I am the IT supervisor of a small-to-medium-sized corporation, a gourmet food retailer with three stores, and an online e-commerce marketplace. We sell approximately $1 million in goods each year. We have more than 35,000 customers, 100 retail employees, and 35 corporate employees. At this scale, good security is imperative as so much is at stake.
I am the IT supervisor, and I have been tasked with managing cyber threats for my organization. I have researched our systems and the threats that put us at risk specifically.
The world of cyber threats is evolving. It has been a while since we have updated our security. Here is a list of 5 potential threats to our organizations that I am particularly concerned about, updated for the Summer of 2022.
*Acquiring Viruses via E-Mail
This is a very broad category, and every office knows to be careful with emails nowadays, but it is still relevant. Email phishing is one of the easiest methods for viruses to make their way into corporate computers, and the results can be disastrous.
Unfortunately for hackers, you can’t get a virus simply by opening an email anymore. However, viruses can be acquired simply by clicking a malicious link or opening an attachment. It is a simple but reliable method to secretly install malware on a computer. It would be so easy for someone to claim they purchased from us and require help, and attach a ‘reciept’ that covertly downloads a virus when accessed.
Another weakness is when our corporate email accounts get taken over. A third party using one of our corporate email accounts could easily send viruses to other emails and customers through the methods above and even infect them as well. Automated email takeovers such as these have caused massive damage to corporations in the past and even the entire web.
*Phishing Customers
This connects to the concerns about email security listed above, however with the focus on our customers.
Since the start of the company, we’ve always used Gmail email accounts with a very simple branding layout. The issue is that we haven’t bothered to get our own email domain. Apart from our own emails appearing sketchy, it would be so easy for sketchy individuals to create a basic Gmail account and mimic our formatting to phish our customers for info. They will pretend to be an employee and request customers of ours to give them sensitive data or get them to download malware.
This will damage our reputation and credibility as well as hurt our customers.
*DNS Hijacking
Domain Name System hijacking has recently become a more prevalent method of stealing data and causing inconvenience.
DNS hijacking is a blanket term, there being many different types all having to do with weaknesses in the Domain Name System. Some are more elaborate and damaging than others. They can have to do with malware or people accessing accounts and changing our domain settings [local DNS hijacking], DNS router hijacking [DNS routers tend to have weak passwords], or man-in-the-middle DNS hijacks.
In man-in-the-middle hijacks, attackers insert themselves inside the communication channel between a user and the DNS server. There, they can eavesdrop, alter messages, and redirect individuals to spoof websites to phish them.
Our DNS should be carefully monitored and protected, as a great deal of damage can be done when a third party tampers with it for their benefit.
*Account hacking
Brute force attacks target our online store’s admin panel, guessing our password by brute force. An algorithm will try to use every single password combination possible to get in. It is simple, slow, and honestly inefficient, but eventually, once someone gets in, they can do a lot of damage. They can lock us out of our own account by changing the password and username. Then, they can do anything they want with our store, like steal data and money from customers.
*Domain Name Spoofing
Our online e-commerce market has a considerable amount of traffic. We have over 35,000 customers. This is large enough for cybercriminals to try and spoof our domain name. They will create a site with a domain name as close to ours as possible so customers may accidentally end up there. On this mock website, they could be scammed or have viruses downloaded onto their computers instantaneously. It is troublesome and puts a lot of people at risk.
Many of our policies and systems are at risk or could put our organization at risk. Some of these are unavoidable, but it is good to examine the vulnerabilities in the functions we have in place. Here are five exploitable facets of our system.
*Emails
We rely heavily on email systems to communicate amongst ourselves and our customers. These emails and email addresses are weakly branded and hard to verify, leaving both employees and clients liable to email phishing attacks. Just a click on a malicious attachment or link could let malware into our system or the devices of our customers.
Email attacks are one of the number one methods to scam and phish online. We need to have our guard up.
*Digital Payment Methods
Our online marketplace allows shoppers to purchase goods using cards or an application like PayPal. This opens up so many levels of risk, opening opportunities for everything from spoof sites to DMS attacks to directly take cash from customers thinking they’re paying us. If someone took control of our account, they could funnel the money to themselves instead of us and perhaps even charge more, stealing extra money with the payment info gained. A man-in-the-middle could redirect users to a fake payment page mimicking ours.
*Personal computers for work
Employees are permitted to use their own personal computers and laptops to do work, such as from home, or on the go; or they can even bring them to the office if they so choose. But as it’s a personal computer, they’re also doing everything else one does on a personal computer outside of work. Opening emails, downloading things, using social media, and surfing the web. If they were to get a virus they would be letting a third party not only access all of their data but ours as well.
*In-store Wifi
Our three stores have publically usable wifi. If we don’t have the proper security steps taken, a hacker could infect the network, gaining access to every device on it. They could install malware, wreck customers’ devices, and enter the devices of the employees working at our store. It could possibly lead back to the company itself.
Rightfully so, we can face legal action against us if shabby network security leads to the infection and possible destruction of many customer devices.
*Our Office System
All of our office computers are on a shared network and they are all the same model and version. Each computer has the same liabilities, so a virus that can easily infect one can easily infect the rest. The shared network also poses a risk as all computers are essentially connected. If the wifi network gets hacked and infected it will spread to each computer in a flash.
To protect our data and the data of our clients, I have a few proposals to tweak our procedures and safeguard our technology. These five suggestions will not only reduce the risk of attacks succeeding but will also help to control the damage if an attack is successful.
*Cybersecurity Plan
We have no plan for what would happen in any one of the situations I have brought up. No plan means no preparations. We need to be ready to negate damage and fix things quickly, instead of flailing around and figuring out solutions on the spot. We need to know what to do in the occurrence of an attack.
A simple step plan could work. For example; if someone’s computer gets infected, all other office computers are to be powered off, and our internet connection is disconnected to stop the spread. Until the threat is recognized and dealt with, they will remain off. After that, all computers are to be scanned for the virus, and for a period of time after the attack, our network firewall would be stricter and more cautious than usual.
*Encrypt Data
We MUST begin to encrypt ALL important data. Businesses are expected to encrypt important data, and the law states that if we do not encrypt our data and the data gets out, we are liable to be sued for our poor security policy. If someone got into our system, our data is practically fresh for the taking, if they are not encrypted. This is an essential security step. Someone could hack into our systems and get to our data, but not be able to use any of it, since they cannot decrypt it.
*Make Our Emails More Verifiable
We need our own custom email domain. It’s too easy to mimic our email naming system. Instead of having the employeenamecompanyname@gmail.com system we currently have, it should be firstnamelastname@companyname.co. This way, customers and workers can verify that this is most likely a real employee, and not just some random email on a first name last name basis.
Alongside that, we should ‘complicate’ our branding. Our emails should have a recognizable footer and structuring that isn’t easy to mimic. It would be saved in our email settings so that every email sent is formatted in that way. This will discourage phishers and make it more complicated for them.
*Get a Better Antivirus
We must have quality and up-to-date antiviruses on our computers, even if it means we subscribe and pay monthly for one. The top antiviruses have options specialized for offices like ours. They have better, more up-to-date, and more often updated knowledge of the computer viruses that exist. They can do much more than the freebies we utilize currently, such as searching links and email attachments for viruses or sketchy behavior.
*Work Computers are for WORK ONLY
Some employees use the office computers as personal devices during breaks. They browse social media and download recreational applications such as video games. If they click a bad link or a bad file and get a virus, it could put all of the other computers at risk, and ultimately our company and customer data.
As cold as it seems, we should prohibit casual use of our office computers. It is better to be safe than sorry.
Resources VV
Continue reading →