The Benefits of Proactive Cyber Security Monitoring

cyber security monitoring A business team can take a wait-and-see reactive approach to cyber security, delaying action until it is a victim. Or, it can play a proactive role in anticipating the risks, finding the weaknesses, and putting the processes in place that may prevent or soften a cyber crime from even happening. Cyber security monitoring is one such proactive move that can pay back an initial investment many times over.

Cyber security monitoring involves the collecting and analyzing of information to detect suspicious or unauthorized behavior or changes on a network, triggering alerts, and often taking automatic, precautionary actions. Think of it as a high quality security alarm. You can leave your doors unlocked and check every now and then to see if anything has been stolen and, if so, notify the insurance company. That’s reactive. Or, you can set an alarm and not only will you know when a break-in occurs, but the system can notify the police, lock doors, and stop the break-in its tracks.

Now, or never?

Even the most secure system can be broken into, and even the most experienced IT professional can leak a password. But with proactive cyber security monitoring you can find and respond swiftly to these mistakes, and threats. In contrast, a reactive cyber security policy leaves you vulnerable, and recovery can be slow. According to the Ponemon Institute, it takes an average of 191 days for a business to detect a hack. The consequences of being hacked for days, weeks or months before noticing it may be substantial, with data continuously compromised or leaked, used and shared across a broad network of cyber criminals. The immediate and long-term ramifications of such a delay is likely to far eclipse any cyber security monitoring investment. Just a few months ago for example, Marriott International announced their network had been hacked since 2014, and wasn’t discovered until September, 2018. Information from 500 million customers was compromised.

As one security industry company writes, “You need to assume that your business will be breached at some point and have appropriate monitoring controls and procedures in place to mitigate the risks.”

Cyber Security Monitoring Basics

Cyber security monitoring utilizes a variety of mechanisms to continuously keep tabs on network traffic, and then send out alerts or take action at the right moment. As international cyberthreat intelligence provider Blueliv reports, there are typically four stages to the lifecycle of a breach:

  1. Attempting to get the information, like passwords and network credentials (via phishing or other schemes)
  2. Collecting the information (from people falling for the schemes)
  3. Validating the information (to make sure the information works, often though an automated bot)
  4. Monetizing the information (selling it to a third party, using it to steal data, and so on).

With the right threat intelligence, however, an IT security team can step in and stop the lifecycle midstream. With cyber security monitoring, action can be taken while attackers are still attempting to validate the information, or before they’ve finished fully collecting it.

Proactive Help

From hackers to disgruntled employees, to outdated devices to third-party service providers, companies are routinely exposed to security threats, often from unexpected sources. Quick response time is essential, and automated, continuous cyber security monitoring is the key to fast threat detection and response.

At Single Path our proactive monitoring services have saved our clients countless times, not only from outside threats, but from a whole host of unexpected issues. For example, our proactive cyber security monitoring for the Chicago White Sox revealed signs of imminent failure within their Contact Center Server. We were able to apply a patch to the server before it failed, preventing any disruption to customer service. At Single Path, our 24/7 proactive cyber security monitoring and problem-solving are part of what make us an outstanding partner in the continual battle against cyber security breaches or issues, and is just one of our many IT as a Service offerings.

Contact us to find out more.

6 Ways to Improve Employee Cyber Security Awareness, for Businesses and Schools

According to Accenture’s Cost of Cyber Crime Study, the average cost of cyber crime in the United States reached $21.22 million per organization last year (compared to $17.26 million the year before). But you can’t depend solely on your IT department for your cyber security. After all, a chain is only as strong as its weakest link. Improving cyber safety means increasing employee cyber security awareness throughout your entire business or school.

Here are the 6 top ways you can get your employees on board to increase engagement and improve employee cyber security awareness.

  1. Education

Do your employees or staff know:

  • Working remotely using an unsecure Wi-Fi connection leaves computers vulnerable to attacks?
  • Using personal, unsecured devices for work can open the door to compromising an organization’s network?
  • What employees say and do on social media can be tracked by cybercriminals and used against them in the workplace?

Chances are, some if not all of those points may surprise some people on your team. Most experts agree that the #1 key to cyber security compliance at a business or school is educating staff on the risks. For example, in addition to the above bullet points, does everyone on your team know how to spot a Phishing email (see our earlier blog post, How to Spot a Phishing Email), or the risks of using a thumb drive (see our post, USB Security Risks: When Flash Drives Become Dangerous)? An educated team, with increased employee cyber security awareness, makes for a more secure organization.

