- Know your enemy: As of Summer 2022, what are 5 sources/types of potential digital threats to your organization. Examples include external malicious actors or internal human error. Provide a thorough description and examples; be specific.
- Know yourself: Identify at least 5 digital processes, systems, and/or functions your company has in place. Importantly, address how could those be exploited or manipulated in order to gain access to valuable corporate or customer data?
- Develop your strategy: As the chief technology executive, make 5 recommendations that your company should adopt to be more safe, secure, and reliable. Again, consider hardware, software, networks, and human policies and procedures. (e.g., appropriate use policy on corporate computers; firewall; SSL/web encryption; backup/retention)
The types of digital threats I’ll be talking about are data breaches, malware, malware on mobile apps, phishing, and Trojans. The first is a data breach. A data breach is where information and data is stolen without the knowledge or consent of the owner. Things that can get stolen in a data breach are personal information, confidential information, customer information etc. Data breaches can lead to the downfall of small companies and damaging the reputations of bigger ones. A data breach that happened to a big company is Uber. The head of security got arrested because he was trying to hid a data breach from the FTC. The next threat is malware. Malware is software that hackers make to try and steal data, and destroy computer software and computers. Malware comes in the form of viruses, spyware, and trojans (a form of malware I’ll go into later). Mobile malware is malware specifically made to attack someone’s mobile device, like a phone and tablet. Mobile malware is less common then malware, but users can easily get viruses or unknow users on their phone when they connect to unprotected wifi. Types of mobile malware are RATS, Ransomware, and advertising click fraud. Phishing is where hackers will use an email or any other form of communication like texts to try and get a user to download malware onto their device. If a phishing is successful they can access you’re account information, credit card information, etc. They usually pretend to be a friend or a trustworthy looking company. The final threat is a type of malware that I think it hardest to spot. A trojan horse is a type of malware where it will disguise itself as helpful code/software. If a hacker gains access through a trojan horse they could gain access to data, export files etc. Trojan horses may also incorporate phishing and other tactics to make the user download the software.
Some processes and systems our company has in place for our data are storing data in files, multiple different storages (hard drive and backing it through the cloud), storing customer credit information though pci equipment, securing worker data, payroll data, and protecting company email. Our first styestem is storing data. For our data the company would have a hard drive with all the data, then have a third party to backup all the files in the cloud. The third party would be involved because they’re whole company goal is protecting, the data would be less likely to get hacked just because of that fact alone. This could be exploited because the company can’t keep track of everything that goes on with the third party. If something goes wrong all the data could be leaked. For the hard drive if someone loses it or someone takes it all the data would be taken as well. The next is specifically for customer credit card information. The company would use PCI approved items like mobile devices, payment processing software etc. We’d also stay on top of system updates and make sure to protect any audio recordings that might have credit card information stored into it. This could also be exploited if we don’t focus on audio enough someone could overhear someones information. Also if we don’t stay on top of updates it might be easier for hackers to get into our equipment. For workers personal information by keeping touch with human recourses and taking stock of how we get personal information, through calls, emails, flash drives etc. The company would only keep personal information if it’s necessary we wouldn’t keep any unnecessary information because that can cause risks we don’t need. Physical files and drives would be locked and files saved on a cloud would be locked behind a password that only few employees have access to and it would change every six months, or when we think some else might have access to it. This could be broken into if someone gives us an email that’s actually a phishing email/trojan. This could cause a lot of company information to leak out and worker info. The last one is specifically for worker payroll like all the other systems this one would be one where we have to file and keep track of our retail workers data. This would be social security card info, and banking information. This would mostly be physical files and things saved on the cloud. This could be broken into if files are misplaced or miscatorgarized, or through data breaches.
The final step is learning how to really protect ageist digital threats. Our protection would be advanced malware protection, falcon mobile for monitoring mobile malware, preventing trojans by not clicking unknow emails/links, spam filters for phishing and firewalls. For malware advanced protection allows the company to monitor multiple things at once like protection, detection and response. For example fast endpoint detection, retrospective security and contains any signs of suspicious activity as quickly as possible. Falcon mobile allows to get more information about possible threats. It allows us to detect jailbreak and rooted devices better. For trojan horses and phising the company will tell employees not to click or download any suspicious emails, only hit links with HTTPS and use spam filters for their emails. Finally the company would use firewalls to keep track of everything that comes in and out of our network. This will also only allow things that seem safe into our network.
Sources
“Data Breach.” Definition, www.trendmicro.com/vinfo/us/security/definition/data-breach. Accessed 9 Oct. 2022.
What Are Cyber Threats and What to Do About Them | Prey Blog. 16 June 2021, preyproject.com/blog/what-are-cyber-threats-how-they-affect-you-what-to-do-about-them
Newman, Lily Hay. “The Uber Data Breach Conviction Shows Security Execs What Not to Do.” WIRED, 7 Oct. 2022, www.wired.com/story/uber-joe-sullivan-conviction.
“What Is Malware?” Cisco, 6 June 2022, www.cisco.com/c/en/us/products/security/advanced-malware-protection/what-is-malware.html.
CrowdStrike. “What Is Mobile Malware? Types and Prevention Tips | CrowdStrike.” crowdstrike.com, 17 May 2022, www.crowdstrike.com/cybersecurity-101/malware/mobile-malware.
“What Is Phishing?” Cisco, 28 July 2022, www.cisco.com/c/en/us/products/security/email-security/what-is-phishing.html?dtid=osscdc000283.
CrowdStrike. “What Is a Trojan Horse? Trojan Malware Explained | CrowdStrike.” crowdstrike.com, 28 Sept. 2022, www.crowdstrike.com/cybersecurity-101/malware/trojans.
Just a Moment… rockcontent.com/blog/what-is-data-storage. Accessed 9 Oct. 2022.
GoCardless. “How to Store Credit Card Information Securely.” GoCardless, 19 Nov. 2021, gocardless.com/en-us/guides/posts/how-to-store-credit-card-information-securely.
“Protecting Personal Information: A Guide for Business.” Federal Trade Commission, 26 Apr. 2022, www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business.
The Risky Business of overlooking data privacy in Global Payroll. Understanding data privacy in global payroll | Safeguard Global. (2021, February 10). Retrieved October 9, 2022, from https://www.safeguardglobal.com/resources/articles/global-payroll-data
“What Is Advanced Malware Protection?” Cisco, 11 May 2022, www.cisco.com/c/en/us/products/security/advanced-malware-protection/index.html.
Freda, A. (2022, May 23). What is a firewall and why do you need one? Retrieved October 9, 2022, from https://www.avast.com/c-what-is-a-firewall#:~:text=A%20firewall%20is%20a%20digital,when%20connecting%20to%20the%20internet.