6 signs your business may be about to have a data breach
Here’s some news that may keep you up tonight: More than 70 percent of cyber attacks target smaller businesses, resulting in a data breach and stolen data. And some 60 percent of hacked small and medium-sized businesses go out of business after six months. Add to this the recent news that the chips used in computers, phones and tablets all contain a major vulnerability flaw, and you’re facing a recipe for disaster. How can you protect against a data breach and, if one occurs, guard your company?
What are the six signs of an impending data breach?
1. You don’t have IT help and robust security software. It’s crucial in today’s cyber age to have someone, whether on staff or a consultant, to audit your risks, install software, monitor activity and ensure updates and patches are installed across the board. At the same time, it’s just as vital to subscribe to security applications such as those provided by McAfee or Norton. They’re inexpensive and run constantly in the background, checking for viruses, infected websites, malware and more. You need both: good security software AND IT help. It’s not an and/or.
2. Your employees are working from home and using their own devices. As your team works with company data on their smart phones, tablets or laptops from home, they represent a greater vulnerability, particularly if they use unprotected WiFi hotspots such as those at a coffee shop. And even if they work in the office, if you allow them to use their own devices at any time, this can create security issues. Why? Because typically, our personal devices aren’t as well-secured as those at our company. That means it’s a good idea to install remote management software to create a secured entry point. Your IT point person can help monitor those extra electronic devices.
Related: How to protect yourself against mobile ransomware
3. Your employees aren’t trained in detection. We all know not to click on that link from the Nigerian prince who’s offering us millions, but what about links or attachments in emails that look OK? It’s highly recommended to bring in your IT consultant a couple of times a year to train employees on the latest threats and how to detect them.
4. Your turnover is high. Disgruntled employees sometimes take sensitive data with them – sometimes by accident; sometimes on purpose. They know all your passwords as well. Careful hiring procedures and all you do to promote employee satisfaction can help you eliminate this weak link to your cyber security. It’s also a good idea to immediately change all commonly shared passwords when an employee leaves.
5. Some of your computers or operating systems are old. Frankly, the older your operating system on each computer, the more vulnerable that computer is. Just one older computer can be the weak link for a hacker to enter your system. The fix? Instruct your IT help to ensure all computers run the most recent versions of Windows or iOS, and updates are uploaded, pronto.
6. You have no system for securing data. When you handle health, financial and other personal information, it must be secured. Not only that, but you’ll need procedures and policies regarding safeguarding this data: Who has access? How is it locked down? Once you’ve determined your procedures, be sure to train employees on compliance and proper safeguards: If working at the office, never leave the computer screen or program open when you walk away from your desk; never let another client be able to see someone else’s information, etc. If working from home, turn off your computer every night; use a VPN for secure information; set up a two-factor authentication (logging into the website with correct credentials plus adding a code that’s texted to you); don’t use easy passwords and change them quarterly.
Adding another layer of cyber insecurity: working from home
In mid-April 2020, just a month after most companies’ employees began WFM, Reuters and Business Insurance noted that hacking activity against U.S. companies more than doubled in that time… and hasn’t let up yet. Even a robust IT security team has a harder time protecting data that’s dispersed on home computers. And VPNs aren’t necessarily bullet-proof, noted one cyber security expert.
In fact, VPNs bring with them a new set of problems. As more organizations launch VPNs for telework, more vulnerabilities are being discovered and targeted by cybercriminals.
Outside of the office, that protection can fall off sharply, allowing infected machines to communicate with the hackers. The corporate firewalls and security policies that once protected on-premises machines have been infected by viruses or targeted malware. Previously safe networks can be exposed.
All that to say, your protection, however robust it is, may not be adequate. That brings us to the next step.
Related: Help your retail clients prevent retail data breaches
Make a plan for when a breach occurs
While many businesses have the proper security in place to protect against a data breach – anti-virus, malware detection, fire walls and data encryption, they stop right there, assuming all the protection they need is in place. However, this only represents maybe five percent of a data breach threat, said Thomas Koulopoulos in an Inc.com article.
Your next step is to assume a breach will happen. Now what’s the plan? “It’s even more important to have a plan that details how you will respond in the face of a cyber attack that includes unknown threats,” he explained.
By far the most damage done in a hack attack or data breach is because the company didn’t have a response plan in place. Those 60 percent of small-to-medium businesses that were hacked never recover, largely because they didn’t understand how crucial it is to have an “after the data breach” plan in place.
“It’s like putting a guard at the front door to ward of bank robbers without giving him or her training on what to do in the event of an actual robbery,” Koulopoulos elaborated.
Related: Are you vulnerable to an insurance data breach?
What you need to include in a data breach plan
These steps are crucial to your plan, says Koulopoulos.
- A “fully redundant system for accessing their applications and data, both live and online, as well as regular offline backups stored in multiple onsite and offsite locations.” This helps protect you against ransomware.
- Cyber security training for employees. Make it detailed, make it ongoing, and make it high profile, showing that you consider it to be of utmost importance. Why? Because 95 percent of cyber attacks involve social engineering in some form – using people to voluntarily but unknowingly allow an attack to occur. It’s critical to train employees on how to avoid and recognize cyber threats.
- Follow up the training with regularly scheduled simulations. For instance, you can create a phishing email to employees with a link that allows you to track who clicked on it, or include an attachment and track how many open it.
Cyber experts agree: It’s much easier to hack a website than to protect a website. Hackers are constantly getting more adept at breaching the most secure sites. That means the security landscape is constantly changing: You may be secure today, but not next month. It pays to constantly be on guard, adding software updates, changing passwords, training employees and planning for a data breach that you hope never happens.
This article originally appeared on Arrowhead Tribal blogpost. It is reused with permission, and has been updated and modified to better fit the needs of ACM’s clients and insurance companies.