  1. Assign Mandatory Training

Recently we came across an article in Forbes Magazine that recommended, “Employees and management from all industries should be assigned mandatory cyber security compliance training every year.” This requirement can be administered with computer-based training modules and tied into annual reviews. When implementing training you’ll want to ensure executive and management support, a way to measure success, and also consider incentivizing participation (for more information, check out our earlier blog post, We’re Only Human: The Importance of Security Awareness Training.)

You may want to work with an outside partner to implement training, such as Single Path. We’re well versed in educating and training staff in the most up-to-date cyber security best practices.

  1. Establish and Promote Simple Procedures

More often than not, employees are happy to follow procedures as long as they are aware of them, and they are easy understand. Create organization-wide procedures for your team to follow. Make sure they are functional, actionable and simple.

Once you have those procedures in place, figure out the best way to communicate them within the organization. Keep communication friendly, and avoid hard-to-understand cyberspeak. Says Ashwin Ramasamy, co-founder of marketing intelligence company PipeCandy, “We use comic book-like imagery and sci-fi and comic language in posters across the office that reinforces the message without being suffocating.” Choose a method of communication that will resonate with your team.

  1. Encourage Reporting of Incidents

The best-trained employees can still fall for a hacking ploy from time to time, such as opening a file or clicking a link without thinking. Even IT professionals fall for these tricks. But if a user feels foolish for falling for an attack, and are embarrassed, he or she is less likely to report it. Create a reporting system that rewards staff for reporting suspicious messages, and that allows them to share mistakes without penalty or stigma.

  1. Have Employees Manage Initiatives

Rather than protocols created only by management, make cyber security policy an employee-managed initiative. Create a committee with representatives from every department, and make it their responsibility to set procedure, communicate policy and enforce compliance. Department participation, where everyone feels included, helps ensure individual buy-in.

  1. Make Awareness a Part of New-Employee Orientation

Employees expect to learn rules and processes when they start a new job, and making cyber security a part of their new-employee orientation stresses its importance, and immediately lays the groundwork for your expectations. An employee handbook is also a great place to publish protocols and procedures.

Your Employee Cyber Security Awareness Partner

To implement an employee cyber security awareness program it helps to have a proven partner. Single Path has helped countless businesses, schools and other organizations create a robust, living program that connects employees and staff to best practices. We can help you create a functional and effective cyber-threat strategy for your school or business. Single Path Security offerings are extensive, collaborative and modern.

Ask us how to get started!

Five Top Cyber Security Threats for 2019

Cyber security concerns have been around for as long as there has been cyber-anything. The first computer virus was found infecting computers in the early 1970’s and the first malware author was convicted in 1988. Those early infections were primitive compared to today’s hacking threats, which continue to grow more complex and sophisticated. While it’s vital to be prepared against any contingency, no matter how remote, we consider these to be the top cyber security threats for 2019.

Cryptojacking Rising

Ransomware has grown by 350% according to a report by Dimension Data, and accounts for 7% of all malware. It has been reported that ransomware costs American businesses north of 75 billion dollars a year, with most attacks never publicly disclosed. The biggest increase in ransomware is expected to take the form of Cryptojacking, also known as “Cryptomining malware.” We discussed the problem of Cryptojacking in a recent blog post, in which we described how hackers can hijack computer processing power to mine cryptocurrency. We expect these cyber security threats for 2019 to continue to grow.

Software Subversion Expanding

As Security magazine reports, “While exploitation of software flaws is a longstanding tactic used in cyber attacks, efforts to actively subvert software development processes are also increasing.” In other words, the software you download may be infected, giving hackers a back channel into an entire network. Malware has even been detected in open source software libraries. Another variant is this: hackers may offer software that is spelled slightly different than a popular application (such as adding an “s” or leaving out a letter), with the only other difference being the inclusion of malware. So be careful what you download, even if it’s from a seemingly trusted source.

Cybercriminals Uniting

One of the top cyber security threats for 2019 is due to the expanding resources available to cybercriminals. Historically, many cybercriminals have worked alone, or in small groups. That’s starting to change. The proliferation of hacker forums and chat groups have launched a robust black market where cybercriminals buy and exchange malware, botnets and other criminal resources. The availability of these rogue offerings means that even inexperienced, or less able, hackers can launch sophisticated attacks. These “malware-as-a-service” opportunities will only continue to grow, which will result in an increased number of cyberattacks, especially in regards to identity and credit card theft. If you think the threats are numerous now–and they are–an aggressive and nearly overwhelming wave of attacks may be on the horizon.

