As hackers take advantage of corporate America’s migration toward teleworking, more cyberattacks targeting supply chain agencies, cloud environments and mobile devices are expected to come, three Louisiana cybersecurity experts agreed this morning during a webinar hosted by Business Report.
Facing the highest risk of ransomware and phishing attacks, both in Louisiana and across the U.S., are the banking and finance, technology and government sectors, according to panelist Jeffrey Moulton, president and CEO of Stephenson Technologies Corp. He strongly recommends businesses purchase cybersecurity insurance as one way to help mitigate this risk. And small businesses are particularly susceptible to being targeted.
“They’re so easy to hack,” said panelist Duane Barnes, CTO of RapidScale, a COX Business Company, recalling an incident where a payroll department at a small manufacturing company was asked over email, seemingly by its CEO, to immediately wire $750,000 to a certain account and had a difficult time reclaiming the money. “No one is investing in this.”
On the other hand, to prevent internal attacks from occurring, it’s important to foster a “holistic” view of security, said panelist Bill Bradley, an executive-in-residence at Louisiana Tech University and retired CenturyLink executive. (Earlier, it was referenced that around 48% of cyberattacks in the medical sector come from internal actors.)
“Understand who has the keys to the kingdom, and what they can do with them,” Bradley said. “Ensure you don’t have one individual who can corrupt your company. Separation of duties is important.”
In addition to the Q&A included in today’s edition of Daily Report AM, check out some of the other questions asked and panelists’ responses, which have been edited for space and clarity.
Many small businesses rely on third-party vendors for storing, analyzing, or leveraging their data. What’s the best way to ensure your data is protected when in the hands of a third party?
Jeff Moulton: You need to understand how your data flows from one terminal to another and who touches it. When you contract to a third party, you’re trusting that third party with everything. You have to have a level of assurance, through the agreements you’re signing, to ensure that the people working with your data are credible, and know what the terms of your contract are if your data is exploited.
Bill Bradley: Whether your data is stored locally or in the cloud, it’s important you have backups. Follow the 3-2-1 rule: Have three backups on two types of media, one of which is off-site from your business. It’s incredibly important that you know that your backups work, so test them. Work with somebody—your service provider and not the cloud—to make sure you get that data back.
Do you recommend giving employees a separate cellphone provided by the company?
Duane Barnes: It’s a double-edged sword, because no one wants to carry two devices. But most companies have access to mobile device management, so as long as an employee signs some sort of waiver saying the company can install that on their phone, the company can control how that device accesses their data—maybe through VPN enforcement, or device encryption requirements. The downside is that you’re giving companies access to your personal device. You’ll have some employees who get a little finicky. But it’s either/or, you need to either give them that company device or manage their personal devices.
JM: I know it’s a pain to carry two phones, but in my opinion, it’s worth the inconvenience.
In terms of training, how can a company with 100 employees and occasional turnover minimize the risk of an employee clicking on something they shouldn’t be clicking?
BB: Get whatever cyber talent you have connected with your HR department. You need to pull HR into the conversation when it comes to repeat cyber offenders. I see it beginning to happen, but it’s been a long time coming.
DB: Google “end-user awareness training.” Lots of companies sell it. It’s very simple. If you have to go to court to defend yourself in a situation where you lost an employee’s or a customer’s data, you can say, “we do monthly classes and surveys on this,” so you’ll be in a much better spot.
What should the state and city-parish be doing to protect their agencies’ data in a time when revenue for investment is limited?
JM: The fiscal reality of our state is that people are working on legacy systems, like Windows 7. We’re doing as much as we can to bring the systems up to speed, but everyone must understand how their data moves and secure as many pieces of it as you can. Good cyber hygiene is the key to success; using “admin” as the administrative password is not good cyber hygiene.
BB: Training must occur within school districts and government entities. Also, Microsoft offers a free upgrade path from Windows 7 to Windows 10.
DB: Small businesses should always err on the side of “auto-update.” The benefits of security patches far outweigh the risks of software becoming unfunctional these days.
