And How You Can Protect Your Business
Cybersecurity is becoming a pressing issue for professionals in all industries. All organizations, from retail shops to law offices, have a digital presence and often collect personal information.
But whenever individuals give out their personal information—be it credit card details or name and password—they’re at risk of having it stolen. Personally identifiable information (PII) is one of the top targets for threat actors (that’s anyone who is trying to access your systems – hackers, cybercriminals, nation states, etc.).
And… unfortunately, we haven’t really been helping ourselves out. Up to 80% of data breaches are related to human error in some capacity, according to the Verizon DBIR.
But how do hackers get your information?
Whether it’s your name, social security number, email and password combination, or medical details, identity theft can be leveraged quickly. Personal account takeover can quickly spiral out of control, compromising businesses, families, and whole industries.
Threat actors have many methods of obtaining this information. One of the most common ways is by going on the dark web, where whole lists of personal information are available, both for free and for sale. High-level corporate account credentials might be for sale, while thousands of first names and social security numbers might be posted for all to see.
These massive lists, and other dark-web-sourced details, come from previous breaches and cyber attacks. Here are some of the most common types of attack:
1. Phishing schemes:
Phishing is an attack method where targets are contacted by email, telephone, or text message by someone posing as a legitimate institution (like a boss or family member) to lure individuals into providing sensitive data such as personally identifiable information, banking and credit card details, and passwords.
2. Password Spraying
Password spraying relies on trying a few, commonly used passwords against a large number of accounts. Threat actors might ”spray” thousands or millions of accounts with a couple of common passwords because they can often rightly assume there’s one person using a common password within a large group of people. Once they have a match, cybercriminals can move laterally across that person’s online presence, often using the same set of credentials for multiple accounts.
3. Credential Stuffing
In this attack method, hackers use lists of stolen usernames and passwords in combination on various accounts. They may build a program that tries over and over again, automatically, until they hit a match and can access an account. Credential stuffing heavily relies on people’s tendency to reuse their passwords.
4. Malware
Malware and ransomware can be packaged and disguised by cybercriminals in ways you wouldn’t expect. A random email attachment, a strange link, or just a targeted attack could mean your network ends up compromised, with a malware attack running your systems amok or stealing other information within your device.
What are the best ways to prevent cyberattack?
Establishing a holistic and defensive cybersecurity posture is a must-do for any business with a digital footprint. Depending on your industry, your compliance requirements may change, but there are many aspects of a cybersecurity plan that are widely applicable.
Utilizing tools like antivirus software, enterprise-grade firewalls, and requiring users to employ multi-factor authentication (MFA) can help you protect your network.
It’s also crucial to have a backup and disaster recovery plan.
What if it’s too late?
Worst case scenario: you’re already under attack. If threat actors are already within your system, the first step is to call Stratti. We’ll help you restore what you can, and deploy your backup and disaster recovery plan.
Once we have your systems back up and running—not a minute of downtime more than is necessary—we can help protect against future attacks. Employee training can go a long way, but we’ll also help you find solutions that fit your business model. This may include requiring MFA for more secure authentication, having all team members reset their passwords, or getting your internal policies on board with NIST (National Institute of Standards and Technology) solutions.
Analysis and remediation are complicated and should be done by a professional. If you’re in over your head—don’t stress. Just give us a call at (530) 342-8999.