Synergistic Threats Increasing

GandCrab has been in the news frequently. Discovered in January, GandCrab is a ransomware Trojan horse, encrypting files on a computer and then demanding payment to decrypt them. Just recently, the group behind GandCrab has targeted users visiting adult websites, asking for money to keep silent about their potentially embarrassing visits. This, however, is just a ruse to mask their real intent. When a user clicks on the email link, he or she inadvertently installs the GandCrab ransomware onto his or her computer.

GandCrab has grown to be so large, they are actually soliciting cybercriminals to partner with them. As McAfee reported, “At the end of September, the GandCrab crew started a ‘crypt competition’ on a popular underground forum to find a new crypter service they could partner with.” This will let the GandCrab organization expand its criminal activities in new, unforeseen, ways.

In 2019, many experts, including Security magazine, predicts attackers will continue to combine tactics to create multi-faced, or synergistic, threats. To combat them, organizations will also need to synergize their defenses.

Social Media Misinformation Mounting

The proliferation of Russian-originated Facebook pages influencing the 2016 U.S. presidential elections has been well documented by news sources across the world. So it shouldn’t be a surprise that cybercriminals are eyeing social media as offering rich opportunities for criminal enterprise, with posts and pages displaying an impressive degree of professional-looking design for dishonest purposes. Botnet operators are able to test messaging just like a marketer, including the use of hashtags, to determine the success rates of their misinformation.

Social media platforms are aware of the potential abuse, and are focusing their resources on stopping it, but with so many users, and so much data available on sites, criminals will further focus their resources on these big-scale platforms.

Protect your business from the Cyber Security Threats for 2019

These five cyber security threats for 2019 are just the tip of the iceberg. There are many more threats out there, many of which we may not even be able to imagine yet. The only thing an organization can do is to be prepared with smart, sophisticated technological resources and by adhering to best Internet safety practices. Consider Single Path your partner in anti-crime. Single Path Security Offerings run the gamut from employee training to insider threat solutions. We’ll help you be prepared for the cyber security threats for 2019 and also those still to come.

Ask us how to get started!

Six Steps to Creating an Effective Business Continuity Plan

You take all the recommended cybersecurity precautions. You back up. Your staff is trained on processes. You have firewalls in place, passwords that are hard to decipher, and the most recent security patches in place. Yet, you still worry. You’re not alone. According to a recent survey, businesses ranked cyberattacks as their #1 threat, with data breach a close second. But if you are victimized by a cybersecurity incident, what do you do now? If you have a business continuity plan in place, the answer to that question is easy: follow the business continuity plan.

A business continuity plan is not the same as a disaster recovery plan, although they have a lot of similarities. As CIO magazine explains, a BC plan is about “maintaining business functions or quickly resuming them in the event of a major disruption,” while DR “focuses mainly on restoring an IT infrastructure and operations after a crisis.” In other words, DR is specific to IT, while a business continuity plan is concerned with the continuity of the entire organization (we discussed the six things you needed to include in your disaster recovery plan in an earlier article).

When you create your business continuity plan, make sure you take into account these six criteria:

  1. Conduct a business impact analysis

As Ready.gov reports, your business continuity plan should start with a complete analysis of the consequences of a business disruption and can include:

  • Lost sales and income, or delayed sales or income
  • Increased expenses (e.g., overtime labor, outsourcing, expediting costs, etc.)
  • Regulatory fines
  • Contractual penalties or loss of contractual bonuses
  • Customer dissatisfaction or defection
  • Delay of new business plans

Your Business Impact Analysis should also detail various risk scenarios and prioritize the order of events for restoration.

  1. Get everyone involved

If you are making the assumption that IT security is solely the responsibility of the IT department, think again. Your entire organization should be working together to protect its data and systems. Consider holding a brief workshop on IT security, create a business continuity management committee with members within and outside the IT department, and consider the impact and recovery on each member of your staff.

One crucial area of involvement is with your leadership team. As reported by Disaster Recovery Journal, it’s important for executives to support a culture of collaboration and to be transparent. “If executives support a culture of transparency, people will be more willing to reveal and troubleshoot problem areas in your organization’s processes. Down the road, this could help the organization mitigate a major vulnerability.”

