A cyber-criminal only needs to get lucky once. You have to stay ahead of them all day, every day

by | Jun 17, 2021 | Legal Firms, News, Security

“A cybercriminal only has to be lucky once, while a defender has to be lucky every minute of every day.”
Combating Ransomware – A Comprehensive Framework for Action: Key Recommendations from the Ransomware Task Force.

The message we hear from governance boards over and over is ‘can you prevent hackers from stealing our data?’ Every time there is a high-profile attack, the calls get louder. As cyber security attacks become more frequent, the awareness of this activity increases exponentially. 

The simple reality is that cyber-crime is now a mega-business. The cost and effort to combat cyber security threats grow all the time, and while nothing is guaranteed, there are things we can do to reduce your risk. 

It means stepping up our collective cyber security game. New tools, new processes and new staff awareness. The protections that seemed excessive a year ago now seem to be inadequate. We have to keep adding new tools and services so that you can select a level of protection that you are comfortable with, and like your insurance, you need to reassess this every year. 

What do you need to think about to protect your organisation?

1.  The biggest risk is people and processes.

We suggest making a representative group and mirroring the practice of a Health and Safety committee. Have a ‘Cyber Security’ committee that spends time thinking about how someone could accidentally give away confidential data – start by thinking about how your data is held, where it is held, if it is confidential, and who has access to it. Next up are simple things like credentials. For example, if a client calls up for anything, from a question to a password reset, how do you verify who they are before providing any confidential info. Inside the company and out, people are the biggest risk to cyber security, and the security of the information your company holds.

2.  We all know about malware and ransomware but…

Malware and ransomware typically get in through software bugs, and the best answer to this cyber security threat is to ensure everything is patched. Do you get regular reports to show that everything is patched or do you trust that it is done? “Everything” can be quite a long list but you can divide it up by types of machines (servers, laptops etc). Patching isn’t just for Microsoft tools, but everything that you use – Adobe, Google, and so on. Digital security is crucial across your network, even on mobile devices.

3.  We’re all aware of antivirus but today we need to go further.

A good level of cyber and information security requires a more intensive end-point protection and personal firewalls, even for computers that stay behind the corporate firewall. That’s because it’s surprisingly common for ‘guest’ machines to connect to networks, for example, to support visitors, and you simply don’t know what state their devices are in and what viruses they may introduce.

4.  Common attack vectors include “phishing”. The best defenses are:

    • ○ Regular phishing tests, to see how aware your colleagues are. 

      ○ Cyber Security briefings and awareness training to help everyone stay alert and support each other, both via eLearning and in-person presentations. Kinetics provides Cyber Security training in NZ 

      ○ URL scrubbing – testing the URLs people click on BEFORE the site opens to warn you before you inadvertently browse to potentially infected websites.

5.  The Darkweb!

It pays to be aware that some of your data is ALREADY on the darkweb. It will mostly be credential information scavenged from historical hacks of sites like Sony, LinkedIn, Marriott, and many others. Occasionally this will surface up to you as an email that states your account name, and password for a particular site, along with a threat, for example, “We know what you have been up to, pay a ransom or we will share this publicly”. If you recognise the username and password and it’s a common one that you use, then this threat can be very compelling. 

The best defense is to ensure everyone uses unique passwords for everything, and the best way to do that is with a secure password vault tool.

6.  Multi-factor authentication!

MFA isn’t infallible, but in conjunction with the items above, it’s a very important layer of cyber security. We regularly see compromise attempts on Office 365 in particular, and these are being defeated by simple steps like enforcing multi-factor authentication, and where possible, limiting logins to territories that people log in from. For example, unless you have people currently in eastern Europe, then you can simply block access from IP addresses from those countries. MFA should be on EVERYTHING, not just Office 365 but also the less common sites your people access.

7. Shadow IT Detection…!?

Looking at the first item on the list, you will be amazed at some of the tools in use by your people. It is extremely common for people to set up an account on an external website, or install an extension to get a job done. They often just use their email address and make up a password. That means that if they leave your organisation, they can still log in with the email address – the webtool doesn’t know they’ve left! Even worse, you don’t know how secure the tool is, and often you don’t even know about the tool at all! Shadow IT can hugely compromise the security of the data and information your organisation holds on to.

