5 Steps To Prevent Cybercrime
You may believe that cybercrime only happens to large corporations or big businesses. However, Scott Augenbaum, retired FBI special supervisory agent, found that there are four commonalities of instances with victims. To help keep yourself off the victim list, here are five simple steps to help prevent cybercrime in your personal life and your business.
You may believe that cybercrime only happens to large corporations or big businesses. However, Scott Augenbaum, retired FBI special supervisory agent, found that there are four commonalities of instances with victims. To help keep yourself off the victim list, here are five simple steps to help prevent cybercrime in your personal life and your business.
Photo by Andrea Piacquadio: https://www.pexels.com/photo/smiling-formal-male-with-laptop-chatting-via-phone-3760263/
5 STEPS TO PREVENT CYBERCRIME
STOP USING THE SAME PASSWORD FOR EVERYTHING
If you do nothing else, stop using the same password for everything, or for more than one thing. Using the same password for different accounts just hands over your password to the bad guys. Fact: Compromised credentials are used in more than 40% of data breaches. Almost all of those credentials came from other hacks where the criminals pulled down huge lists of usernames, usually email addresses, and passwords. If you use the same password for LinkedIn and your business email, and Mr. and Mrs. Criminal got a copy of the LinkedIn user database (and this has happened multiple times)… now they have access to your email. Yes, it’s that simple. Read this article from LastPass for more details on the risks: https://blog.lastpass.com/2021/09/breaking-the-cycle-of-password-reuse/
ENABLE MULTI-FACTOR AUTHENTICATION (MFA) ON AS MANY ACCOUNTS AS POSSIBLE
Enable MFA on as many accounts as possible, especially your business email account. According to Microsoft, 99.9% of BEC, Business Email Compromise instances would have been prevented if MFA was in use. The majority of cases we have been involved with didn’t have MFA enabled. It’s such a simple precaution and acts as a safety net for your passwords that do leak out.
LEARN TO RECOGNIZE PHISHING AND SOCIAL ENGINEERING SCAMS
Educating yourself and your business on these most common threats will really decrease the risk of falling victim to a phishing email. All data breach events were the result of one of two things: (A) Someone did something they should not have done, such as clicking that link in the phishing email, or using the same password multiple places, or (B) Someone didn’t do something they should have, such as updating software to close a vulnerability.
USE A PASSWORD MANAGER
Supporting bullet point #1, use a password manager to handle all of your good, secure, unique passwords.
GET CYBER INSURANCE FOR YOUR BUSINESS
Get an appropriate Cyber Insurance policy for your business. Every business should have coverage because you never know what can happen.
WILL THESE TIPS WORK?
I will guarantee you this: If you take this advice and diligently follow these 5 strategies, you will greatly reduce your risks of falling victim to all manner of cybercrime in your business or personal lives.
IS THIS ALL I NEED TO DO TO PROTECT MYSELF OR MY BUSINESS?
No. But without these foundational security strategies in place, spending all manner of money on fancy cyber tools, BCP/DR services, Intrusion Detection Systems and all the fancy buzzwords in the cyber security space, won’t yield the results you expect.
LEADING CAUSE OF CYBERCRIME
Every single breach that RealTime has been consulted on was the result of failings in these subjects. The highest leading cause of cybercrime was successful phishing attempts which provide criminals access to their business data and communications. The second leading cause was poor password hygiene, usually in the form of using the same passwords everywhere.
What are four things victims of cybercrime have in common? Read now!
4 Things Victims of Cybercrime Have in Common
Scott Augenbaum, is a retired FBI Special Supervisory Agent, author, and keynote speaker specializing in cybercrime investigations. Scott shared his experiences this week of working with the victims of cybercrime over the past 20+ years, from huge multinational businesses to mom-and-pop retail shops. These are the four things that cybercrime victims have in common.
Scott Augenbaum, retired FBI Special Supervisory Agent
Scott Augenbaum, is a retired FBI Special Supervisory Agent, author, and keynote speaker specializing in cybercrime investigations. Scott shared his experiences this week of working with the victims of cybercrime over the past 20+ years, from huge multinational businesses to mom-and-pop retail shops. These are the four things that cybercrime victims have in common.
No victim ever expected it to happen.
Once the bad guys break in and steal your data, the chances of Law Enforcement fixing it are about ZERO.
The bad guys won’t go to jail.
Most victims could have prevented the attack.