  1. Establish work-arounds

Ready.gov paints this scenario: “Telephones are ringing and customer service staff is busy talking with customers and keying orders into the computer system. The electronic order entry system checks available inventory, processes payments and routes orders to the distribution center for fulfillment. Suddenly the order entry system goes down. What should the customer service staff do now?”

Developing manual workarounds eliminates uncertainty. For example, listing contact personnel (along with phone numbers and contact information) and providing specific details, such as how to document transactions manually, gives your team direction. You may need to reassign staff or even bring in temporary assistance if systems fail. How will you do that? Plan it all out now in your business continuity plan.

  1. Keep data on the cloud

The best way to ensure your business can continue to run, is by backing up all your data on the cloud. A cloud service ensures that an organization’s critical data and processes are secure off-site. An organization can then quickly ramp up their systems in the case of a disaster. If you’re not already on the cloud, check out our earlier posts, 12 Reasons to Move Your Business to the Cloud and 9 Facts to Know About the Risks of Moving to the Cloud, and How to Manage Them.

  1. Ready crisis communication efforts

How prepared is your organization to quickly and effectively respond to and communicate with the public—and each other–during or after a cybersecurity incident? If you are hit by a breach, you may need to issue statements to the press, customers, partners, vendors and staff. We recently posted an article about emergency communication preparedness, in which we stressed the importance of drafting some templates that cover various scenarios. As we wrote: “it’s faster and easier to tweak a message than to write one from scratch for a multitude of mediums, and even multiple languages, if needed.”

  1. Test your business continuity plan

The time to ensure your business continuity plan is effective is before you need it. Is it comprehensive? Are there gaps? For example, are contact phone numbers correct? Are you able to restore data from the cloud without significant barriers or challenges? Since the network may be down, are there hard copies of the business continuity plan, and are they distributed to all the members of the team?

As suggested by CIO magazine, testing options for your business continuity plan include a table-top exercise in a conference room with the team looking for gaps, a structured walk-through or “fire-drill,” often with a specific disaster in mind, and disaster simulation testing in which an actual disaster is simulated involving all the equipment, supplies and personnel (including business partners and vendors) that would be needed.

  1. Call Single Path

While all the steps above are important there’s a seventh step that may be just as vital: call an outside partner like Single Path. As experts in cloud services, IT security solutions and more, Single Path works with businesses, schools and other organizations to protect them from cyberattacks and help them recover when they’re hit. Planning, monitoring and adhering best practices go a long way to protecting your customers or clients, team members, vendors and your own business. Calling a partner like Single Path, and getting your business continuity plan published, are important first steps.

Ask us how to get started!

How to Spot a Phishing Email

Business organizations and schools are under cyber attack. Just this past week, it was reported that the FBI uncovered a phishing email scam aimed at stealing funds from New Jersey state employee online payroll accounts. The emails requested employee login credentials, which the criminals could then use to redirect an employees’ direct deposits. A similar ploy was recently directed at school employees in Atlanta, and the FBI Internet Crime Complaint Center (IC3) has issued a public warning about phishing email payroll fraud.

The Telltale Sign of a Phishing Email

A simple request to confirm login data, such as in the recent New Jersey state employee scam, may seem legit at first glance. Often these emails may seem to come from the organization itself, a vendor or software provider, or another trusted source. Some of these phishing email schemes are amateurish, but others are more sophisticated and harder to detect. Here are some signs an email may not be on the up-and-up:

  • Subject lines that seem “too good to be true.” They probably are.
  • Subject lines that make threatening statements. Common phishing subjects are “Your account is about to close,” or “Final Warning.”
  • Non-personalized, generic introductions. Look for terms like “Hello Valued User” or “Attention Client.”
  • “From” addresses that may be misspelled or misconfigured. For example, the email may come from someone @ “company-corporation” or “cmopanycorporation” instead of “companycorporation.”
  • Direct links. Always go directly to the source rather than clicking on an email link, or hover over the link to check the actual long-form URL, and not the shortened version displayed in the email text. You may be surprised to see where the link is actually pointing.
  • If you’re not sure, follow your gut. A phone call or personal email confirmation to a colleague or vendor may not only confirm if an email request is on the up-and-up, but alert someone their email might be hacked.
  • And in all cases, never open unexpected attachments, which could have viruses or malware attached.

The FBI also suggests, in response to the New Jersey phishing email scheme, these additional precautions:

  • Employees should forward suspicious requests for personal information to the information technology or human resources department of their organization.
  • Ensure that login credentials used for payroll purposes differ from those used for other purposes, such as employee surveys.

