“Today’s world is more interconnected than ever before. Yet, for all its advantages, increased connectivity brings increased risk of theft, fraud, and abuse. As Americans become more reliant on modern technology, we also become more vulnerable to cyberattacks such as corporate security breaches, spear phishing, and social media fraud.”
U.S. Department of Homeland Security
Small and midsize businesses don’t get the news attention, but they suffer more cyberattacks than big companies. By some estimates, nearly half of all organizations will suffer at least one security incident this year.
Even businesses and organizations that regularly and responsibly increase their network security systems and services have to remain on guard constantly because cyber criminals prey heavily on human error.
Indeed, experts estimate that the vast majority of breaches can be traced back to human mistakes rather than shortcomings in equipment.
Adam Tischler, a managed services engineer at SDN Communications in Sioux Falls, agrees that employees typically are a company’s most vulnerable network link. Companies and organizations that interact with customers by phone or email are especially vulnerable.
“Any way that one of your employees can be reached out to and contacted is going to be a risk,” Tischler says. “The bulk of cybersecurity issues typically are initiated by a user error.”
For example, an employee might unwittingly open an infected email attachment or give a persuasive caller access to sensitive information.
So, one of the first steps for any business implementing a good cybersecurity plan should be to train employees well and keep their training up to date, Tischler says. Employees also should be tested regularly on the job to make sure that a company’s security policies are being followed.
Employers might want to provide incentives to employees who point out possible security vulnerabilities, but do it a way that doesn’t embarrass colleagues, Tischler says.
When human safeguards have been implemented and strengthened, attention can be focused on the mechanical means of protecting a company’s network. Threats constantly evolve. But, based on what Tischler sees, there are four types of cyber infections that most commonly threaten businesses.
- Remote Access Trojans. These tiny cyber rats can provide an attacker with a remotely controlled, internal connection that serves as a pathway for directions and for stealing information from a targeted network. Such malware often is planted through user-requested means. A good, application-aware firewall can help identify bad signals and block them.
- Botnets, or zombies. Computers infected by Trojans can be remotely controlled and banded together into armies to launch automated spam or virus attacks, such as Distributed Denial of Service (DDoS) attacks, on other networks. Computers typically are enlisted in zombie armies without the knowledge or consent of the computers’ owners. Firewalls and protective services can help.
- Misconfiguration of websites. Sometimes publicly accessible websites can be manipulated externally to expose internally stored databases. Detecting such an exfiltration of electronic data can be difficult, Tischler says. It’s best to try to prevent such attacks in advance by keeping equipment and security practices up to date, he says.
- Old, neglected and forgotten networking equipment also can provide an entryway for hackers. For example, an old server that once provided remote access for employees might still be operational. Keep it updated or shut it down.
In many cases, a security review and a penetration scan by outside experts – such as those from SDN - can help a company reduce vulnerabilities.
Individuals and small businesses also can take steps on their own, such as subscribing to third-party, breach-notification services. Such services monitor computer breaches to let subscribers know if their email addresses have been exposed.
But first and foremost on any company’s to-do list should be to shore up its human line of defense. If that is solid, good equipment and managed networking services will take care of most of the remaining problems.
