Every year, thousands of companies fall prey to attacks on their network and equipment. No one is immune; from small businesses to large corporations like Home Depot and Sony, cyber security threats must be taken seriously.
As the Internet of Things, cloud platforms, offsite storage, and other technologies gain in popularity, their susceptibility as a security breach point does, too. All companies should have risk management strategies and a strong cyber security culture in place. As part of Cyber Security Month, we are presenting this three-part series to offer tips for protecting yourself against cyber security threats in the workplace, the home, and on personal devices. In our first segment, we discussed the types of cyber threats and various ways to defend against them. This week, we’ll look specifically at the workplace, and steps to protect your business.
Understand security is everyone’s responsibility.
Develop an awareness program within your organization which educates and empowers both your customers and employees to maintain regular awareness of cyber security threats. Make sure your program is an ongoing process and not just a one-off activity. Assign security “experts” within the company who can keep training efforts fresh and updated.
Make sure new hires are immediately brought into the fold with your cyber security efforts. Every employee should know their part in the awareness program, how to watch for suspicious activity, and where to report it from day one.
Keep it personal.
Personal information about yourself, fellow employees, company practices, remote access to the company network, etc., should never be discussed with people outside of the company, even if you are acquainted with them. Scammers and social engineers use this information to exploit and gain access to company data. Whether the request is via email, telephone, text, or in person, all information should be kept confidential unless the requestor’s identity has been verified and approved.
Protect yourself from phishing.
Phishers are adept at masquerading as legitimate individuals or companies. If you receive an email from an unknown sender, the best practice is to never open it. If you do, read it thoroughly. Grammatical errors and misspelled words are commonly found in phishing scams. Never click on a link in a suspicious email; they often contain a virus or lead to a malicious website disguised to look like a legitimate domain. Instead, use your browser to go directly to the company’s website. If you think you’ve received a phishing scam, delete the email message completely.
Beat the BEC
Business Email Compromise (BEC) is a sophisticated scam which targets businesses who work with foreign suppliers and/or regularly perform wire transfer payments. First, they compromise legitimate business e-mail accounts through social engineering or computer intrusion, then they conduct unauthorized transfers of funds. The Financial Services Information Sharing and Analysis Center recommends additional steps to protect your company against BEC:
- Create intrusion detection system rules that flag e-mails with extensions similar to company e-mail. For example, legitimate e-mail of abc_company.com would flag fraudulent e-mail of abc-company.com.
- Register all company domains that are slightly different than the actual company domain.
- Verify changes in vendor payment location by adding additional two-factor authentication, such as having a secondary sign-off by company personnel.
- Confirm requests for transfers of funds. When using phone verification as part of the two-factor authentication, use previously known numbers, not the numbers provided in the e-mail request.
- Know the habits of your customers, including the details of, reasons behind, and amount of payments.
- Carefully scrutinize all e-mail requests for transfer of funds to determine if the requests are out of the ordinary.
Next week, we will wrap up the series by taking a closer look at personal cyber protection, including your home computer and mobile device.