Happy NCSAM

This month (October) is the fifteenth annual National Cybersecurity Awareness Month, an annual initiative to raise awareness about the importance of cybersecurity.

There is plenty of information you can find in support of NCSAM, but one report we found particularly helpful was the Cybersecurity Awareness Toolkit for Small and Medium-Sized Business, as published by the Cyber Security Alliance, Facebook and MediaPro. This toolkit includes a great deal of information on how to identify phishing email tactics.

The toolkit also splits organizational emails into three general buckets, with warnings on why these groups may be targets:

General Population Phishing. The best way into an organization’s network is through its employees, especially when their level of alertness to cyber crimes may be uneven.

HR Manager. HR professionals must be particularly wary when it comes to phishing emails seeking personal information, as they are often the keepers of employee tax and health documents.

Executive Phishing. As privileged users, many executives have greater access to an organization’s network, making them particularly attractive phishing targets.

Whether someone is on the top rung or still climbing the company ladder, their awareness of phishing email techniques can make a big difference in the security of an organization.

Phishing, Solved

We recently wrote a two-part blog post on phishing, and the most common techniques hackers are using to steal your information (check out our phishing blog post part 1 and phishing blog post part 2). Among those techniques we described were phishing email schemes, just like those in New Jersey and Atlanta.

No matter what phishing technique is used, everyone always thinks, “It won’t happen to me,” or, “I’m too smart to fall for that.” But even the best of us can make a mistake. So, what do you do when you mess up, or someone at your business or school organization does?

Contact Single Path. At Single Path, we are experts on beefing up your online security to protect your organization from malicious schemes including employee training of best practices, proactive desktop, server and network infrastructure patch management, and the installation of backup protection. We are also experts at helping you rebound from an attack or natural disaster. With Single Path Security offerings you have access to a wide range of collaborative and customized protective services. Let us help you avoid being victimized. After all, falling prey to a phishing email scheme is a mistake, but doing nothing to prevent it from happening may be an even bigger one.

Ask us how to get started!

Cyber Incidents for K-12 are Rising. Is Your Student Data Vulnerable?

Data leaks are becoming so commonplace it seems like we’re almost becoming immune to them. Another ransomware attack on a business. Another virus crippling a network. Another identity theft scam. But then something happens that shakes us up and reminds us … this is not okay. Such as when an attack hits a little too close to home. For example, this—hackers are now specifically targeting schools.

CNN reported that a school district in Montana was forced to shut down more than thirty schools for three days after hackers infiltrated their network. The hackers sent threatening text messages to staff and students. School Superintendent Steve Bradshaw explained, “The messages weren’t pleasant messages. They were ‘splatter kids’ blood in the hallways,’ and things like that.” The messages also included disturbing references to “Sandy Hook.” But the hackers weren’t done. They also demanded up to $150,000 in bitcoin or they would release stolen school records. At least three other states were hit with similar school data extortion attempts.

Malicious hackers are going after schools because of a combination of weak data security and available information that is ripe for exploitation. As schools rush to incorporate technology in their schools, security protocols are sometimes afterthoughts. Vulnerable information can include social security numbers, birth dates, medical records and financial information.

An attack leaves one school district $10,000 poorer

Can your school afford to send ten grand to a hacker? Leominster Public School district officials recently had to ask themselves that question. A hacker attack left this Worcester County, Massachusetts school district unable to access email, health services, food services, library services, help desk and file services, backup services and more. The attackers demanded $10,000 to decrypt the files. Despite FBI warnings to never pay ransomware, the district felt they had little choice but to pay up. “If we had not used the option of paying the ransom for the decryption of our files, we would most assuredly be in for a much longer recovery at a much higher cost,” said Leominster Superintendent of Schools Paula Deacon. “In the case of one of the file servers, there were over 237,000 files which were encrypted, covering all departments in Central Office.”

According to an article in the Leominster Champion newspaper, the school is now making changes to their network to remove vulnerabilities including replacing old computers. The cost of this overhaul? More than $435,000. 

It’s a bigger problem than you think

How many school cyber incidents do you think have occurred in the last two years? Ten? Twenty? Try more than 330 (and growing)! In an attempt to categorize, defend and combat these threats, EdTech Securities has published a map that includes all manner of school-related cyberattacks including data breaches, phishing attacks and “other occurrences that lead to school and personal information being exposed.”

