Protecting your business from a cyberattack should always be a top priority. Increasing your defenses not only protects your data, it can have a positive effect on your business reputation and provide the safeguards needed to sustain through various market conditions. That said, to effectively protect your business from a cyber threat, you must remain vigilant in educating yourself on current cybersecurity threats and the best methods of protection.

Phishing 

The most common form of cyberattack is called Phishing. In fact, according to the Federal Bureau of Investigation (FBI), phishing was the number one crime type in 2022. And, USA Today reports that “more than 90% of cyber-attacks are initiated as a result of a phishing email.”

In a phishing scenario, a bad actor will attempt to collect sensitive information (e.g., user credentials, credit card information, bank account number) from an employee via email, text message, or phone call. The outreach is intended to look like it came from a trusted source and crafted with a sense of urgency to entice immediate action. That action may be to reply with the requested information, or even to click on a link or attachment for next steps. 

What to look for: 

• Sender email address: Verify that the sender’s email address is legitimate. Bad actors will use spoof accounts that are similar to the legitimate email, but may have a character or letter off. They also may come from a different domain (e.g., Jeff@XYZ.com vs Jeff@XYY.com or Jeff@XYZ.co) 
• Sender name: Use caution when engaging with a message from an individual you may have some familiarity with, but don’t interact with regularly. For example, receiving an email that indicates it’s from a leader within your organization, but outside of your department. This is a tactic used to deceive the recipient through a sense of familiarity or perceived trust. 
• Unusual sense of urgency: If the message comes through with a high level of urgency, especially something unexpected, that may be a sign of a phishing attempt. A great example of this is when an entry-level employee receives an urgent message from the CEO to respond with specific information right away. 
• Spelling and grammar issues: If the message is written with numerous spelling errors, odd phrasing, or grammatical errors, the recipient should take a moment to pause before acting.
• Links and attachments: Be sure to watch out for links or attachments from unknown senders. Inspect link URLs before clicking on them, or type the known URL into your browser directly instead of clicking on the embedded link. Often, bad actors will include infected links or attachments with the hope of tricking the recipient into opening them and unknowingly installing a virus.

Engaging with unknown individuals is a part of conducting business, but it’s essential to remain keenly aware of the messages coming in to ensure you don’t open yourself up to unnecessary risk. 

Ransomware and Malware

Once connected to your business, either through phishing or another inlet, cybercriminals can install malicious software known as malware or ransomware. Ransomware software is intended to seize control of your data or operating systems, holding them “hostage” until a ransom is paid. Malware software is similar in its malicious intent, causing disruptions to a business’ computers, servers, or networks. 

According to VirusTotal, more than 130 ransomware strains have been detected since 2020, and Verizon’s Data Breach Investigations Report noted that ransomware was involved in 24% of all breaches in 2023. In regard to malware, reports show 560K incidents of malware detected every day, with trojan viruses accounting for 58% of all malware.

Unfortunately, recent reports from Cybereason show that “84% [of organizations] paid the ransom. But 78% were then breached again, and 63% of these were asked to pay even more the second time.” Although it may be tempting to pay the ransom so you can regain access to your data and business operations, it will likely hurt your business in the long run. The best course of action (for both ransomware and malware) is to increase protection around any digital entry points (e.g., email, external storage drives, applications), provide security training for employees, patch software to ensure high level of security, and engage with security experts like GainSide to ensure all of your security needs are met.

Man in the Middle Attack

A Man in the Middle (MITM) Attack occurs when a cybercriminal inserts themselves between two entities in communication with the intent of stealing data. This often occurs when a user connects to an unsecured or unknown network (e.g., coffee shop, airport). The individuals communicating via this network are unaware that another party is present during their conversation and extracting data. Often, the cybercriminal is looking for financial information that can be sold on the dark web. 

Two common types of MITM attacks include: 

• WiFi eavesdropping: Cybercrimninals may establish a wireless network with a legitimate-sounding name, enticing individuals to connect. Once connected, cybercriminals will be able to collect sensitive information (e.g., user credentials, financial data). 
• Session hijacking: When an individual connects to an unsecured network, a cybercriminal may use this as an opportunity to steal the cookie associated with a specific application (e.g., banking app). This cookie will allow them to re-enter that application and conduct malicious activities.

In today’s virtual work environment, connecting to wireless networks is commonplace. Unfortunately, not all networks are safe. To ensure your business remains safe and secure, even on public wireless networks, be sure to always connect through a VPN network, which allows you to safely work with encrypted data. 

Stay Educated to Remain Secure

Cybersecurity threats are increasing in frequency and sophistication every day. As businesses continue to collect more data (including highly sensitive data), cybercriminals will be ready and waiting for an opportunity to insert themselves and take advantage of that data. The best way to protect yourself and your business is to remain hyper-vigilant in monitoring activity, securing all computers and applications, educating staff, and partnering with security experts like you’ll find at GainSide so you can focus on business growth and success.