Martin Straub is the owner of SimplePowerIT, LLC, an affiliate of Cordell, Neher & Company, PLLC, and provides cybersecurity and technology solutions and support to NCW businesses and nonprofits. Martin can be reached at (509) 433-7606 or martin@simplepowerit.com.
In the early days of the internet, most individuals and businesses considered themselves safe from hackers if they had reliable antivirus software. The occasional virus was a nuisance, but typically didn’t involve the theft of confidential data. Because it was inconvenient to secure PCs and WiFi networks with passwords, many of us didn’t bother. Similarly, when we created website accounts, we didn’t think twice about using “Password” as our password because really, what was the risk?
Unfortunately, whereas years ago, malicious internet activity was often motivated by technology “nerds” looking to prove that they were capable of breaching networks and releasing destructive viruses, today cybercriminals are most often motivated by money. The “dark web” provides a platform for criminals to exchange data, pass along trade secrets, and generally make their living. An entire industry now thrives making money illegally on the internet, often at our expense.
Many small businesses and nonprofits naively think they won’t be targeted by cybercriminals. According to Verizon, 58% of malware attack victims are categorized as small business. Another sobering statistic from a 2017 Ponemon Cybersecurity Study indicates that 61% of small businesses experienced some type of cyberattack in the past 12 months. The reason? Small businesses and nonprofits lack the resources of larger organizations and often don’t understand the risks or make it a priority to properly secure their data.
Be suspicious of every unsolicited email. According to the same Verizon study, an amazing 92% of malware is delivered via email. That doesn’t necessarily mean a malicious attachment; often it is a less suspicious link within the email that starts the malware infection. Phishing emails (and a clever variation known as “spear phishing” which impersonate a known person to gain the trust of the recipient) have become increasingly more sophisticated and difficult to distinguish from legitimate messages. Office 365 users are particularly susceptible, not because Office 365 is inherently less safe, but because it has a massive user base attracting more sophisticated attacks.
Control access to data. Because end user PCs are the most common sources of malware, controlling access to data may help contain a virus’ spread. If a user does not have a business need to access customer or other confidential data, use security controls to restrict their access. For instance, in QuickBooks, assign only permissions that correlate to the person’s responsibilities; on a server, assign folder share permissions only as needed.