Check out the Interactive Map

The amount of exposure and consequences of those incidents vary widely. The Wall Street Journal recently reported on a number of cyber incidents including: 

  • Hackers in Iowa’s Johnston Community School District released school and parent information along with threats to kill the children. A hacker claimed the information was released to help child predators.
  • Hackers stole $56,000 worth of paychecks being sent via direct deposit to Atlanta Public School employees
  • Hackers stole $75,000 from employees of the Fulton County School district in Georgia

One state gets ahead

Many school districts are realizing the threats of a cyberattack are all too real, and are proactively working to protect themselves. Schools in Indiana are leading the way. As reported by Indiana Public Media, the Indiana Department of Education has targeted thousands of dollars in cyber funding for certain schools. Schools can apply for matching grants of up to $25,000 to build up their cybersecurity systems and improve 24-hour system monitoring. Says Chief Technology Officer John Keller, “Cybersecurity is a layered concern that goes across really all sectors. I mean, it’s not just a teacher thing or a school administrator thing, it’s our students, our staff.”

What you can do

Waiting until a cyberattack hits can be costly to schools and devastating to the families or staff whose information is breached. Fortunately, there are many resources available. For example, the U.S. Department of Education provides a number of cyber-resources and documents related to Security Best Practices, from a Data Breach Response Training Kit to a Data Security Checklist. But it can be daunting to read and figure out exactly what you need to do, especially without a partner to help guide you.

At Single Path, we work with schools across the country to help them uncover and tighten up weaknesses, implement security measures, and create recovery plans if the worst happens. We can help overhaul your entire system, as we did for Great Lakes Academy in Chicago, provide training like we did for Saint Anne Parish School in Barrington, Illinois, and offer any or all of a full range of security offerings.

Ask us how to get started!

 

Is Your Cisco Network Hardware Leaving You Vulnerable?

Recently, Cisco Systems made the news, but not the sort of news any Internet-related business wants to make. Their network hardware was hijacked, and hundreds of thousands of their customers were victims.

As this blog post from Kaspersky Labs reported right when the attack hit: “According to our sources, there’s a massive attack against Cisco switches going on right now—these switches are used in data-centers all across the globe.”

For those on a Cisco network, this was, and continues to be, a frustrating and potentially nightmarish issue. For those who don’t use Cisco networking switches, this event is a reminder that vulnerabilities exist everywhere, and constant vigilance is crucial.

What exactly went wrong?

More than 200,000 Cisco network router switches worldwide were hacked on Friday, April 6, 2018. This affected large Internet service providers and data centers across the world, especially in Iran, Russia, the United States, China, Europe and India. According to an Iranian government official, “Some 55,000 devices were affected in the United States and 14,000 in China.”

As a result of this hack, many users found their Internet connections blocked, websites down, and screens showing an American flag and the note, “We were tired of attacks from government-backed hackers on the United States and other countries.” It seems machines affected in the United States were collateral damage from an attack meant to hit foreign states. Anarchic hactivists are suspected, although no one has been charged.

Mounir Hahad, head of Juniper Threat Labs, a network and security product manufacturer confirmed initial suspicions when he said, “The vulnerability is severe enough to cause a lot of damage and implant a man-in-the-middle agent [a scheme we discussed in a past blog post], but it doesn’t look like the attacker took advantage of it. I suspect this is the work of a hacktivist group with sympathy toward the U.S., which had no intention to inflict serious damage.”

So, good news, we suppose. But it’s only good news compared to what may have been much worse news. A different group could have caused significantly more trouble such as inserting malicious code into networks, locking users out of systems unless ransomware was paid, and so on. And this could still happen. Cisco acted quickly in response to this problem, but there may be other vulnerabilities still yet unfound or exposed. One hacker news site reported that, according to Internet scanning engine Shodan, more than 165,000 systems were still vulnerable days after the attack. Those who didn’t update security patches may still be.

What can you do now?

If you think your system may have been infected, there are a few steps you can take to check. But even if you’re safe, for now, you may be exposed to other vulnerabilities in the future in unexpected ways. Single Path can help you build up your defenses, protect your systems, and help you rebound if you face a malicious computer attack.

As this story demonstrates, patching is critical for all IT assets, including networking components. Single Path provides a wide range of services, from security offerings like Patching, Desktop Security Risk Assessment and Managed Firewall, Content Filtering & Proxy Services, to consulting services so we can analyze your needs and provide ongoing support and advice. Doing nothing is never a good idea; instead, play it safe and play it smart with Single Path.

Ask us how to get started!

 

What is Ethical Hacking, And How Can It Help You?

