NSA’s intellectual property extracted from an employee’s home computer… Hacking attempts on real-time payment transfers at three Mexican banks… Delta Air Lines, Sears and Best Buy breached by malware-infected software from a channel partner…
What do these three incidents have in common?
The hackers attacked at points of vulnerability.
NSA. Bank of Mexico. Best Buy. Sears. Delta. These organizations are some of the biggest, most aggressive entities in the world when it comes to pursuing cybersecurity. And yet their business operations and potentially their customers were impacted by cyber attacks. If organizations such as these, with funded and staffed cybersecurity operations, can be breached, what does that mean for businesses that lack the robust resources of such organizations? Should we give up because even they cannot stop hackers?
Not if we want to stay in business.
There are important lessons in these hacks that translate to EVERY business, large and small.
Just as energy flows along the path of least resistance, so will hackers attempt to access data at the point where it is most vulnerable – regardless of the level of security preparations or size of organization. Notice that none of these hacks took place behind the firewall within the victims’ hardened networks.
- The NSA breach was an attack on a remote worker.
- The Bank of Mexico attack occurred when attackers attempted to hack entities within the bank’s interbank electronic transfer system.
- Best Buy, Sears, and Delta fell victim to malware introduced through 7.ai, a third-party vendor.
Recognizing that anyone can be hacked … eventually, what are the countermeasures?
We’re glad you asked.
Securing the Remote Worker
In a modern business environment, remote workers can be independent contractors, employees working from home, or employees (often executives) working on the road. For all types of remote workers, an effective solution is to have them do their work within the corporate network, where the security is the most robust. Remote Desktop and VPN are two common approaches that can be quite effective, but they can be difficult for users to deal with and become useless when the connection breaks. Soliton’s SecureShield provides an alternative solution that combines the safety of a secure browser with the encrypted security of VPN. On PCs, it also application-wraps the workspace, enabling the user to keep working on files protected by SecureShield even with interrupted connections.
Trusting Data in Transit
In modern businesses, both big and small, data constantly flows between company offices, between customers and suppliers, and between the cloud and the local network. Many options exist for securing data in transit, and the Bank of Mexico surely had strong ones in place. Yet, they still had to advise their partners to pursue alternative connection methods because the interbank electronic transfer system and partner banks were potentially compromised. In addition to the traditional methods used to encrypt data during the handoff, why not apply multiple layers of security? Integrating a secure browser (such as SecureShield) within client-facing applications or requiring the use of a secure browser to access an application will allow a company to extend their own security to their partners without relying upon their partner’s ability to be secure.
Managing Third-Party Risk
In today’s workplace everyone has at least one third-party partner. Even the smallest of SMBs has online access to banks, send emails to their accountants, uses a credit card processing partner, etc. Managing the cyber risk introduced by a third party will always be more difficult because their systems are completely out of our control. Yet we still rely upon services from third parties, many of whom are SMBs without the robust resources of the NSA or multinational corporations. In today’s interconnected world, hackers see an organization’s partners as an open backdoor to the organization’s network. Risk management platforms can help an organization map its attack surface, monitor changes to supply chain partners that are part of that attack surface, anticipate problems, and work with partners to address the risks. Check out these six best practices for reducing third-party cybersecurity risk and pass along the message to your key partners.
SMBs – Back to Basics
When passing along those best practices, find a friendly way to remind your partners that no matter how small they are, you expect them to adhere to fundamentally sound security practices. Many SMBs either believe that that their security programs are good enough, or that they have nothing of value to an attacker. Assuming that an attacker has nothing to gain from an SMB will be the death of the business. Business owners need to sit down with their internal or external experts and invest the time to examine their entire security profile and assess what measures can reasonably be taken to address vulnerabilities – internally and externally. A good place to start is to minimize data to be shared and maximize the protection of data to be shared – in as many layers of protection as is practical and affordable given the value of your data. For a review of the basics and additional tips, check out these resources:
- 12 Cyber Security Tips to Protect your Small Business
- Six Tips for Shoring Up your SMB Security Strategy
- Create Your 2018 SMB Cybersecurity Plan in 6 Steps
Nakashima, E., Israel hacked Kaspersky, then tipped the NSA that its tools had been breached, Washington Post, October 10, 2017.
Schwartz, M. J., Hackers Target 3 Mexican Banks’ Real-Time Transfers, BankInfoSecurity, April 30, 2018.
In Latest Hacking News, Best Buy Breached?, PYMNTS, April 6, 2018.
Earley, S., 6 Best Practices that Reduce Third-Party Cybersecurity Risk, Security Magazine, October 5, 2017.
12 Cyber Security Tips to Protect your Small Business, EkranSystem.com, December 9, 2016.
Teitler, K., Six Tips for Shoring Up your SMB Security Strategy, MIS|TI Training Institute, February 15, 2018.
McDonald, T., Create Your 2018 SMB Cybersecurity Plan in 6 Steps, NSI, December 7, 2017.