The ‘Human’ Element to Cyber Breaches

Cyber breaches are more prevalent than ever before. We’ve all been there. An email comes through from Barry over on floor 2:

You look at it and think, oh fantastic we’re using Office 365 links to work on collaborative projects now, looks like our business has finally caught up with the game you mention to your colleague! You know Barry well and have worked with him for many years, so you have no reason to question what he’s sent you.

You click the link… you log in… the page times out and nothing happens. You reply to Barry letting him know the link didn’t work and get on with your day.

Initially nothing happens out of the ordinary. Around a week passes and you realise you’re starting to not receive emails that are being sent to you. You’re also getting a lot of people asking why you’re sending them links to websites. You’re not sending these emails so what are they on about?

Finally, it hits. IT puts the building in lockdown and removes access to all systems. The statement comes down from management. You’ve been hit, it’s ransomware and they’re estimating all the company data has been encrypted as have their backups.

Weeks pass and a ransomware remediation team enter the building regularly. They sit down with you. A good chunk of company data has been lost and they believe the breach has come from your mailbox. You give them all the information that you have and they explain the following to you.

When you thought you were emailing Barry you were actually emailing a hacker directly, that hacker had filtered your replies to a subfolder in Barry’s exposed mailbox that he wasn’t checking. When you clicked on the link and logged into your mailbox you actually gave up your password to a hacker. The hacker then got into your mailbox, set up similar rules and then started going through your organisation to see if they could fool an admin with the same trick, they did, that admin got breached, they gained remote access and then managed to get ransomware on all the company systems in the company.

It’s a scary thought isn’t it? It’s scarier to know that this is happening to businesses all the time.

---

Now let’s get some steps in place so Cyber breaches never happen to you.

MFA / 2FA

A true blessing of the modern age and soon to be enforced as standard by Microsoft 365. MFA/2FA stands for Multi Factor Authentication/2 Factor Authentication. It’s the code you get text through to you to sign into some accounts online, the code in your authenticator app or the push notification on your phone you accept to be able to log in.

So many businesses will not implement 2FA as a standard but it’s so very important. If the hacker that got Barry and targeted you had tried to log into your account, and it had 2FA on it they would likely have given up and tried to target someone else. That hacker is unable to get into your account without that second factor of authentication, due to the fact they’re likely in a completely different geographical location to you- that is an incredibly hard thing to do!

For the extra step and 10 seconds it takes to log in of a morning this is one of the most comprehensive ways you can secure yourself and your accounts against hackers. If you haven’t enabled it, enable it now or ask your IT support company to do it for you!

Question Everything

No matter how long you’ve known Barry, or how close you are, that still doesn’t mean you can implicitly trust emails that come from him. You should never be clicking on links or opening attachments in emails that you’re not expecting them to be in. Even at the point you are expecting an email you should still be following your internal process on allowed links and attachment, ensuring you report anything that you’re not 100% sure on to your IT support company.

People often think raising something with IT will cause irritation and waste their time. The truth is, I’d personally have 10 tickets raised with users being careful than none raised and a massive security breach. You’re never going to be in trouble for reporting something before or after an event and I feel like I speak for all dedicated IT support experts in echoing the sentiment we just want to know and as soon as possible.

That’s the take from this section, assume it’s malicious but treat it like it is until you can prove implicitly that it’s not.

Undergo Company-Wide Phishing Simulation

The idea of a phishing simulation isn’t to catch anyone out but instead to identify the members of your team that need cyber security training and hand it out accordingly wherever needed. A phishing simulation will send round an email to all your organisation with suspicious links in. It will then report back to your IT managers or your IT Support partner how many people clicked on those links enabling you to find potential vulnerabilities in your business and implement the correct procedures in place to protect yourself.

These are so important as honestly, you can avoid most cyber attacks with proper security in place and training amongst all staff.

Use a Password Manager

I’m going to make some assumptions… dangerous I know. You have one password that you use across multiple accounts, or at best maybe a couple of go to passwords. You use variations of the password adding numbers or an exclamation mark here or there to meet complexity requirements. Your password is built out of the following – A pet’s name, your child’s name, the day you met someone important to you, a significant date for you or a partner and maybe some part of an address.

If you do have multiple passwords you have them written down in a book somewhere or in your notes section on your phone tablet. Your phone password is your date of birth or the pin number to your bank card.

If I got any of this information right, take solace in the fact you’re like the majority of people. Most people use a combination of the previously mentioned ways to create and remember their passwords and the majority of people are very likely to be cyber attacked, they just haven’t been targeted yet.

An easy way around this is to use a password manager, we use Keeper in our business but there is a large variety of free to use password managers with paid subscriptions available too. A password manager is like a secret vault of all your important information, it will do things like auto-fill them for you across your PC, phone and tablet. It will also allow you to generate very secure long passwords which you don’t have to remember any more.

When you chose your password manager go through all your accounts and reset the password to strong auto-generated ones from your password manager. Also check to see if any of your accounts can have 2FA/MFA applied to them whilst you’re there!

So when considering Cyber breaches, what next?

Hopefully the steps above have been food for thought so you can start bolstering up your knowledge and security against a potential cyber attack. These steps will get you started but my biggest advice to you is to keep up to date with the latest recommendations in cyber security. We’ll keep you informed and up to date here but you should always do your own research when you have the time and inclination to do so.

If you feel like your business could benefit from a Cyber Security Audit click here

---

Corbel based in Ipswich, are IT Support and Cyber Security experts and work with business in Ipswich, Felixstowe, Colchester and the surrounding Suffolk area to optimize their IT and keep their data, systems and applications secure. Please contact info@corbel.co.uk or call 01473 241515