Cautionary Tales for SMBs from Hacked Water System

by

As you probably read or heard last week, the small city of Oldsmar, Florida, population 13,500, narrowly escaped a disaster from a cyber attack.

A hacker manipulated the Lye ratio in the water system of the city near Tampa using the remote access tools the city’s water department deploys to remotely manage the chemicals that make the city’s water safe to drink.

The story doesn’t tell us as much about the vulnerability of our nation’s critical utilities, however, as it does about what can happen when municipalities and businesses cut corners on the technology they use.

Oldsmar turned out to be fortunate in this case.

First, the hacker chose to access the system during working hours in full view of on-site staff, who immediately alerted their superiors to the attempts to drastically change the lye content in the water. Had the hacker attempted to do this after hours, the problem might not have been caught until the next morning.

Second, the water plant still remotely accesses the system with Windows 7 32-bit computers a year after Microsoft retired that operating system and declared it unsafe, but that was the least of the plant’s security transgressions.

The computers used to access the plant’s treatment control system shared the same password for remote access. In addition, all appeared to be directly connected to the Internet without a firewall.

Budget concerns justifiably come into play with cyber security measures at small municipalities, just as they do for small businesses.

But using different passwords, changing them from time to time, installing a firewall, and implementing multi-factor authentication offer low-cost protection that any organization can afford.

Another cost-effective measure would be cyber security awareness training for employees and management.

For information on what a security awareness training program can do for your business, visit https://threatucation.com, call me at 302-537-4198, or email me at ericm@threatucation.com.

Five Tips to Strengthen Security in Your Law Firm

by

No profession depends more on the confidentiality, integrity and availability of its data than law firms.

The information they collect forms the basis of all of their cases. Without it, they can’t represent their clients.

Because of the nature of that data, which includes PII, PHI, confidential and proprietary information, not to mention potentially embarrassing revelations, attorneys will be in the crosshairs of cyber criminals for the foreseeable future.

In fact, an analysis of public records by Law360 found that nearly 50 law firms reported data breaches in 2020 and that most were small and boutique firms. And that’s not all …

“There are probably many more attacks than what you’ve listed here. They just have not been documented in any official way,” said Claudia Rast, co-chair of the American Bar Association’s cyber security legal task force, to Law360.

The overwhelming majority of the 50 breaches (80%) was caused by human error or insider incidents.

To strengthen your firm’s security, consider the following five tips:

  • Secure Your Mobile Devices with Passcodes, Biometric fingerprint access, and Encryption
  • Create a culture of cyber security in your firm with policy-based Security Awareness Training
  • Watch Autocomplete in Emails to avoid inadvertently sending an email to the wrong person
  • Ensure remote devices and computers get the same protection at home and on the road as in the office
  • Consider multi-factor authentication on critical entry points to your network, such as computer logins, to prevent criminals from accessing it with a stolen user name and password caught up in a data breach that had nothing to do with your firm

New E-Book! SMB Resolutions for 2021

by

New Year Resolutions for SMBs

Small business owners and CEOs face a number of continuing challenges, and even though COVID-19 continues to hamper growth, increasing productivity and efficiency while holding off cyber attacks will continue to be the main issues they must deal with.

For that reason, our sister company, FlexITechs IT Services, has produced a new e-Book, “New Year Resolutions for Businesses”, that addresses the primary areas small businesses should focus on to improve security and securely increase productivity. Included are important measures all SMBs can take in 2021 to enhance their cyber security posture.

For your FREE copy, click this link and submit the form and you’ll also be enrolled in our monthly e-letter that provides advice and tips on a variety of small business IT topics.

SMBs Not too Small to Hack

by

A colossal data breach like the one of Solarwinds should serve as a reminder that small business owners, too, need to keep an eye on their cyber security measures.

While data breaches at small businesses don’t generate those kinds of headlines, they do cause pain in the affected SMBs including not only financial losses but also operational disruption and loss of time and reputation.

In the past year, 35 percent of small businesses who experienced a data breach either closed their doors or filed for bankruptcy,  according to a survey of 1,006 small business owners by the National Cyber Security Alliance.

Additionally, in a 2019 Ponemon Institute study, 66 percent of SMBs said they suffered a cyber attack in the previous year, 69 percent said an attack eluded their intrusion detection system, and 57 percent reported succumbing to Social Engineering attacks like phishing emails.

The fact is, you’re not too small to hack.

Cybercriminals continually tune the efficiency of their mass attacks on small organizations because they handle the same types of sensitive information as large enterprises but don’t have the sophisticated security measures that big companies deploy.

They have also learned to target specific small businesses because of the unique value of their data or because of their relationships with larger companies.

So, the need for SMBs to pay attention to their data’s security has never been greater.

But, just how do you protect your data without breaking your bank account?

In its Q1 2020 Wave Security Awareness and Training Solutions document, titled “Behavior and Culture Reign Supreme over Awareness and Punishment”, Forrester Research determined that the best security awareness training vendors aim to change negative employee behaviors by fostering a culture of cyber security within organizations.

Threatucation’s motto has always been “Creating a Culture of Cyber Security in Small Organizations”. We have long championed this approach over phishing email simulations designed to punish an employee with a bad score for succumbing to a phishing test.

While phishing simulations are part of Threatucation’s Cyber Security Awareness Training program, we really create a culture of Cyber Security with our unique policy-based approach that helps employees understand the reasoning behind the policies, the ramifications of violating them to the company, co-workers, customers and board members, and how to recognize and properly react to cyber attacks.

The whole process takes just 3 steps, starting with a Cyber Security Risk Assessment to ensure the security measures you ultimately choose to protect your business actually match your data security requirements.

For a free, no-obligation Cyber Security Risk Assessment for your business, contact us at info@threatucation.com or 302-537-4198.