There is only one true way to know if your computer system is vulnerable to an outside threat—to be the victim of a cyber attack. Not awesome. But what if there was a better way? What if you were the one attacking … yourself?

That would make you an ethical hacker—someone who systematically attempts to infiltrate a computer system or network vulnerability, like a hacker would, but on behalf of a company’s owners.

Ethical hackers, also known as White Hat hackers, use the same methods and techniques to test and bypass a system’s defenses as their criminal counterparts would, but rather than exploiting them for Ransomware (see our previous blog post on cyber attacks here), they document them and provide actionable advice on how to fix them.

An ethical hacker uses all or some of these strategies to penetrate a system:

  • Scanning systems to find open ports
  • Examining patch installations
  • Tricking employees into sharing passwords
  • Evading IDS (Intrusion Detection Systems), IPS (Intrusion Prevention Systems), honeypots, and firewalls
  • Bypassing and cracking wireless encryption, and hijacking web servers and web applications

The Skills To Be A Hacker

Businesses and government-related organizations are so serious about hiring ethical hackers that an entire industry has opened up to train them. An online search for “Ethical Hacker Degrees” reveals numerous degrees and training programs. The International Council of Electronic Commerce Consultants (EC-Council for short) offers Certified Ethical Hacker (CEH) certification, currently the industry standard, where students learn about viruses and Trojans, identify theft, attack tools, counter measures, and much more.

In addition to technical expertise, ethical hackers also need people expertise. According to a PC World (pcworld.com) article, How To Become an Ethical Hacker, “Ethical hackers also need street smarts, people skills, and even some talent for manipulation, since at times they need to be able to persuade others to disclose credentials, restart or shut down systems, execute files, or otherwise knowingly or unknowingly help them achieve their ultimate goal.”

A Hacker’s Bag of Tricks

People are the greatest security risk to any application. The more people who have access to a system, the easier it is to exploit them. Finding and exploiting vulnerabilities is often a matter of trickery and taking advantage of laziness, kindness and ignorance.

For example, many organizations insist on passwords being changed every ninety days. Since it can be challenging to continually create new passwords, these types of policies actually encourage easy-to-guess and poorly-created passwords shared by multiple users. A hacker can go to a login portal used by many users and try just one password against every user (this also avoids the ‘common brute force technique’—trying multiple passwords with just one user name, which can quickly lock out the user after too many failed attempts). On a blog for the internet security company peoplesec.org, one ethical hacker describes how he used a common Outlook app to guess a single password against 800 different user accounts. Fifty of the accounts matched, fifteen with VPN access and two with local admin access. The ethnical hacker then used the same password to gain access to the entire system and from there, he could do anything he wanted. The entire process, start to finish, took less than three hours.

The same hacker describes calling a law firm help desk technician, pretending to be one of the firm’s partners and complaining how he couldn’t run an application at home. Without prompting, the desk technician shared his own user name and password for the ‘partner’ to use, instead. With this information, the hacker soon had control over the entire network. Concludes this hacker, “I’d be shocked if more than 10% of enterprises exercise, measure and report the human readiness underlying more than a few of their cyber policies.”

But the most common way to gain access through users is with phishing emails. These can encourage people to respond to a fake DocuSign request, download a patch that is actually a virus, or visit a site that requires password and user name entry (also an easy way to gain access to a bank account or credit card account, as most people re-use the same combination across numerous sites). It’s been reported that, “two-thirds of electronic espionage cases can be traced back to phishing,” and “23 percent of recipients open phishing messages, and 11 percent open attachments,” numbers which are alarmingly high.

It’s Not Ethical To Wait

According to a post on thenextweb.com citing reports on U.S. News and the Ponemon Institute, “Hackers have cost the global economy an estimated $575 billion in 2014 or 0.8 percent of global GDP. Further, in 2015 the average breach at a U.S. company cost 6.5 million dollars.”

Waiting until you have a cyber problem is the wrong time to fix it. Training your team on best practices is as vital as having the right policies in place. We’ve mentioned many threats and solutions in previous blog posts, such as those easily fixed through timely security patches, those exemplified by the recent Equifax breach, and the importance of email security and back-up protection. All are important, and easily implemented.

At Single Path we can provide the guidance and training you need, a plan to keep your organization safer, and supply all your comprehensive IT security needs, from managed firewalls to risk assessment.

Learn more about how Single Path’s Security Offerings can help you create a cyber strategy your business can live with.

Ask us how to get started!

