Know Your Business’s Weak Points

With the threat of online attacks increasing year over year, it’s vital that every business leader understand the weak points in their business. One of the weakest points lies in your email systems. Others include a lack of understanding of the threats businesses face and the technologies available to help them. Read on to learn more about weak points business leaders need to know and how learning more can save time, money, and even their livelihood.Email SecurityEmail is the single most significant attack vector in any business’s cybersecurity. This is a major attack vector for cybercriminals looking for a way into your networks and systems. Email is a high point of vulnerability for a couple of reasons.First, bad actors can use email in many ways to infiltrate systems. These include email spoofing, phishing, ransomware, and malware attacks. The other is user error. Employees don’t always have the proper training to avoid these threats, making them an easy target for hackers.According to Cisco, the most common forms of cyberattack include malware, phishing, man-in-the-middle (MitM) attacks, and denial-of-service (DoS) attacks. Malware is at the top of that list because it covers so many types of attacks including spyware, ransomware, viruses, and worms.MalwareMalware uses malicious software to conduct a breach by manipulating an insider, such as an employee, into clicking a dangerous link or email attachment. When a bad link is clicked or an infected attachment is opened, the malware makes its move to:

• Install harmful software or malware that can infect entire networks and systems.
• Block access to data, programs, etc., and hold it ransom (this is known as ransomware).
• Interrupt network components, completely disrupting business operations.
• Steal valuable information covertly.

PhishingPhishing emails are another threat that comes in the form of social engineering. For example, a cybercriminal might send a fraudulent email to you or one of your employees. It may appear to come from a reputable source you trust such as a vendor or business partner. Phishing is typically conducted through email but can also be done through text message (SMS).The goal of a phishing attack is to steal sensitive data such as credit card information or login information. Another goal of a phishing attack is to install malicious malware into the victim’s computer that can spread throughout their network. Cisco’s 2021 Cybersecurity Threat Trends report shows roughly 90 percent of data breaches occur due to phishing attacks, making it the most common method of attack.MitM AttacksORAM Corporate Advisors has also assisted clients with man-in-the-middle (MitM) attacks, or eavesdropping attacks. A MitM attack occurs when a bad actor inserts themselves into a two-party conversation, typically via email, that leads to a transaction that can be swiped. The attacker simply infiltrates an email system, monitors the traffic, and waits until they have the chance to intercept a large payoff.One ORAM client was using their email to book a trip valued at roughly $1 million. The client was working with their travel agent to arrange the trip and send payment. Little did the client know, that the travel agent’s email had been hacked. The attacker interrupted the flow of email traffic by intercepting communications from ORAM’s client to reroute the payment before the client or the travel agent even realized what was happening.In addition to stealing money, MitM attacks can also lead to the filtering and theft of information. There are two common points of entry for MitM attacks. The first is when you or your employees use unsecured public Wi-Fi to conduct business. Attackers can insert themselves between your device and the unsecured network. Without realizing it, you or your employees may be passing valuable data to an attacker when you use an unsecured public network to shop, send or receive emails, or conduct other business.The second way MitM hackers can access a network is through the use of malware. Once malicious malware breaches one device, it can install software to access all data on that device. In addition, it can spread to other devices within a network if it isn’t found and stopped quickly.DoS AttacksThis is another form of breach that comes through email. A denial-of-service attack will inundate a network, systems, and servers with traffic to overwhelm them and bring business to a screeching halt. A company’s digital resources are kept so busy with attack traffic that it eats up the bandwidth. This means a business’s computers, systems, and networks can no longer handle legitimate business requests.Bad actors can also use compromised devices to execute a distributed-denial-of-service (DDoS) attack. It works in the same way as one that comes through your email but it uses each infected device to continue to distribute bad traffic and tie up other devices on a network.Businesses Don’t Know What They Don’t KnowMost recently, ORAM is seeing that many businesses don’t know what they don’t know. Oftentimes, business leaders who are making decisions about information technology (IT) and cybersecurity for their organizations don’t know about the latest and greatest technologies available.Business leaders should write down their company’s goals and/or objectives, then speak with an IT professional such as ORAM about their technology needs to achieve their goals and meet objectives. This is very important not just because technology is always adapting, but the threat environment businesses face is also constantly changing. Every business needs a knowledgeable IT professional they can turn to such as ORAM. The old way of doing things may not be the most efficient or cost-effective method moving forward.What To DoFirst, ensure your email, apps, and systems are protected with strong passwords. Every login should be accessed with a unique password comprised of at least 10 letters, both uppercase and lowercase, as well as numerals and special characters. Use a password manager such as LastPass to manage all passwords in one place.Use multifactor authentication (MFA) whenever possible. This requires an extra step when logging into email, apps, or systems, but it is well worth it. In order to hack these accounts, a bad actor would need a user’s login and password as well as access to their mobile device and/or email.Training needs to be provided regularly for every employee. Cybersecurity training provided every three months to all staff will educate them about current threats, how to spot them, and how to avoid them. This includes the ability to recognize bad emails.Next, enroll in Dark Web monitoring for yourself and every employee. Such monitoring will notify a user when their personal information or passwords are found on the Dark Web so they can take steps to secure their data. It buys them time to change passwords that are compromised before a breach can occur and/or better secure their personal information.Finally, identify business goals and objectives on a quarterly basis then consult with their IT professional. This will help a business stay abreast of technology that can best achieve its goals with strong cybersecurity while saving money so it gets a top return on investment for its money.Contact ORAM Corporate Advisors for more information about knowing your business’s weak points, the latest technologies to support your business goals, and cybersecurity to protect your organization. Simply call (617) 933-5060 or visit ORAM online.