A NonTechnical Cybersecurity Primer for Small Businesses Cybersecurity

A Non-Technical Cybersecurity Primer for Small Businesses

Cybersecurity focuses on protecting computers, networks, programs, and data from unintended or unauthorized access, change, or destruction.

During a Senate hearing, top U. S. intelligence officials warned that cyber attacks and digital spying are the top threat to national security, eclipsing terrorism.

AVOID DETECTMALWARE DELETE

390, 000 malicious programs registered per day in 2016 by AV-Test Institute https: //www. av-test. org/en/ Only 27% of organizations did not experience a security attack during the past 12 months. Osterman Research survey, Aug. 2016, http: //www. ostermanresearch. com/ 81% of phishing targets in 2016, were in the U. S. https: //www. phishlabs. com/ A BIG PROBLEM

RANSOMWARE ATTACKS 2015 - 3. 8 million 2016 - 638 million - Sonic. Wall GRID Threat Network 49 percent of businesses were hit by a ransomware attack in 2016. - Radware More than 4, 000 ransomware attacks occurred every day in 2016. - US Do. J A BIG PROBLEM

Social Engineering Changing Habits & Behavior

Top 5 reasons human error leads to security incidents 1. INCREASED SOCIAL MEDIA USE 2. UNDERSTANDING NEW THREATS 3. INERTIA 4. UNFAMILIAR WITH WEB & APP SECURITY 5. LACK OF PLANS, POLICIES & PROCEDURES Comp. TIA, 2015 Trends in Information Security

* Phishing * Spear Phishing * Whaling “The most devastating attacks by the most sophisticated attackers almost always begin with the simple act of spear-phishing” - Jeh Johnson, Homeland Security Secretary, November, 2016

“ 95% of all attacks on enterprise networks are the result of successful Alan Paller, SANS Institute spear https: //www. sans. org/ phishing. ” 30 percent of phishing messages were opened by their intended target - Verizon, 2016 Data Breach Investigation Report

EXAMPLES OF PHISHING EMAIL SUBJECT LINES q Invitation to connect on Linked. In q Undelivered Mail Returned to Sender q Online confirmation required q Mandatory Meeting q Invoice q Good News q Job Offer q Quote Request

PHISHING CLUES q Vague "From" Field/Subject Line q Strange "To: " List q Missing Salutation q Incorrect Names/Non. Existent Departments q Poor Grammar/Spelling q Generic/Strange Links Resource: https: //www. virustotal. com/

PHISHING CLUES

RAN$OMWARE

Bitcoins Commonly abbreviated BTC Untraceable Not tied to any government Access via TOR browsers and networks • Price constantly fluctuating • You can buy partial Bitcoins • •

Most ransoms start in the $100 -$500 range - miss the kidnapper’s deadline and it will probably increase to over $1000. Trend toward 5 - or 6 -figure ransoms targeting industries most likely to pay up, such as healthcare, government, critical infrastructure, education and small businesses.

. . . a few examples Los Angeles Valley College, January 2017 paid a public record of $28, 000 in Bitcoins to extortionists after ransomware encrypted hundreds of thousands of files held on its servers. Bournemouth University (UK) August 2015 to August 2016 suffered a ransomware infection, on average, every 17 days Hollywood Presbyterian Medical Center (Los Angeles), February 2016 Victimized by ransomware and paid $17, 000 (40 Bitcoin) to regain access to its files Med. Star Health, Washington, D. C. $19, 000 ransom paid April, 2016, Cybercriminals said they'll unlock the data for 45 Bitcoins, and they gave the hospital an option of paying 3 Bitcoins to unlock a single computer.

"Satan ransomware: old name, new business model" https: //nakedsecurity. sophos. com/2017/03/07/satan-ransomware-old-name-new-business-model/

WHAT TO DO IN A RANSOMWARE ATTACK source: http: //www. thewindowsclub. com/what-to-do-after-ransomware-attack 1. Remove computer from network 2. Copy the disk for analysis 3. Restore point 4. Format and clean reinstall 5. Boot in Safe Mode & run antivirus deep-scan 6. ID ransomware at https: //idransomware. malwarehunterteam. com/ 7. When identified, find an available decryptor tool 8. Do you pay the ransom? 9. Report to authorities

IBM Survey: 46% had ransomware attack 70% paid ransom 20% paid more than $40, 000 25% paid $20, 000 -$40, 000 11% paid $10, 000 -$20, 000 https: //nakedsecurity. sophos. com/2016/12/19/ransomware-payouts-heading-for-1 bn-a-year/

How to Stay Protected Against Ransomware https: //www. sophos. com/en-us/medialibrary/Gated%20 Assets/white%20 papers/sophosransomwareprotectionwpna. pdf? la=en

TRENDS 1 • More Mac OS X, Linux, mobile 2 • Internet of Things 3 • Expanded functionality Phish. Labs, 2017 PHISHING TRENDS & INTELLIGENCE REPORT https: //info. phishlabs. com/2017 -phishing-trends-and-intelligence-report-pti

http: //www. slate. com/blogs/future_tense/2016/12/28/ransomware_reported_on_smart_tv. html http: //fortune. com/2017/01/29/hackers-hijack-hotels-smart-locks/

