5 IT Risks That You’re Exposing Your Business To
In the 22 years that Connetic has been performing cybersecurity audits, we have built a very mature cybersecurity audit and incident-handling practice. Our capability in finding every security vulnerability that affects a company provides transparency into what our customers need to fix in their environments. This dramatically reduces the risk of costly losses associated with a data breach. Statistically, 60% of small businesses that suffer from a cyber-attack go out of business within six months.
In the audits we’ve run over the past two decades, we’ve routinely seen five typical failures that affect most small businesses, dramatically raising their risk of a data breach.
Spear Phishing and Email Forgery
Problem
This is the most widespread incident we see affecting small businesses, and it’s usually the most costly too. An entire economy exists in breaking into cloud email services (especially Microsoft 365) and then forging emails to vendors and business partners which discuss re-directing wire payments to fraudsters by convincing Accounts Payables staff to change wire instructions for existing payments.
Solution
The solutions to this problem are Multi-Factor Authentication (MFA) on those email accounts, spear-phishing resistance training for employees, and two-person verification of all wire-transfers and wire change instructions.
Poor Credential Handling
Problem
Employees often re-use the same password across multiple web services—and they often use the same password for their work systems. Combined with the fact that most web service usernames are their work email addresses, attackers can recover the username and password for your systems from websites your employees use.
Solution
The solutions are MFA and training employees never to use their work passwords elsewhere.
Unmonitored Systems and Cloud Services
Problem
If an attacker broke into your network or cloud services and started stealing data, how would you know? The answer is you wouldn’t – unless you had both comprehensive security monitoring configured and a 24×7 Security Operations Center, or SOC, reacting to alerts. It’s shocking how often attacks go completely unnoticed, even at very large companies, until stolen data shows up for sale on the dark web.
Solution
The solutions are configuring log aggregation and monitoring using tools like Splunk or Elastic Stack and engaging with an SOC that can put human eyes on these consoles to see attacks in real-time. These solutions can be expensive for small businesses to attempt on their own, so most outsource this critical security function to dedicated managed security services providers.
Bring Your Own Device (Malware Included!)
Problem
Employees working from home and on their own devices invite computers that your company does not control to connect directly to your critical infrastructure. What if those uncontrolled devices contain malware such as keyloggers that are recording and transmitting your employees’ account names and passwords directly to hackers? Well, hackers have an open door into your network at that point.
Solution
There are effective ways to managed BYOD policies, but they involve legal agreements with your employees to allow the company to install end-point management software that can keep those computers safe as if they were company assets. It’s often simpler to simply provide all your employees with all of the computing hardware they need to perform their jobs and disallow the use of any personally owned equipment.
Opaque Cybersecurity Configuration
Problem
How strong is your cybersecurity posture? How effective are your defenses against a data breach? If you’re like small business owners, you have no idea other than what your IT staff or providers are telling you, and it’s too late to do anything about it once a security incident occurs.
Solution
All businesses should engage with security audit providers to perform an independent 3rd party vulnerability assessment and access configuration audit that includes a clear summary of all vulnerabilities found along with recommendations for remediating them. Security audits have a cost, but it’s significantly less than the cost of a data breach.
How Connetic Can Help
The Connetic team has the unique training, knowledge, and expertise necessary to ameliorate risks by implementing security through comprehensive security audit practices, security framework compliance, and the comprehensive implementation of security solutions. Contact Connetic’s IT services team to set up a security audit today.
