7 Tips To Protect Your Business From Cyber Security Threats

Cyber security threats will forever become a post-pandemic norm.

How will the 2021 cyber attacks affect small/medium and large corporations?

Unfortunately, even the mightiest have fallen with the recent ransomware attack on Colonial Pipeline – an energy company which provides fuel for nearly half of the U.S. East Coast. A Russian-affiliated cyber criminal gang, DarkSide, hacked Colonial Pipeline, promptly disappearing once the $4.4 million ransom was paid demonstrating the vulnerability of the energy sector. The Colonial Pipeline responded with not only paying the ransom, but also shutting down operations for five days, leading to nationwide gas shortages and widespread panic reminiscent of the 1970s fuel shortage.

Our online world, especially the energy sector, has forever changed. What will be left of it all as the dust settles in 2021?

Joseph Blount, CEO of Colonial Pipeline Co., told The Wall Street Journal that he authorized the ransom payment of $4.4 million because executives were unsure how badly the cyberattack had breached its systems, and consequently, how long it would take to bring the pipeline back.

“I know that’s a highly controversial decision,” Mr. Blount said in his first public remarks since the crippling hack. “I didn’t make it lightly. I will admit that I wasn’t comfortable seeing money go out the door to people like this.”

“But it was the right thing to do for the country,” he added.

Will every company be forced to become cyber security experts? There will be more ransomware hacks with every company becoming vulnerable moving forward. Cyber criminals, ranging in size and capability, are here to stay, leaving many CEO’s scrambling to protect their companies’ data, reinforce client trust, and prevent brand damage when impacted by cyber security threats.

Companies should consider these 7 tactics right away to prevent cyber security threats:

1. Acknowledge that cyber threats are a material risk for all businesses, and take action to protect your people and data
2. Establish a clear company cyber security policy
3. Provide comprehensive cyber security training for all employees
4. Test employees consistently, communicate test results to management, and require management to provide additional training
5. Harden network posture, including ensuring firewalls and appropriate configurations to prevent cyber security attacks
6. Partner with your ISP (Internet Service Provider) to provide redundant protection and ensure active monitoring of their networks for cyber security threats
7. Engage a cyber security service to monitor and protect your networks

Cyber crime has increased year over year as cyber criminals capitalize from vulnerable business systems. Former Cisco CEO John Chambers once said, “There are two types of companies: those that have been hacked, and those who don’t yet know they have been hacked.”

Let’s start with understanding how a cyber attack happens, common ways to hack into a company’s business system, and reasons why hackers target an organization.

What Business Leaders Must Understand About Cyber Security Threats

Why do cyber criminals attempt to hack business systems?

86% of all cyber attacks, thefts, data breaches, and other digital crimes are motivated by money. Another incentive for criminals to engage in cyber attacks – also known as hacktivism – is wreaking havoc on a secure computer system. The attack is then about political, social, or religious justice for the group’s cause.

What types of companies are most at risk for cyber security threats?

Small businesses – 51% of organizations are the most vulnerable for cyber security threats given their lack of preparation. With an average loss of $200,000, many companies go out of business after a ransomware event due to unexpected downtime and recovery costs.

The Healthcare industry – suffered the most data breaches, with 597, of any industry in 2020. This was a 55% increase from 2019. The attacks had an average annual cost of $7.13 million in 2020 and affected nearly 26 million people.

Critical Infrastructure – Businesses without a contingency plan for cyber attacks can cost a minimum of $926 per minute in unplanned downtime, with the maximum amount skyrocketing to $17,244 per minute.

What is the average financial impact of a cyber attack for business?

Globally in 2021, a cyber attempt happens every 11 seconds, with an average ransomware payout costing $84,116. Damages and liabilities due to cyber crimes have increased 15% every year with an expected reach of $10.5 trillion by 2025.

What are the most common types of cyber security threats?

Social Engineering

The art of manipulating people into giving personal information is called social engineering. It’s easier for criminals to psychologically exploit someone rather than hack into their company’s software. Our human nature is inclined to be helpful, and employees unwittingly disregard typical safety protocols as a result.

Despite the rapid growth of cyber security threats, physical security will always remain an area of concern for businesses. Theft and hacking are when physical meets digital. Companies should continually evaluate both physical and cyber security threats as not all vulnerabilities are electronic. The easiest way for a cyber criminal to infiltrate a company is through manipulating employees. For instance, a cyber security threat can come from a cyber criminal clandestinely leaving USB drives in the parking lot. Unassuming employees that are not proactively educated about this type of hacking strategy will innocently place USB drives into a computer and activate a virus.

Social Engineering Prevention Tips

• Provide cyber and physical security training for employees to mitigate the risk of social engineering
• Ensure your cyber security and physical security companies are not operating in a silo

Malware

Malware is short for malicious malware which is software intentionally designed to cause damage to a computer, server, client or computer network. Examples of malware include ransomware, adware, spyware, worms, and viruses. Malware can enter a vulnerable network when a user clicks on a link, and an email attachment downloads it on a device. The user is typically unaware of the malware’s presence.