NO ONE EVER EXPECTS IT TO HAPPEN
Quite common and really, who expects to become a victim of crime anyway? In the online world, you are a target, usually of opportunity. We all receive phishing emails, sometimes dozens a day, so logically we’re all aware of this attack vector. Everyone should realize that a cyber event that causes data loss and service interruptions, regardless of how large or small our companies are is probable depending on your industry. While we only hear about the big guys getting breached like Target, Colonial Pipeline, Maersk, Experian, Sony, etc., understand that for every one of these headline grabbers, there are hundreds or thousands of small businesses getting successfully breached that we never hear about. If we understand that the bad guys are always looking for victims, we should admit that it’s at least a possibility and take positive steps to reduce our risks.
LAW ENFORCEMENT CANNOT FIX IT
Law enforcement cannot fix it after it happens. It’s the nature of cybercrime – most people/businesses don’t know they have become a victim until after it’s happened. No one can turn the clock back on an attack unless you planned ahead with solid, tested backups and recovery processes, practiced how your business would respond to various cyber events, and took steps to reduce the likelihood of a successful attack. This doesn’t mean don’t notify law enforcement, there are financial crimes that need to be reported immediately in order to have a chance of recovering a fraudulent transfer, for example, but that is outside the scope of this article. Your IR (Incident Response Plans) should outline your plans based on the type of cyber security event experienced.
THE BAD GUYS WILL NOT GO TO JAIL
Due to the international nature of cybercrime, it’s very rare for someone to be held accountable for a crime. Even if they do get caught, the likelihood of you being made whole because of this is next to zero.
MOST VICTIMS COULD HAVE PREVENTED THE ATTACK
With simple preventative measures, you can reduce the likelihood of becoming a victim.
ABOUT SCOTT AUGENBAUM
After joining the Federal Bureau of Investigation (FBI) in the New York Field Office in 1988 as a support employee, Scott Augenbaum became a Special Agent in 1994 and was assigned to the Syracuse, New York Office, where he worked domestic terrorism, white collar and hate crimes, and all computer crime investigations. Author of the Book: The Secret to Cybersecurity: A Simple Plan to Protect Your Family and Business From Cybercrime
Interested in Five Simple Steps to Prevent a Cyberattack? Read our tips now.
A Parent's Guide to Online Safety for Children
There is a lot of information about online safety for families on the internet. In this blog, we discuss seven major areas of concern for parents as well as two major steps to help protect your children online.
ONLINE SAFETY FOR FAMILIES
by Todd Swartzman, RealTime Chief Information Security Officer
image courtesy of ron lach
I have been asked multiple times recently about this very subject, to the point that I feel like I need to research and understand this subject much better from a parental perspective. There is a ton of information out there on the subject, but so far nothing that covers it all.
MAJOR AREAS OF CONCERN
When it comes to online safety, these are the top seven significant areas of concern for parents in regard to their children’s safety:
Social media and the manipulations these platforms engage in online.
Bullying online will typically occur on social media platforms.
Recognizing scams and threats and knowing what actions to take (or things to not do).
Objectionable materials online - websites, videos, ads, pictures, etc.
Are kids communicating with older kids or even adults on social media, in games, email, texts, or in apps?
Texting or sexting…I know this is a cringy topic, but it is necessary.
How do I as a parent monitor/manage/protect my child online and on their phones?
STEPS TO PROTECT YOUR FAMILY
STEP ONE: CONTROL ITEMS IN YOUR HOME
The first step is to better control what things are in your home and what children can access using them. These steps can cost you nothing but maybe 30-45 minutes of your time and are foundational to having a safer experience. Here are four simple steps to reduce some of the risks for your family:
AV and Firewall on your computer.
This is easy for Windows 10 and newer and better than just about any free antivirus you might try and use. Just use the built-in Windows Defender and Windows Firewall with the default settings. Your internet provider most likely gives you a commercial AV product if you just hunt it down on their website.
Spectrum: https://www.spectrum.net/support/internet/security-suite-windows-installation
Comcast: https://www.xfinity.com/support/articles/downloading-the-norton-security-suite?view=app
CenturyLink: https://www.centurylink.com/home/help/internet/security/mcafee.html
Turn on automatic updates and let the computer install them automatically.
This might cause a problem when a bad patch is released, but that is very rare, and it is better to be up-to-date. You can choose to manually install patches, but you would physically need to do it. This applies to the operating system and any applications you have installed.
Use a DNS Filter.
There are a few providers worth a look, all have set up guidance on their websites, and these generally work by changing what DNS servers your home router uses.
