DENVER – Cyber attacks have been part of the news cycle for several weeks, with JBS USA – the world’s largest meat processing company – the latest target of these criminals.
These types of attacks don’t just happen to large businesses – they’re the ones making headlines, according to Scott Warner, president of Connecting Point, an outsourced managed IT services company that provides services to small and medium-sized businesses across the country. Colorado. and Wyoming.
Denver7 spoke with Warner about the recent wave of cyber attacks and what businesses and individuals can do to better protect themselves from cybercriminals. To note: This interview has been edited for brevity and clarity.
Q: What is happening with these cyber attacks on fuel pipelines and meat processing facilities?
A: Well, I think what people are seeing is just a proliferation – on a large scale – of what is happening on a small scale. Notoriety and the press focus on the bigger tax, but Small Business USA is actually a much bigger tax service. So people should know that cybercrime is a $ 3 trillion revenue industry on an annual basis and therefore there is a lot of dollars and therefore a lot of activity in all verticals and all shapes and sizes.
Q: So you don’t hear much about the little guys, but they are attacked just as much.
A: If you really think about it, the work and dollars that a large organization or business spends on IT security is far more than a small business would have to deal with cybersecurity. Thus, there are more entities to attack with less focus and protection around cybersecurity. So if you think about it, a large organization can always be compromised; How much more easily is a small organization compromised as attacks become more elegant and complex? … And money is part of the solution, but education, awareness and training is more than half the battle, right? You have to have – at the end of the day – the lowest common denominator is the individual, and so if the individual doesn’t understand their role, then that’s the weakest point of attack.
Q: For most businesses – I guess big and small – it’s not a question of if, but when.
A: There is a great term that most executives and business owners should embrace, which is “suspected violation,” which is the kind of lens to consider, it’s not if, but when. Cybercrime is constant and constantly evolving, so I think if we consider our responsibility to mitigate the risk and understand how to temper the carnage, you know – when that happens – and come out in as good a situation as possible. , then you’ve done your job to mitigate that risk of breach.
There are a handful of mundane things that need to be more widely adopted and implemented, but things like: Enforcing good password hygiene, ensuring networks are constantly updated and protected, points terminals are secure, ensuring that two-factor authentication is enabled across remote access and critical connections and connections, with emails being protected and ensuring that when people send and receive emails – this is really where most of the damage happens with emails – and again, train your staff to your team to understand who they are the weakest link and how to identify The problems.
We can forget how many username and password leaks we’ve had with big platforms like, you know, Facebook and LinkedIn and some of those big, big platforms where credentials have already been compromised. , they are there, that is why the hygiene password is important. But it’s… it’s a multitude of organizations and people that are actually carrying out these credentialing efforts. And so, it’s a big money industry and therefore we have to be prepared to apply that same kind of effort. Otherwise, you will always be chasing after.
Q: Tell us about ransomware. Should companies ever pay? I’ve heard that companies do it.
A: Thus, companies have problems when background data protection policies and procedures are not followed in a way that protects the data and the inability to restore it. Once data is lost, they are in control, but data protection practice and procedure is one of the most important things a business can do.
If done right, an organization shouldn’t have to pay a ransom to get their data back; we should be able to recover these recordings without paying ransom. You don’t want to have to pay a ransom. If you have to pay a ransom, you’re going to negotiate with someone who has very little long-term understanding of what’s going to happen with your data.
Believe it or not, there are trust issues in the world of cybercrime. They’re actually pretty trustworthy because if they lose their trust, that… ‘Okay. I’m gonna, you know, someone’s gonna pay my ransom ‘and I don’t get their data back,’ … there’s this very weird code of ethics that they kind of have to enforce, but you don’t get there and there are many ways to prevent yourself from getting there.
Usually, when a business has to pay a ransom, it’s because at some point in their process they haven’t been able to protect their back-end data, to the extent that they should or should have. could have it, and as a result, its data was compromised beyond recovery, which again, you shouldn’t have to go there. But sometimes the worst case happens when an organization has to learn a lesson the hard way and paying a ransom is the only way out. The hardest part for users is to navigate a path of increased resistance, right? So, the simplest – and this is what cybercrime is all about – is the path of least resistance for a user and the path of least resistance for a person carrying out an act of cybercrime. Password hygiene is therefore very important and is really part of the basis of a kind of sound cybersecurity practice, password hygiene.
Q: I saw something recently that says all these Facebook quizzes that are shared out there, these are actually trying to get your password questions answered.
A: Absolutely, yeah. So, there are a lot of cool tricks that are used to capture information and credentials to sell and use to attack. Another cool thing is that many businesses will have their email addresses on their websites. It’s an easy way for someone to say, “I know the CEO, I know his email address, and I know how I can kind of spoof his email. And it’s easy for someone, so being aware of that stuff is important as well.
(But not all Facebook quizzes try to get your information out), but there are definitely some spoofed quizzes that you should be aware of. Never complete these quizzes.
One of the things that has become increasingly important for small businesses is to purchase cybersecurity insurance. One thing to note is that as organizations try to acquire cyber policies they are … underwriters are getting more aggressive and demanding cybersecurity services and best practices in place to get cyber policy, which will be a big deal. trend for small businesses. – they will have to strengthen their cybernetic practices to even be insured with cyber insurance.
And if you look at some large organizations, if they want to go into business with a bigger organization or entity or bid for a job, they have to prove that they have cyber insurance. But this is something that is no longer so easily acquired.
RELATED TITLES –
JBS ransomware attack is a cautionary tale, which many experts have warned for years