being encouraged to do urgently.
- Call and check bank details before making a payment to someone you have not paid before, or if you are asked to pay into a different account.
Glossary
Cyber Security: The practice of protecting systems, networks, and programs from digital attacks.
Cyber Attack: A digital attack aimed at accessing, changing, or destroying sensitive information; extorting money from users; or interrupting normal business processes.
Penetration test: Colloquially known as a pen test, pentest or ethical hacking, is an authorised simulated cyberattack on a computer system, performed to evaluate the security of the system.
Patching: A set of changes to a computer program or its supporting data designed to update, fix, or improve it, including fixing security vulnerabilities.
Vulnerability: A weakness which can be exploited and expose your business to a threat, for example to gain unauthorised access to a computer system.
Threat: A source of potential information loss or damage relevant to your business, for example a computer virus.
Incident: A cyber security attack where information is threatened.
Breach: A cyber security attack where information is compromised.
Virus: A type of malicious code or program written to alter the way a computer operates and designed to spread from one computer to another.
Malware (malicious software): Any software intentionally designed to cause damage to a computer, server, client, or computer network. A wide variety of types exist, including computer viruses, worms, Trojan horses, ransomware, spyware, and adware.
Ransomware: Malware planted illegally in a computer or mobile device that disables its operation or access to its data until the owner or operator pays to regain control or access.
Pop-up: A window that appears on top of all other windows, commonly a form of advertising.
Virtual Private Network (VPN): This describes a way to establish a protected network connection when using public networks and makes it more difficult for third parties to track your activities online and steal data.
Internet of Things: A computing concept that describes the idea of everyday physical objects being connected to the internet and being able to identify themselves to other devices.
DNS (domain name system): Often referred to as the internet’s phone book and converts host names like https://australianolives.com.au to IP addresses.
CommuniCloud Cyber Security Solutions
If all of this is sounding a little overwhelming, don’t worry. Here at CommuniCloud, we are experts in cyber security solutions and partner with industry leading vendors. Together, we can create a Cyber Security Ecosystem of both technology and professional services, tailored around your business needs.
If you have questions on how to create a safe remote working environment for your firm or business, contact CommuniCloud.
We offer a range of cyber security solutions to safeguard your people, assets, data and business.
CommuniCloud lets you focus on running your business while we protect it!
Content author: Glenn Makowski, CommuniCloud Managing Director