1-417-627-9878
Cyber threats are fun, aren’t they? They come out of nowhere; they terrorize your network, and they’re nice enough to tear apart your business in the process. Fun and thoughtful. What a catch, right?
But seriously, cyber threats aren’t fun at all. With one email, you could give away thousands of dollars to some punk teenager who lives halfway across the country, and with one click, your data could be held for ransom or auctioned off on the dark web for a pathetically small chunk of bitcoins.
There are simply way too many random, off-the-wall, entirely unsuspecting ways that you could infect your network, lose your data, or both. It’s a terrible, no-good, and highly depressing reality.
Source — CSO
Nonetheless, it’s a reality that businesses from all corners of the professional galaxy are required to face on a daily basis… which sort of makes it even more depressing. The people who work for these companies are expected to put on a brave face and click, type, and browse with caution.
But, alas, how cautious can anyone actually be if they don’t know what to look for? Sure, you could handle everything with some degree of skepticism, but if you aren’t knowledgeable in prominent cyber threats, then you’re basically walking down a busy freeway, barefoot and blindfolded. Not such a great scenario, is it?
“43% of cyberattacks target small businesses.” — Smallbiztrends
So, in the spirit of not walking down busy freeways, let’s go over a few of the most prominent cyber threats to be on the lookout for.
Phishing
Phishing goes down all day, every day, and anyone who has the ability to string a few words together inside an email can pull off a successful attack. Simply put, phishing is an email created with the intent to do harm – usually, this entails duping business professionals into dropping standard security protocols to give away information (financial details, personal information, company secrets, and any other data worth value).
Source — Barkly
Cybercriminals pull these attacks off by posing as a trusted source, like a partner, client, or large company. Within the email, they might ask someone to complete a payment, reset their online password, or update personal information within the online portal. Any information handed over goes directly to a malicious source.
Source — Phish Labs
Spear Phishing
Generally speaking, spear phishing is the same thing as phishing; however, one major difference exists. To explain this difference, you’ll need to think of “phishing” as someone actually fishing – throwing out a line and hoping to catch any fish that may or may not pass by. Will they catch a fish? Probably. Will it be worth their time? Maybe.
Spear phishing, on the other hand, would be like someone wading out into the water, aiming a spear at an individual fish, and then throwing it. Since the spear is targeted at a specific fish, the person throwing that spear is more likely to catch not just any fish but the fish.
In the cyber realm, this would entail a cybercriminal sending out an email only after they’ve researched your position, grazed your social profiles, and learned about your company’s internal processes. When they send you a malicious email, it’ll appear so legitimate that the likelihood of you being duped is significantly higher.
Source — Barkly
Social Engineering
Social engineering is a very broad concept of a cyber threat, and hypothetically, it could expand to cover a few of the threats mentioned on this list. However, we’ll get a bit more specific and talk about the form of social engineering that exists outside the cyber realm. Yes, that’s right, folks. A breached database, hacked account, or infected network doesn’t have to begin online.
“In 2016 60% of organizations were a victim of social engineering” — SecureWorld
Like phishing, social engineering involves someone duping another person into dropping standard security protocols and procedures. In this case, however, a little acting might be involved.
It would be like someone calling your receptionist and pretending to be a vendor or client. Depending on your internal processes (or a lack thereof), your receptionist might hand over information, not realizing the person on the other end of the line isn’t who they say they are. Consider it a “social,” real-life version of a malicious email.
Ransomware
Just in case you live in a cave, ransomware is a cunning form of malware that will encrypt your data and then force you to pay for the decryption key. If you don’t want to pay, that’s fine. You just won’t get your data back. And if you don’t have your data backed up, that’s also fine. You just won’t ever see that data again.
Source — CSO
The most clever aspect of ransomware is that the criminals behind it typically stick to their end of the bargain. In other words, you pay; they deliver… and quickly, too. This makes it considerably more appealing for businesses to just bite the bullet and pay up. However, just as every other threat does, ransomware is continuously evolving, and with this evolution, come some pretty frightening capabilities.
More recently, some victims of ransomware have been given the power to infect others with ransomware. In this situation, someone is infected with ransomware; but to receive the decryption key, they have two options. The first option is to pay (as per the norm), and the second option is to infect two other people with ransomware. Sounds fun, doesn’t it? How would you feel if someone you knew forwarded you an email containing ransomware?
Source — Malwarebytes
Malvertising
In the last few years, malvertising has become a heavyweight contender in the world of cyber threats. This is mainly because it’s been able to infect major online brands such as The New York Times, The Daily Mail, BBC, YouTube, and Reuters.
