Would You Know a Cyber Attack if You Saw One?

What is a Cyber Attack?

“I don’t know. But I will when one happens to me.”

Simply defining a cyber attack can be a challenge. It’s like trying to explain the shape of air, always changing. Crooks are incredibly creative these days and their operations are evolving. They are constantly inventing new ways of attacking your business. And cyber attacks are just that – an assault. They represent threats as real as a thief stealing from a cash register. Except the financial impact from a cyber loss is much greater.

So, let’s broaden our thinking on what a cyber attack may look like, because many of us hold an erroneously narrow view, founded upon a few high-profile stories prevalent in the news. However, a cyber attack can fall within any of the following broad categories:

• Loss of Customer Data: Hackers steal information and profit by selling it to other criminals.
• Loss of Employee Data: Even if you prudently guard customer data, most companies are required to maintain sensitive information on their employees as well. This can be social security numbers, payroll information, bank account numbers, health issues, and more.
• Breach of Company Secrets: Competition is fierce. Are your competitors engaging in corporate espionage and reading your email?
• Ransomware / Extortion: This occurs when a criminal gains access to your company’s server, website, or local computers, and blocks access. They then demand payment before releasing control. This is a common ploy and quite effective for a fast cash turn-around.
• Virus: In any one of their multitude of forms.
• Funds Transfer Fraud / Computer Fraud: This is a favorite among thieves due to the huge payouts possible. The ploy is to gain access to bank accounts utilizing one of several common strategies, and transferring money to an account they control. Strategies utilized to gain access information range from social engineering to good old-fashioned picking through your trash.
• Social Engineering: A broad category that is rocketing in popularity thanks to the creativity of the bad guys. They get an A+ for divergent thinking. At its core, this strategy is to use fraudulent email or other communications to trick an employee into taking a specific action. Popular schemes include monitoring network traffic, then mimicking legitimate emails and misleading employees to divulge sensitive information such as payment methods, bank account passwords, or to make a payment to a fraudulent vendor.
• Paper: Feeling nostalgic? Store your sensitive data in paper form? Any of the above can be accomplished by targeting important information on paper, many times with less effort.

It’s like trying to define the shape of air, always changing.”

Next we will explore what constitutes a loss of customer data, including who is responsible for the data’s safekeeping, whether the data owners or users or both. We will also address when a loss of data needs to be reported, and to whom.

Contact us for all your Insurance needs! (321)725-1620 

Bob Lancaster Insurance

                                                                        Serving Florida since 1964

'Tis the season for cyber attacks: 6 ways to protect against breaches

Online holiday sales in 2014 are estimated to rise between 8% and 11%, reaching as much as $105 billion, according to the National Retail Federation. Because shoppers are expected to do much of their holiday shopping online, this presents a heightened concern over cyber security.
Businesses should prepare against cyber attacks all year long, but they should be especially diligent during the holiday season when employees are at their busiest.

• Train employees to protect sensitive information. All employees—even seasonal ones—should learn the importance of protecting the information they regularly handle to help reduce exposure to the business. This includes everything from locking up customer records to keeping passwords strong and confidential. Employees should also be taught how to handle a breach if one occurs.
• Halt systems changes until the end of the year. Make sure your software and other technologies are running smoothly and avoid implementing new systems at this time. Of course, there may be exceptions to address critical new patches.
• Ensure systems have appropriate firewall and antivirus technology and that security software patches are updated in a timely fashion. After the appropriate software is in place, evaluate the security settings on software, browser and email programs. In doing so, select system options that will meet your business needs without increasing risk. Regularly maintaining security protections on your operating system is vital to them being effective over time.
• Monitor use of mobile devices and public Wi-Fi access for employees. Establish usage standards and be sure they are clearly communicated. For example, to avoid security breaches, employees should be instructed to use public Wi-Fi only in very limited circumstances. Hackers can easily intercept public Wi-Fi, so it is imperative that employees cautiously use the Internet and transmit information. To reiterate, any data that shouldn’t be made public, such as proprietary business or customer information or credit card numbers should not be transmitted or accessed through public Wi-Fi.
• Insure that your season is protected. Insurance coverage typically includes liability protection for when customers or other individuals who have been affected hold a company responsible for information stolen during data breaches or other network intrusions. A cyber policy can also include coverage for a forensic investigation, litigation and remediation expenses associated with the breach. In addition, a cyber program may include coverage for business interruption, which is critical during the holiday season.
• Have a plan in place to manage a data breach. If a breach occurs, there should be a clear protocol for which employee is managing the situation, and what action should be taken, such as informing the insurance provider, etc.