This month, I attended a cybersecurity roundtable organized by the Chester County Chamber of Business and Industry. Supervisory Special Agent Ben Stone from the FBI led the meeting and discussed some very helpful IT security insights.
It was frightening to hear many threats we often discuss with our clients are considered common and dangerous by the FBI. I was reassured to hear that the countermeasures Pegasus recommends to our clients are some of the most effective solutions.
[button size=” style=” text=’Download the IQ Security Test for Employees’ icon=’fa-file-pdf-o’ id=’iq-test-button’ icon_color=” link=’https://www.pegasustechnologies.com/download-technology-security-iq-test/’ target=’_self’ color=” hover_color=” border_color=” hover_border_color=” background_color=” hover_background_color=” font_style=” font_weight=” text_align=” margin=”] [vc_separator type=’transparent’ position=’center’ color=” thickness=’25’ up=” down=”]
Here are a 5 of my top cybersecurity takeaways from the discussion I want to share with you:
1. Keep insiders from exploiting your company data
When your human resources department confronts an employee about lacking performance, demotions, or termination, ensure they do it with tact and have a follow-up procedure for technology.
HR should be prepared to terminate all employee accesses and credentials to prevent a terminated employee from having the means to open a security breach.
Many cybersecurity issues can be caused by upset employees still on the inside, but also by those on their way out the door. Disgruntled employees may resort to exposing your company to IT security threats. Even employees who are merely upset and careless might also unknowingly violate cybersecurity best practices and open up a security hole.
2. Create a response plan for security breaches
The roundtable discussion made it clear that every organization should have a Cybersecurity Incident Response Plan. With an official plan in place, you can remain calm and address a problem thoroughly instead of accidentally skipping over security protocols in a panic. The plan should include a comprehensive list of who you need to call in the event of a security breach:
- IT remediation companies
- IT security & forensics companies
- Law enforcement officials
Put the responsibility of initiating the plan in the hands of company officers who can make tough decisions under pressure. For example, they may need to hurt business operations in the short-term, but save the company in the long-term by shutting down the point of sale terminals during the busiest time of the day to prevent the spread of attack.
3. Use extra caution when traveling
When traveling abroad, you may be carrying sensitive company information on a phone or laptop. You may even have intellectual property stored on your devices. Another key takeaway from the roundtable discussion: only take what you need when traveling.
You should assume any electronic data you send or receive while traveling internationally can be breached. Consider using a “burner” laptop and cellphone to minimize the exposure of your sensitive data. Burner means it’s a device purchased for one-time use, such as using:
- A prepaid disposable phone to make calls when traveling
- A cheap laptop with only the necessary company information for your trip
This way you can travel lean with your company data, transfer any new data on the device when you return, then have the laptop or phone wiped out and thrown away.
4. Don’t pay ransom to cybercriminals
Some cybersecurity breaches don’t just damage your data; they can hold it hostage. Cybercriminals can render your files unusable until someone pays them. You should never pay them, even if they demand an alternative to the dollar bill.
Many times these criminals will demand paying ransom in bitcoins. Bitcoins are a digital currency bought and sold online. It contains an element of security attractive to cybercriminals because it:
- Doesn’t require a currency exchange
- Can’t be counterfeited or faked
- Its value can increase
Today, one Bitcoin is valued at approximately $1,700 and is subject to market conditions. A bitcoin is a safer alternative for the cybercriminal and more expensive for your company.
Avoid paying ransoms. There’s no guarantee that the criminals will honor their part of the deal, they have no moral obligation to you and shouldn’t be trusted. They may bail before they unlock your files and leave you with lost data and less money.
5. Train your employees on cybersecurity
Your employees can be your strongest or weakest line of defense depending on whether you train them on cybersecurity best practices. Cyber attacks can travel through many different channels. Attacks such as Spear Phishing (targeting single employees to give up their access credentials) can come through:
- Phone
- Remote logins
Above all cybersecurity training takeaways from the FBI conference, there are 2 that strengthen your human firewall the most. First, ensure your staff uses complex passwords to keep their accesses secured. Second, teach them how to spot a phishing attack so that they know to be cautious and follow your cybersecurity response protocols.
You’re responsible for your company’s cybersecurity
As sophisticated as the FBI’s cybersecurity forces are today, the reality is that the FBI has limited resources and cannot pursue every single computer crime out there.
It’s up to all organizations and people to maintain a secure posture and avoid becoming a victim. If you have suffered a loss due to a cyberattack, you can file a complaint online at the Internet Crime Complaint Center (IC3).