Cloudflare - https://blog.cloudflare.com/introducing-1-1-1-1-for-families/ This one is pretty slick in that they have a few options – We like that choosing different DNS servers provides different filters to include blocking of malware and adult content.
OpenDNS – The original with 4 flavors for home users - https://www.opendns.com/home-internet-security/
CleanBrowsing - We had never heard of this one before, but it looks like it ticks more boxes than a DNS filter.
If you have a Windows 10 or 11 computer, there are parental controls built-in, outlined in this article by Microsoft: https://news.microsoft.com/en-in/features/windows-10-parental-controls-feature/
Please understand that none of these recommendations are 100% foolproof, rather they all play a part in reducing the likelihood of problems.
Finally, if you need to backup anything important that you store on your home computer, you can choose to store important stuff in the cloud in a place like Google Docs/Photos or Microsoft One Drive. Using these cloud storage services doesn’t guarantee that you will never experience something going wrong, after all, these are free services. If it’s important, keep at least 2 copies of anything important, one of those offline.
STEP TWO: EDUCATION
Now that we have the foundations in step one set up, let’s train ourselves and our kids on some online safety concepts.
Be Internet Awesome Learning.
Google has “Be Internet Awesome”, an online portal where anyone can interactively learn and apply simple concepts to improve their families’ awareness of potential problems and learn how to respond appropriately in various situations online. This is a simple way to teach your family about some of the problems online and how to respond to them.
Social Media awareness.
The Social Dilemma film, https://www.thesocialdilemma.com/ is a documentary/drama presentation of how social media, search engines, and the like operate under the hood. It’s sometimes a bit overly dramatic, but the central themes are accurate. I am recommending that parents and teens watch this together to understand better the playing field.
Stay tuned for part two where we address monitoring online activities and how to keep up with what is happening on smartphones!
###
REALTIME IT SUCCESSFULLY LAUNCHES HIGH SCHOOL TECH CO-OP PROGRAM
RealTime, LLC is proud to announce the successful launch of the RealTime IT Co-Op Program. RealTime has partnered with Dothan City Schools (DCS) to provide a hands-on learning experience for high school students in their junior/senior year(s) of high school.
June 29, 2022, Dothan, Alabama – RealTime, LLC is proud to announce the successful launch of the RealTime IT Co-Op Program. RealTime has partnered with Dothan City Schools (DCS) to provide a hands-on learning experience for high school students in their junior/senior year(s) of high school.
Pictured: (L to R) Tommy Price, Field Services Manager; Jayden McCory, DCS Student Intern; Brian Lapham, Director of IT Operations.
“This Co-Op experience is invaluable to any young person interested in working in the Information Technology field,” said Deidre Frith, Director of Marketing and Culture. “We created this program for high school students who have exhibited qualities that lend themselves to being tech-savvy as well as holding a deeper interest in tech as a potential career. This Co-Op is hands-on for the student but more importantly, connects them with a mentor. Being shown the ropes at such a young age can change the trajectory of their career path.”
Jayden McCory, an incoming DCS junior and student of Mr. Rodney McCloud, was selected as the first RealTime IT Co-Op student and began working with RealTime on June 14, 2022, in the Field Services Department under Tommy Price, RealTime Field Services Manager.
“Jayden is doing great,” said Price. “He has had the opportunity to do everything from off-boarding PCs to setting up new PCs, and he has been onsite with our Field Tech, Jared, visiting several clients. I mean, he has gotten exposed to a lot of different things; he learns very quickly and is doing great.”
During the RealTime IT Co-Op, McCory will learn and develop trade skills focused on IT Field Services and receive extensive on-the-job training while being immersed in the day-to-day operations. McCory has been learning how to coordinate with clients on repairs, set up and install PCs for client deployments, and the process to escalate issues to the necessary department. The exciting aspect of this Co-Op is that McCory is being mentored by an experienced Field Services tech while he conducts client-onsite visits for networking, installations, and other tickets that may be assigned on a normal business day. McCory will continue the RealTime IT Co-Op during the 2022-2023 school year while attending Dothan High School.
STUDENT SELECTION PROCESS
During the 2021-2022 school year, Frith, along with Director of IT Operations, Brian Lapham, visited several different classes at Dothan High School to promote the RealTime Co-Op program thanks to the partnership with Ryan Richards, DCS Central Office Coordinator for Workforce Development. Students were asked to submit a letter explaining their interest in IT as a career. All students who applied were then offered in-person interviews with Lapham. Offering students the opportunity of a physical interview for the position allowed everyone, even those not hired, the opportunity to gain real-life experience from this program. Each student was able to learn what the interview process felt like in a real-world setting. RealTime had five submissions from interested DCS students who were contacted for interviews. Three candidates participated in the interview process and ultimately McCory was selected as the best candidate for the position.