WHY ARE CYBER CRIMINALS SO SUCCESSFUL? Software Tactics Email Oversharing Training Inexpensive

Small to Medium Businesses Are at Risk source: ESET INTERNET SECURITY http: //www. eset. com/ Enterprises Assets worth looting SMB “Sweet Spot” Consumers Level of protection The Retail/Service sector most-attacked category of victim, suffering 43% of phishing attacks in Q 3 - Anti-Phishing Working Group, 3 rd qtr. 2016 trends report, http: //www. apwg. org

“Visa estimates about 95 percent of the credit-card data breaches it discovers are on its smallest business customers. ” - U. S. Dept. of Homeland Security

Loss of revenue Loss of business Fines, lawsuits, headlines Unbudgeted expenses Breach approx. $190 per record exposed 5, 263 records = $1 million hit Source: eset internet security http: //www. eset. com/

ACT NOW.

BACKUP YOUR FILES X 2

https: //howsecureismypassword. net

https: //blog. keepersecurity. com/2017/01/13/most-common-passwords-of-2016 -research-study/ “Nearly 17% of users are safeguarding their accounts with ‘ 123456’. ” 2 FA “How to pick a proper password” https: //youtu. be/p. MPh. BEo. Vul. Q 2 -Factor Authentication Best free password managers https: //www. wired. com/2016/01/you-need-a-password-manager/

C U A O I T ! N Email address as a primary credential

39% of adults “password challenged” & reuse passwords across services Pew Research Center, 2017 http: //www. pewresearch. org/fact-tank/2017/01/26/many-password-challengedinternet-users-dont-take-steps-that-could-protect-their-data/ Check if you have an account that has been compromised in a data breach https: //haveibeenpwned. com

ATTACHMENTS • Tell Explorer to show file extensions. • Never open. exe files. • Open. JS files with Notepad. • Better yet, block all. js email attachments.

UPDATE ENCRYPT MOBILE SECURITY PASSCODE PUBLIC WIFI APPS LOCATE/ERASE BLUETOOTH DISPOSE Mobile Overlay Malware has the ability to lay screens over legitimate (e. g. banking) apps.

Commonly Overlooked Threats http: //jumpstart-hr. com/ • • Disgruntled employees Stolen/lost mobile phones and laptops Outdated software Lack of cyber security protocols Human error Working over public wifi Overconfidence regarding your susceptibility

PHYSICAL SECURITY

POISON TAP https: //samy. pl/poisontap/ Image: samy. pl

SEPARATE HOME & BUSINESS COMPUTERS

HAVE A PLAN “Security policy samples, templates and tools” - CSO Magazine http: //www. csoonline. com/article/3019126/security-policy-samples-templates-and-tools. html

Assess assets, risks & resources Further assess, audit, test Educate employees & vendors HAVE A Build your policy & choose controls Deploy controls

Do you need a threat intelligence strategy? 3 Types of Threat Intelligence 1. Tactical - Where on the network? (defenders) 2. Operational - Adversary-focused, internal/external info. gathering 3. Strategic - C-level risk & investment decisions

Train to prevent successful phishing. Train for what you’re going to do if you have a breach, or a suspected breach. Make the training scenarios as realistic as possible. Table Top Exercises (scripted scenarios) Hybrid (scripted plus real probes/scans) ONGOING STAFF TRAINING

https: //info. knowbe 4. com/phishing-security-test-eb

Free Cybersecurity Planning Resources for Small Businesses FCC Small Biz Cyber Planner 2. 0 https: //www. fcc. gov/cyberplanner Greater Houston Partnership, Cybersecurity Guide http: //www. houston. org/cybersecurity/pdf/Cyber%20 Security%20 Book_2015_small. pdf Health. IT. gov https: //www. healthit. gov/providers-professionals/cybersecurity-shared-responsibility National Cyber Security Alliance, Stay Safe Online https: //staysafeonline. org/ NIST, Cybersecurity Framework http: //nist. gov/cyberframework/ SANS Institute, Information Security Resources https: //www. sans. org/security-resources/ U. S. Department of Homeland Security, Stop. Think. Connect. https: //www. dhs. gov/publication/stopthinkconnect-small-business-resources U. S. Department of Homeland Security, US-CERT (United States Computer Emergency Readiness Team https: //www. us-cert. gov/ccubedvp/business

THANK YOU! John Hamerlinck jhamerlinck@clcmn. edu

This workforce product was funded by a grant awarded by the U. S. Department of Labor’s Employment and Training Administration. The product was created by the contracting agency and does not necessarily reflect the official position of the U. S. Department of Labor. The Department of Labor makes no guarantees, warranties, or assurances of any kind, express or implied, with respect to such information, including any information on linked sites and including, but not limited to, accuracy of the information or its completeness, timeliness, usefulness, adequacy, continued availability, or ownership. Central Lakes College does not discriminate on the basis of race, color, national origin, religion, age, or disability in the employment or provision of services. All non-logo images are public domain except where the appropriate CC license is noted. This work is licensed under a Creative Commons Attribution-Share. Alike 3. 0 United States License