It was another email from a vendor about a purchase order. She'd seen this same email a hundred times before. Why would she look more closely than the familiar logo and letterhead? After all, the dangerous stuff couldn't get past her company's firewall and spam filter. Or so she thought...
She didn't notice that the phony email address was from a .co instead of a .com. Flash forward one week. After dozens of hours of lost business and a $16,000 ransom payment, the company was still digging out of the mess.
We've all read about the JBS Meat Packing, Colonial Pipeline, and now the Kaseya VSA cyberattacks but there are hundreds of attacks that no one hears about. While these hacks may not raise the price of gas or a rib-eye steak, they are brutally damaging to the small to medium-sized businesses who suffer through them.
The purpose of this post is not to frighten anyone, but rather to reinforce the concept that we must all be vigilant. This begins with a discussion of the most obvious and easy-to-deploy line of defense against cyberattacks - Education and Awareness.
Forget the movie scenes where the bad guy climbs the outer wall of an impenetrable office, ducks into the ventilation system, and inserts a deadly USB drive that spreads malware onto the network. The vast majority of exploitations occur at the employee level through the simple act of a worker opening an email or clicking on a link.
How can we most effectively train our front-line employees? The first step is to make sure they are aware that a threat exists. You cannot effectively confront if you are not aware. The second step is to engage them by examining real-life examples and not just classroom reenactments, but actual on-the-job supervised experiences. The fact is we learn more by putting our hands on the hot stove than by being told not to. Finally, it's imperative to be consistent in training and testing. The attackers are always learning new and better ways and we should as well. Proper training does not consist of an annual seminar or online training class but should be an ongoing, ingrained part of your daily corporate life.
Think of Cybersecurity in terms of four walls protecting your organization. We have listed above just a few pointers in how to help your organization stay educated and aware. Beyond Education comes Protection, Detection and Recovery. The most important step towards becoming cyber-secure is to find an experienced and dedicated cybersecurity specialist with the proper platform and resources to put these plans into action.
Unetek 