8.  Microsoft have baked some excellent protections into Microsoft 365.  Are you using them?

Microsoft has for example, ‘data leak protection’ to help set up a regime where Office 365 can detect confidential data (eg credit card numbers, health records, and so on) and then permit or prevent certain actions – for example preventing emailing a spreadsheet with more than say 5 of these records on it, or at least warning you before you do. It can also warn when it detects unusual behaviour such as copying or deleting large numbers of files. The trick is that this needs to be turned on, configured, and, above all, maintained and monitored.

9.  Consider vulnerability scanning on a regular basis.

Vulnerability scans are based around CVE (Common Vulnerability and Exposures) and CVSS (Common Vulnerability Scoring System) and are maintained by First.org, a global forum for response and cyber security teams. CVE’s can describe vulnerabilities in software on any connected device, from baby monitors to virtual appliances, CVE’s can be found everywhere and anywhere. A deep vulnerability scan is intensive. In addition to scanning devices, it will attempt to use common login and passwords to brute-force hack devices.

CLICK HERE to find out how you can step up your security game with one of Kinetics Cyber Security Service plans.

Read some of the latest news on Cyber-Security

Free resource: Business Cloud Security Checklist

Free resource: Business Cloud Security Checklist

Essential Business Cloud Security Checklist for 2024 In today’s digital age, securing your business’s cloud environment is more critical than ever. With cyber threats evolving rapidly, it’s essential to have a robust cloud security strategy. Here’s a checklist to help...

When not being able to access a website is a good thing.

When not being able to access a website is a good thing.

We know it can be incredibly frustrating when you can’t access a website that you need.  That happened for a number of a number of our clients last week, (and, counter-intuitively, it’s a good thing) Many websites are built on common components.  One of those is...

TeamViewer Compromise

TeamViewer Compromise

TeamViewer is a common piece for software that allows IT businesses to remotely access, control, manage, monitor, and repair devices – from laptops and mobile phones to industrial machines and robots. Many software vendors include it to allow them to remotely support...

Cert NZ Business online security assessment tool

Cert NZ Business online security assessment tool

A Personal Encounter with Cert NZ's Assessment Tool. Have you recently received an email about cyber-security that set off your system's alarms? It's ironic isn't it? That was my recent experience with an email from Cert NZ. Despite the initial warning, the email...

Avoid the IT Travel Woes

Avoid the IT Travel Woes

Free Webinar Replay : Avoid the IT Travel WoesBusiness travel is fraught enough.  It's a nightmare to balance tight connections, and tough time zones with work colleagues that are accustomed to being able to link you into Teams meetings and urgent chats.How can you...

Lessons from the Change Healthcare attack. Why MFA Matters

Lessons from the Change Healthcare attack. Why MFA Matters

By now, regular readers know how important MFA is. Unbelievably, there are still some people who think this is for someone else, and they don't need it themselves.   Unfortunately, we are seeing some of these people fall victim to the very scams we've been writing...

What happened when we got told we’d been hacked?

What happened when we got told we’d been hacked?

“We’ve been hacked”. When you hear that the world stops. What does this mean? How bad is it? How can we manage that?  That was the news earlier this week. It was quite confronting! Suddenly your careful plans for the day are thrown aside as your priorities have...

Can VPNs be defeated?

Can VPNs be defeated?

We’re reading about a flaw called ‘TunnelVision’ that could give hackers access to overcome virtually any VPN security solutions. It works by manipulating routing in DHCP, which is the mechanism networks use to hand out IP addresses to devices.  DHCP has been around...

Will some of your emails stop?

Will some of your emails stop?

Microsoft Exchange Online to retire Basic authentication We are going to face a big change coming in September 2025, Microsoft is going to be disabling SMTP Basic Authentication. This continues work they commenced a couple years ago to disable other protocols such as...

How to create passwords that hackers hate

How to create passwords that hackers hate

A guide to making your online accounts more secure and less boring Have you ever used your birthday, your pet's name, or the word "password" as your password? If so, you're not alone. According to a study by NordPass, these are some of the most common and worst...