robintek

The federal Internet Crime Complaint Center received more than 330,000 complaints in 2009, and more than a third of them ended up in the hands of law enforcement. The damages from those referred to the authorities totaled more than a half billion dollars. The Government Accountability Office estimated that cyber crime cost U.S. organizations $67.2 billion in 2005; that number has likely increased since then. With so much of business today done electronically, organizations of all types are highly vulnerable to theft and corruption of their data. It is important for them to identify their loss exposures, possible loss scenarios, and prepare for them. Some of the questions they should ask include:

What types of property are vulnerable? 

The organization should consider property it owns, leases, or property of others it has in its custody. Some examples:

• • Money, both the organization’s own funds and those it holds as a fiduciary for someone else

• • Customer or member lists containing personally identifiable information, account numbers, cell phone numbers, and other non-public information

• • Personnel records

• • Medical insurance records

• • Bank account information

• • Confidential memos and spreadsheets

• • E-mail

• • Software stored on web servers

Different types of property will be susceptible to various threats, such as embezzlement, extortion, viruses, and theft.

What loss scenarios could occur?

The organization needs to prepare for events such as:

• • A fire destroys large portions of the computer network, including the servers. Operations cease until the servers can be replaced and reloaded with data.

• • A computer virus infects a workstation. The user of that computer unknowingly spreads it to everyone in his workgroup, crippling the department during one of the year’s peak periods.

• • The accounting department discovers a pattern of irregular small funds transfers to an account no one has ever heard of. The transfers, which have been occurring for almost three months, were small enough to avoid attracting attention. They total more than $10,000.

• • A vendor’s employee strikes up a casual conversation at a worker’s cubicle and stays long enough to memorize the worker’s computer password, written on a post-it note stuck to her monitor. Two weeks later, technology staff discovers that an offsite computer has accessed the human resources database and viewed Social Security numbers, driver’s license numbers, and other personal information.

In addition to taking steps to prevent these things from happening, the organization should consider buying a Cyber insurance policy. Several insurance companies now offer this coverage; although no standard policy exists yet, the policies share some common features. They usually cover property or data damage or destruction, data protection and recovery, loss of income when a business must suspend operations due to data loss, extra expenses necessary to maintain operations following a data event, data theft, and extortion.

However, each company might define these coverages differently, so reviewing the terms and conditions of a particular policy is crucial. Choosing an appropriate amount of insurance is difficult because there is no easy way to measure the exposure in advance.

Consultation with the organization’s technology department, insurance agent and insurance company might be helpful. Finally, all policies will carry a deductible; the organization should select a deductible level that it can afford to pay and that will provide it with a meaningful discount on the premium. Once management has a thorough understanding of the coverages various policies provide in relation to the organization’s exposures, it can fairly compare the costs of the policies and make an informed choice.

Computer networks are a necessary part of any organization’s environment today. Loss prevention and reduction techniques, coupled with sound insurance protection at a reasonable cost, will enable an organization to get through a cyber loss event.

According to a phishing study conducted by KnowBe4, employees in the insurance, manufacturing and technology industries click phishing emails or open infected attachments more than employees in other industries.However, no industry is immune to phishing attacks. Use several practical tips to protect your company from phishing attacks.

1. Recognize spam.

Emails designed to gather and steal information can be disguised to look like they originate from a legitimate company. Check every email carefully before you open it, and look for this and other signs of spam.

• Originate from an unrecognized sender.
• Ask for confirmation of personal, financial or banking information.
• Contain a sense of urgency.
• Threaten to contact the police or other organization if you don’t comply.

If you notice any of these signs, mark the email as spam and delete it.

2. Use secure websites.

Employers may need to order or pay for items online. In this case, they should only use secure websites to share personal or financial information. A lock icon on the browser status bar and https URL indicate that the site is secure.

3. Carefully update information via email.

Cybercriminals can practically duplicate the look, logo and other details of a legitimate company as they attempt to steal data. Your employees should always verify that the email is from the right company before they submit personal, financial or other secure information. Even then, they should use caution since anyone can hack into email and access the sensitive data it contains.

4. Avoid clicking on certain links, files and attachments.

Links, files and attachments from unknown senders may contain a virus or spyware that can compromise your entire network. Remind employees not to click on email links, files or attachments from senders they do not know or are not expecting.

5. Beware of pop-ups.

Annoying pop-ups can also be a tool cybercriminals use to gather sensitive data. Legitimate companies do not gather information via a pop-up, so employees should not click on pop-ups, copy a pop-up’s web address into a browser or enter personal information into a pop-up screen.

6. Utilize IT security measures.

Your computer system should feature IT security, including a firewall, anti-virus and anti-spyware software, and spam filters. Update these measures regularly, and instruct your employees to keep them intact.

7. Hold frequent training.

Human forgetfulness and evolving phishing scams require you to host frequent cybersecurity training. It teaches your employees to recognize and avoid phishing scams and can dramatically decrease risks.

Phishing scams can harm your company now and into the future. In addition to purchasing cyber insurance, protect your company when you take these practical steps.

By 2019, the cybersecurity industry will face a deficit of over two million professionals. Whether your company needs a solid cybersecurity team or already has a great team in place, consider taking steps to fight this deficit and protect your business.

Detail the Threat

Incite current employees to enter the cybersecurity industry when you detail current threats, including phishing scams and cyber breaches. Employees who are aware of the threats may step up and seek further training so they can protect others.

Make Cybersecurity Everyone’s Job

Cyberbreach costs exceed $100 billion annually in the United States. Despite your cyber liability insurance policy, your company is not immune to breaches. Ensure that every employee understands the basics of privacy and security in their daily operations. With ongoing training, your team will be equipped to protect your company.

Recommend Schools that Align with National Cybersecurity Guidelines

The National Security Agency (NSA) and Department of Homeland Security (DHS) sponsor a program that supports cybersecurity education for all elementary to postgraduate students and aims to improve the number of trained cybersecurity professionals. Currently, 200 universities have earned the Centers of Academic Excellence in Cyber Defense (CAE-CD) status in the U.S. Highlight these schools as you encourage people to enter the cybersecurity field.

Encourage Hands-on Training

In addition to four-year degrees, a variety of hands-on certification programs also train students to handle cyber challenges. They include the Certified Information Systems Security Professional (CISSP), Systems Security Certified Practitioner (SSCP), Security+, Network+, GIAC Penetration Tester (GPEN), and Certified Ethical Hacker (CEH). The hands-on education means graduates are prepared to succeed as security specialists, security analysts or other security professionals immediately after graduation.

Introduce Practical Skills

A cybersecurity training program will include technical classes in risk management, data mining and statistical analysis. However, students must know other skills such as collaboration, conflict management, perseverance, and attention to detail. These practical skills provide a well-rounded education and enhance a student’s ability to succeed in the cybersecurity field.

Offer an Annual Scholarship or Tuition Reimbursement

Sometimes, finances prevent someone from pursuing a cybersecurity career. Reduce financial strain with a scholarship for current employees and their family members. You could also offer tuition reimbursement that allows employees to boost their current cybersecurity skills or pursue advanced training.

Allow Flexible Work Hours

If your employees express interest in pursuing cybersecurity training, give them a flexible work schedule. They can work a different shift, share duties with another employee or telecommute as they balance work and classes.

Your company can do its part to train new cybersecurity professionals. Take these steps so that more trained personnel can fight cybercrime and keep data safe.