Three Recent Cyber Attacks and What They Teach Us

cyber-attacksHistory teaches us that cyber threats are not merely the stuff of Hollywood movies, or only relevant to ‘someone else.’ They are real. They are happening now. And without proper protection your system—and even the continued operations of your business—can be greatly compromised.

As we’ve detailed in previous blog posts, a malicious cyber attack can be devastating to your business—from the loss of information or money, to the loss of confidence from your customers. Our blog post on Cyber Insurance for example, outlined how general insurance policies exclude cyber threat protection, leaving a business liable for losses associated with data destruction, ransomware, hacking, denial of service attacks, crisis management activity related to data breaches, and legal claims for defamation, fraud and privacy violations.

Let’s dive into three recent attacks and see how a lack of safeguards crippled businesses.

WannaCry

This worldwide ransomware attack occurred in May 2017 and targeted computers running Microsoft Windows. It encrypted data and demanded ransom payments to decrypt them.

The attack hit on Friday, May 12. Within a day it affected more than 230,000 computers in more than 150 countries. Among its victims was the UK National Health Service. Hundreds of UK health clinics were affected, as were several hospitals. As reported by online trade publication techrepublic.com, “The incident forced surgery delays, cancelled appointments, and generally made a mess of healthcare for several days.”

A fortuitous discovery by a 22-year-old web security researcher from England found a flaw in the virus, which dramatically slowed the infection. Still, his discovery, and subsequent patches provided by Microsoft and others, were too late to help computers already infected. Also, new strains have since been detected that continue to spread, and are significantly more difficult to halt.

According to security software company Symantec: “WannaCry is far more dangerous than other common ransomware types because of its ability to spread itself across an organization’s network by exploiting critical vulnerabilities in Windows computers.”

When your files are encrypted and you have no viable backups, what are your options? As of June, it is estimated that just over $130,000 of ransomware had been paid to the perpetrators of this attack.

Pinkslipbot

Pinkslipbot is a worm capable of spreading over a network, downloading files, controlling networks and stealing user information. First introduced in 2011, once a computer is infected, Pinkslipbot can extract email addresses, accounts, certificates, web addresses, and login credentials, allowing cyber terrorists the ability to compromise banking information, credit card information and engage in personal identity theft.

Pinkslipbot is a derivative of Qakbot, a virus that emerged in the late 2000’s and has been a continual source of problems and threats, with new variants continuing to pop up—a particularly malicious strain was detected as recently as May, 2017.

From a post on business technology news website zdnet.com, “There has been a resurgence of the malware, according to [Cyber security software company] Cylance, which had been made even more evasive and persistent with new, polymorphic features that enable the malicious code to squat in business networks for longer.” Unlike ransomware, this malware does not lock out a system, but uses stolen credentials to “spam neighboring hosts and disrupt corporate activities. In turn, this may result in the compromise of additional hosts and further spread.”

CryptoLocker

The CryptoLocker ransomware attack started in September 2013 and continued for more than 20 months. The virus targeted computers running Microsoft Windows, encrypting files and offering to decrypt the data only if a payment was made by a certain date. While the virus was fairly easy to remove, the affected files remained impossible to decrypt without the ransomware payment.

The exact amount of money the operators of CryptoLocker successfully extorted vary wildly, but some sources put that number at close to three million dollars. The University of Kent released a survey reporting 40% of CryptoLocker victims paid ransom. According to the same report, “28.2% of respondents in the survey claim not to engage in any security practices online, such as using antivirus software, firewalls and password management tools.”

Avoid The Next Threat

While no one knows what threat will hit next, the one thing everyone can agree on is that every business needs to be prepared for the worst.

Our blog post on  Four Foundational Layers Every Organization Should Have outlined the importance of back-up protection, strong email security, artificial-intelligence-based security and other critical programs that can self-guard against cyber attacks.

As history shows us, getting rid of malware is at best a challenge, likely expensive, and at worst, impossible. That’s why formulating a multi-layered plan including continual back ups and implementing best practices, such as employee education, is of paramount importance. Single Path can help you get protected and stay protected. We work with small- to mid-size businesses like yours, creating a multifaceted approach that will leave you prepared for the next headline-creating cyber threat.

At Single Path we’re ready to work with you, and discuss our array of security offerings. Our certified and highly skilled security specialists understand the complexities of protecting your network, and our security solutions leave you feeling confident and secure.

Let’s make sure the next cyber attack doesn’t cripple your business and make you a footnote to tomorrow’s headlines.

Ask us how to get started!