Just think about this for a second… How many times have you been told to stay away from “sketchy” websites because that’s where malware lives? Probably too many times to remember. Well, now that any website is a target – sketchy or not – avoiding malware just got a little bit trickier.
But what exactly is malvertising? It’s exactly what you think it is – a malicious online ad.
If you feel the urge to click on one of these malicious ads, any number of things could happen. A download could initiate and you could end up with some form of malware. You could be redirected to another website and fall into a ransomware trap. But what’s an even scarier thought is that you can be infected without clicking or downloading anything. If you land on the site and the threat is advanced enough, it can play out its attack and successfully infect any outdated browser or computer.
Source — 2016 Internet Security Threat Report by Symantec
YOUR GO-TO GUIDE TO AVOIDING DARK ALLEYWAYS.
High-fives all around. You now have a reasonable idea of what’s lurking in the cyber realm, and you officially know which dark alleyways to avoid. This being said, you may know what the threats are and where they might exist, but knowing how to avoid them is an entirely different matter.
Phishing & Spear Phishing
Let’s go ahead and bundle these two threats together. Bundling is never a bad idea because when it comes to emails, you should treat them all with the same degree of suspicion. So, if you’re looking to avoid malicious emails, here’s what you need to consider:
The Grammar
This doesn’t apply to all phishing emails; however, looking for bad grammar can help you eliminate many malicious emails at a rapid pace. This being said, if you receive an email that is poorly written, it could be a surefire sign of a phishing attack. This especially holds true if the email comes from a reputable source, like a large company or well-known brand.
The Sender
It’ll always work in your favor to verify the “accuracy” of an email address. For example, johnsmith@johnsmith.com is different than jonsmith@johnsmith.com. Do you see why?
Let’s try another one. StrongholdData@StrongholdData.com is different than StrongholdData@StronghodData.com. Did you catch the difference this time? Although both emails in each example are only off by one letter, it can mean the difference between a friendly email and a not so friendly one.
The CTA
The call-to-action of every email is an important element to consider when debating the legitimacy of a message. In other words, does it make sense on all possible levels…?
Is this the right person to be asking this of you? Do people normally ask you to do it this way? At this time? For this reason? Have you ever done it this way before? Why or why not? Does it follow policy and procedure? If not, do these requests typically follow policy and procedure. These are the types of questions you should always ask yourself, especially if sensitive data is at stake.
Source — Barkly
Social Engineering
When it comes to social engineering, suspicion and process are your two best friends. Together, these two can help you successfully avoid the majority of in-person social engineering attacks (and to a certain degree, online forms of it, as well). If you have processes in place that say, “Don’t do this unless that,” then you actually have the power to tell someone ‘no.’
Going back to the previous example – if someone calls your receptionist pretending to be a client and asks for sensitive data, your receptionist now has the wherewithal to say, “I can’t do that unless you can verify XYZ or unless you can do ABC.” At this point, you aren’t just protecting your own company; you’re protecting your clients, too.
Ransomware
Malwarebytes says, “Prevent, don’t react.” And when it comes to ransomware, that’s a good mentality to have. Of course, this should start with a strong security solution, which should include anti-malware, as well as anti-ransomware. However, it’s also important to remember that ransomware is a fairly new, fairly advanced threat. In other words, you never really know where it’s going to evolve to next.
Because of ransomware’s ever-evolving nature, one of the best things you can do is backup your data. If your data is professionally backed up and recoverable, then you can be attacked by ransomware all day long and be completely fine. Well… sort of… they still have access to your data, and technically, that still qualifies as a data breach.
Source — Barkly
Malvertising
Malvertising typically relies on vulnerabilities within outdated software and browsers to get where it wants to get. This being said, a multi-layered security approach is a great place to start; however, if you really want to protect yourself, then you need to ensure that all parts of your system are up-to-date at all times. In other words, all those notifications you receive to update stuff… stop postponing them!
And remember, you can’t expect to avoid malvertising forever simply by not clicking on ads. Some forms can attack and infect whether you click or not.
HOW CAN STRONGHOLD DATA HELP YOU PROTECT YOUR BUSINESS?
With decades of combined IT experience, the Stronghold team provides professional IT services to business of all industries and sizes. We believe in fostering solid, long-lasting relationships with the companies we partner with, and we believe in providing nothing less than high-quality IT solutions and honest IT support.
With our help, we can keep your network fully secure at all times of the day and all days of the week. With full audits of your network and multi-layered solutions, we can protect your data from anything and everything that comes its way.
In other words, we have your back.
If you’re interested in learning more about our network security solutions, then give us a call today. We’d love to talk. You can also send us a message or visit our site to learn more about our technology solutions.
