Why Cyber Security is the Biggest Risk to Business:

We all know that technology drives business.  That is why a company like Uber has rebranded itself as a technology company.  But the reliance on technology also has the downside of making businesses more vulnerable to cyber-attacks.  It happens so often these days that it is difficult to keep up.  No one is safe.  It happens to businesses of all sizes, in the public and private sector.  For example, recently, Russian hackers breached 632,000 email addresses of DOJ and Pentagon officials.  In the private sector,  popular password manager application LastPass had a large hack costing millions a month ago.  

The impact of cyber-attacks can be devastating to businesses of all sizes.  They not only disrupt operations, but also result in financial losses, reputational damage, and legal liability issues.

The risks are wide and deep and constantly evolving.  So what are the risks ?  

• Phishing – Phishing attacks are designed to trick users into revealing sensitive information, such as passwords or credit card numbers.  Victims often receive emails or text messages that appear to be from legitimate sources like banks or well-known companies.  The messages contain links or attachments enticing them to click resulting in Malware being installed on the computer or device or redirecting them to a fraudulent website where they are prompted to enter login credentials, credit card information or personal information.  They are very sophisticated and convincing.  I recently had a friend that worked for a school district call me in distress because they had received an email that appeared to be from the school board but later realized after clicking a link and entering personal information, that it was not from a legitimate source.
• Malware – Malware is malicious software that can damage or disable computer systems or networks.  An attack can disrupt operations, steal data, or just spy on users.  It is often spread through email attachments, infected websites, and USB drives (employees loading infected drives into the company network).
• Ransomware – Ransomware is a type of malware that encrypts a victim’s files and demands a ransom payment to decrypt them.  This is a very common attack launched against businesses these days and is very disruptive.  They prevent businesses from accessing their data and in essence shuts down operations until a ransom is paid.  A popular hotel in Las Vegas was hit by a similar attack last month that estimated losses in tens of millions.  
• Denial-of-service (DoS) – DoS attacks attempt to overwhelm a website or server with traffic, making it unavailable to legitimate users.  This really impacts those companies that rely heavily on online sales.  
• Supply chain attacks – Supply chain attacks target businesses through their third-party vendors. Cyber criminals look to compromise a vendor’s system in order to gain access to a company’s network.
• Data breaches – Data breaches occur when sensitive information is stolen.  This particular threat is an extremely common cyber threat today because data is golden!  This can include customer data, employee data, and financial data.  In addition, it can include company secrets or even damaging emails that company executives do not want exposed to the public.  This has a serious impact on a business’s reputation and bottom line. 
• Insider Threats – These are threats from within the company, whether malicious or not, it is often the greatest threat.  These are threats posed by employees and contractors working within a company.  What makes them very difficult to stop is because a company can do everything right, have all sorts of protection measures in place, be regularly monitoring the environment for threats, and still have an employee click an attachment from an infected email that got through the defenses or connect a USB drive to the network that has malware and the Company is compromised.  It is difficult because a company can take all the proactive measures it can think of, but they mean almost nothing if employees do not follow procedures.  Employees are the biggest risk to an organization.  What makes it even more challenging is that threats are caused by a number of things, not just malware.  Another culprit is weak passwords.  Weak passwords are easy for cyber criminals to guess or crack.  Most IT professionals can probably remember a situation when the password for some computer application was something like “password” or “password1”.  Another common example IT professionals run across is a password that is emailed around the company so often and with such little regard that it is like they were sending around a recipe for banana pudding.