Adware

One of the most common forms of malware is adware – which is short for advertising-supported software.

A pop up that doesn’t close or a click advertisement could lead to a company downloading malicious software. It is common that the user downloads another software, such as a game or a survey, without knowing that the malware is also coming along for the ride. Some ads can act as spyware – collecting and reporting data about the user.

Prevention Tips for Malware & Adware

• Block malicious scripts from running on a company browser
• Install and run a dedicated routine adware tool

Bad Bots

When a software performs an automated task it is called a Bot (internet bot). A bad bot can infect a network collecting logged keystrokes, personal financial data, passwords, and other sensitive information.

Prevention Tips for Bad Bots

• Block malicious cyber attacks by installing a firewall
• Use passwords that are complex with upper-lower case alphabet letters, mainly containing a combination of numbers, and special characters
• Use a unique password for every online platform and change it every 60-90 days
• Maintain applications and software and ensure they are always kept up to date

Ransomware

Ransomware is a type of malware that blocks the access of authorized users to their private data. For retrieval of the encrypted data, the victims then need to pay the ransom amount demanded by the attacker.

Victims are blocked from access to their private data. In order to retrieve the data, the authorized user has to pay the attacker a ransomed amount of money.

This is the type of cyber attack that was used to manipulate Colonial Pipeline.

Prevention Tips for Ransomware

• Maintain frequent full system backups stored on a cloud or on a separate device

Phishing

Phishing is becoming the most common form of cyberthreat. Sending fraudulent communications through an email address that appears to come from a reputable source is phishing. The objective is to install malware on the victim’s machine or steal sensitive data such as credit card and login information.

Tips for Preventing Phishing

• Train employees not to click on untrusted links, emails or software
• Understand and follow all cyber security protocols in place

Brute Force Attack

By using several attempts through trial and error, the criminals attempt to guess your passwords. An attacker will try a possible combination of names, dates, phrases which are commonly used as a password. Once the login credentials are accessed successfully, attackers can shut down an account or website.

Prevention Tips for Brute Force Attacks

Use passwords that are complex with upper-lower case alphabet letters, mainly containing a combination of numbers, and special characters.

• Limit the number of login attempts
• Enable Captchas to prevent from automated bot attacks
• Add layers of security with multi-factor authentication

What is a SOC (Security Operations Center)?

A SOC employs people, processes, and technology in a centralized function within an organization to continuously improve and monitor a company’s security systems as well as detect, prevent, analyze, and respond to cybersecurity incidents.

Are your business systems vulnerable to cyber security threats?

Combining physical and cyber security is the #1 way to protect your people, property, and data.

AGB Investigative’s Cyber Division specializes in Security Information and Event Monitoring through our Security Operations Center (SOC). We offer expert IT Security Consulting for organizations assessing cybersecurity from the ground up, as well as IT Support and Digital Security auditing, compliance, recovery, and management.

Find out what you can do to protect your company from cyber security threats. Click here to learn more.

About the Authors

John Griffin Jr.

A nationally trained, full-spectrum security and cyber expert, John Griffin, Jr., has been involved in high-level security prevention and investigations for the past 20 years. Mr. Griffin is a certified Forensic Expert Witness and actively collaborates with local, state, and federal law enforcement agencies. He received his computer forensics training from The Department of Defense, The Department of Homeland Security, and The United States Secret Service.

In 2001 Mr. Griffin founded AGB Investigative Services with his wife Dr. Denitra Griffin. As the nation’s largest Black-owned security company, AGB offers expertise in all aspects of security, including physical and cyber. Mr. Griffin has received many awards acknowledging AGB’s accomplishments. He was awarded as an Ernst & Young’s Entrepreneur of the Year Finalist in 2018. For three years, AGB was named “Crain’s Fast 50,” one of the fastest growing businesses in Chicago as well as one of Inc. 5000’s Fastest Growing businesses in the United States in 2018, 2019 and 2020.

Dr. Denitra Griffin

Dr. Denitra D. Griffin is co-owner & President for AGB Investigative Services. Her twenty-year commitment to business strategy, leadership development, and social responsibility has led the business in aggregate revenues of over $100M within the last three years with steady growth margins over the national average.

In addition to her business acumen, Dr. Griffin helps to disrupt the cycle of poverty through her leadership of the Always Giving Back Foundation. The Foundation is dedicated to eliminate economic inequities through workforce development, financial wellness, and philanthropy to minority youth in underserved communities throughout the Chicago area. Dr. Griffin has received several acknowledgements and rewards for her leadership and commitment to service. She has awarded over $55,000 in college scholarships and spearheaded over 8,600 hours of workforce development mentoring and coaching for minority youth.