RealTime plans to continue growing the program and expanding it to other surrounding school systems in the Wiregrass. The RealTime IT High School Co-Op is a valuable learning opportunity as well as a paid, part-time position that begins in the summer and continues through the next school year. If you are interested in having your school participate in the RealTime IT Co-Op program, please contact Deidre Frith at dfrith@realtime-it.com.
ABOUT REALTIME LLC
RealTime LLC provides fully managed Information Technology services for businesses in the Wiregrass area and beyond that include business continuity and disaster recovery planning, cyber security protection, HIPAA compliance, threat prevention, private cloud backup, and more. RealTime has been providing elite IT managed services to the Wiregrass area since 2000. For more information about RealTime IT, visit www.realtime-it.com.
RealTime LLC also provides Revenue Cycle Management for a broad range of specialties in the medical field including Hematology, Oncology, Chemotherapy, Mental Health, Hospitalist, OB/GYN, Ophthalmology, Optometry, Family Care, Pain Management, Pediatrics, Rheumatology, Internal Medicine, Wound Care, Chiropractic, Cardiology, Aviation Medicine, Otolaryngology, Plastic Surgery, Allergy Medicine, Dental, Reference Lab, Speech, Physical Therapy, General Surgery, Outpatient Surgery, Neuro Surgery, and Cardio-Thoracic Surgery. For more information about RealTime RCM, visit www.realtime-medical.com
###
DON’T FREAK OUT - JUST use MFA
Are you a business who is looking at a cyber insurance policy and just not ready to commit? Or, perhaps you haven’t renewed your cyber insurance policy recently? Read on, because this article is written just for you…
Requirements to get a policy are real! If you apply for a policy (or renew your policy) the following are hard requirements you need to have in place if you want to be covered. Don’t risk getting a ‘no’ from your insurance provider, be prepared starting with Multi Factor Authentication (MFA).
Cyber Insurance Prep for 2022
Are you a business who is looking at a cyber insurance policy and just not ready to commit?
Or, perhaps you haven’t renewed your cyber insurance policy recently?
Read on, because this article is written just for you…
RATES ARE GOING UP
No surprise that rates are going up especially since we’ve been seeing SMB rates for cyber insurance rise as much as 100% or more. The reason this is happening is because some insurers are taking unacceptable losses and are raising rates accordingly. Other insurers are not renewing or offering new cyber insurance policies going forward. A few are “pausing” writing new policies, probably trying to decide if they can weather the storm.
MFA TO HELP AVOID COVERAGE REJECTION
Requirements to get a policy are real! If you apply for a policy (or renew your policy) the following are hard requirements you need to have in place if you want to be covered. Don’t risk getting a ‘no’ from your insurance provider, be prepared starting with Multi Factor Authentication (MFA).
MFA is required for the following:
Microsoft 365 or other Hosted email services
VPN users
When enabling your Remote Desktop Protocol
WHY DO THEY REQUIRE MFA?
The above three areas are where most cyber incidents being which is why insurers will not cover your business if you won’t take these very basic (and often no cost) precautions. These days, not following this type of guidance is akin to inviting the bad guys in. Your business is NOT too small for the bad guys. They have an automated process which makes everyone a target, large or small.
WANT TO HEAR SOMETHING SCARY?
We received notice from our dark web monitor just yesterday that a client account was up for sale due to a phishing scam – this person’s email account credentials were up for sale and it was a current password! I logged in using the info the bad guys had, and lo and behold, someone from Russia was logged into the account too. Yikes! There was a 99.9% chance that this would not have happened if MFA was in use.
ON AVERAGE, 1.2 MILLION MICROSOFT
ACCOUNTS ARE COMPROMISED MONTHLY.
WHEW! CHECKLIST
1. Enable MFA for everyone using Microsoft 365, G-Suite, etc. and enforce this.
2. If you allow direct RDP access to computers and servers in your office, you really need to turn this off and pick a more secure method of remote access.
3. If you use VPN’s for remote access, enforce MFA usage.
4. Train your folks to recognize social engineering attempts and phishing (the most common form of social engineering we see) attempts along with clear guidance on what they should do when (not if) they encounter these situations.
5. Shore up your password policies. Require long, unique credentials for everything, backed up by MFA where possible. No password reuse either – it’s just inviting problems. Then, use a password manager to easily keep up with your good, unique passwords.
References