Preventing Cyber-Threats
As Chief Information Officer, I’m constantly looking for digital threats to my organization. These threats include but are not limited to Phishing, Malware, Ransomware, Trusted Insider Threats, and Data Exfiltration. According to the Computer Security Resource Center, NIST, Phishing is “A technique for attempting to acquire sensitive data, such as bank account numbers, through a fraudulent solicitation in email or on a website, in which the perpetrator masquerades as a legitimate business or reputable person.” Often, these phishing attacks go hand & hand with malware. Malware is a subtle technique that infects a given device using embedded emails or websites to spam and steal said device’s data. One of the most common forms of malware is Ransomware. An article by BDO Digital states, “Once the malware is in your system, it locks it up and denies you access to critical data until you pay a ransom to retrieve your sensitive information and regain control of your systems.” One possible source of these threats is a trusted insider. Trusted insider threats are digital threats from (typically disgruntled) former or current employees/associates with access to sensitive information. Lastly, Data Exfiltration is unauthorized data removal from personal and or business devices.
Admittedly, there are many ways in our company’s current digital processes can be exploited or manipulated. For instance, our corporate employees are given business devices with no protection software that typically go unmonitored. Currently, there is also no encryption in place for the business emails of any of our employees. Similarly, frequent business emails are sent to our employee’s unprotected emails. Our in-person stores only have community wifi with no password-protected private wifi for our staff. Lastly, as of now, our staff has no training on how to recognize and prevent cyber attacks.
To solve this, I intend to install a VPN on all devices used for business purposes. All company emails will be encrypted with a firewall and consistently monitored. Our systems should always be up to date and backed up. Starting now, Employees are to be educated on malware and how it enters computer systems to limit the margin of user error.