Kila mwaka, maelfu ya makampuni huathiriwa na mashambulizi ya mtandao na vifaa vyao. Hakuna mtu aliye na kinga; kutoka kwa biashara ndogo hadi mashirika makubwa kama Home Depot na Sony, vitisho vya usalama wa mtandao vinapaswa kuchukuliwa kwa uzito. Kama mtandao wa vitu, majukwaa ya wingu, kuhifadhi nje ya tovuti, na teknolojia nyingine kupata katika umaarufu, unyeti wao kama uhakika wa kuvunja usalama hufanya pia. Kampuni zote zinapaswa kuwa na mikakati ya usimamizi wa hatari na utamaduni mkubwa wa usalama wa mtandao mahali. Kama sehemu ya Mwezi wa Usalama wa Mtandao, tunatoa safu hii ya sehemu tatu kutoa vidokezo vya kujilinda dhidi ya vitisho vya usalama wa mtandao mahali pa kazi, nyumbani, na kwenye vifaa vya kibinafsi. Katika sehemu yetu ya kwanza, tulijadili aina za vitisho vya mtandao na njia mbalimbali za kujikinga dhidi yao. Wiki hii, tutaangalia hasa mahali pa kazi, na hatua za kulinda biashara yako. Kuelewa usalama ni wajibu wa kila mtu. Kuendeleza programu ya ufahamu ndani ya shirika lako ambayo huelimisha na kuwezesha wateja wako na wafanyakazi kudumisha ufahamu wa kawaida wa vitisho vya usalama wa mtandao. Hakikisha kwamba programu yako ni mchakato unaoendelea na si shughuli ya mara moja tu. Kuweka usalama "wataalamu" ndani ya kampuni ambao wanaweza kuweka juhudi za mafunzo safi na updated. Hakikisha kuajiri mpya ni mara moja kuletwa katika fold na juhudi zako za usalama wa mtandao. Kila mfanyakazi anapaswa kujua sehemu yake katika mpango wa ufahamu, jinsi ya kuangalia kwa shughuli ya kutilika shaka, na wapi kuripoti kutoka siku ya kwanza. Weka mambo ya kibinafsi. Habari za kibinafsi kuhusu wewe mwenyewe, wafanyakazi wenzako, mazoea ya kampuni, upatikanaji wa mbali wa mtandao wa kampuni, nk, haipaswi kujadiliwa na watu wa nje ya kampuni, hata kama unawajua. Watapeli na wahandisi wa kijamii hutumia habari hii kutumia na kupata upatikanaji wa data ya kampuni. Ikiwa ombi ni kupitia barua pepe, simu, maandishi, au kibinafsi, habari zote zinapaswa kuhifadhiwa kwa siri isipokuwa utambulisho wa mwombaji umethibitishwa na kupitishwa. Jilinde dhidi ya udanganyifu. Watekaji-mbizi ni stadi katika kujifanya kuwa watu au makampuni halali. Ikiwa unapokea barua pepe kutoka kwa mtumaji asiyejulikana, mbinu bora ni kamwe kuifungua. Ikiwa ndivyo, soma kwa uangalifu. Makosa ya sarufi na maneno yaliyopigwa herufi vibaya hupatikana kwa kawaida katika udanganyifu wa udanganyifu. Kamwe usibonyeze kiungo katika barua pepe ya mashaka, ambayo mara nyingi huwa na virusi au inaongoza kwenye tovuti mbaya iliyojificha kama uwanja halali. Badala yake, tumia kivinjari chako kwenda moja kwa moja kwenye tovuti ya kampuni. Kama unafikiri umepokea udanganyifu wa udanganyifu,futa ujumbe wa barua pepe kabisa. Beat the BEC Business Email Compromise (BEC) ni udanganyifu wa kisasa ambao unalenga biashara zinazofanya kazi na wauzaji wa kigeni na au kufanya malipo ya uhamisho wa waya mara kwa mara. Kwanza, wao kuhatarisha halali biashara akaunti za barua pepe kupitia uhandisi wa kijamii au kompyuta uvamizi, kisha wao kufanya uhamisho wa fedha zisizoidhinishwa. Kituo cha Uchambuzi na Ushirikiano wa Habari za Huduma za Fedha kinapendekeza hatua za ziada za kulinda kampuni yako dhidi ya BEC: - Kuunda sheria za mfumo wa kugundua uvamizi ambazo zina alama ya barua pepe na upanuzi sawa na barua pepe ya kampuni. Kwa mfano, barua pepe halali ya abc_company.com ingekuwa alama ya barua pepe ya udanganyifu ya abc-company.com. - Usajili wote kampuni domains kwamba ni kidogo tofauti na kampuni halisi domain. - Kuthibitisha mabadiliko katika muuzaji malipo eneo kwa kuongeza ziada mbili-sababishi uthibitisho, kama vile kuwa na sekondari saini-off na wafanyakazi wa kampuni. - Kuthibitisha maombi ya uhamisho wa fedha. Wakati wa kutumia uthibitisho wa simu kama sehemu ya uthibitisho wa sababu mbili, tumia nambari zilizojulikana hapo awali, sio nambari zilizotolewa katika ombi la barua pepe. - Kujua tabia ya wateja wako, ikiwa ni pamoja na maelezo ya, sababu nyuma, na kiasi cha malipo. - Chunguza kwa uangalifu maombi yote ya barua pepe ya uhamisho wa fedha ili kuamua kama maombi ni nje ya kawaida. Katika wiki ijayo, tutamaliza mfululizo huu kwa kuangalia kwa karibu ulinzi wa kibinafsi wa mtandao, ikiwa ni pamoja na kompyuta yako ya nyumbani na kifaa chako cha rununu.