Tag: cybersecurity

5 Ways to Make Your Cyber Security a Reality

What is a Cyber IQ?

Take the Cyber IQ test compiled by the security firm, Eset.  Companies need to continue to commit to gaining knowledge about cybercrime and technology.  Ignorance in this evolving area could be leaving data at risk.

According to the Verizon 2015 Data Breach Investigations Report (DBIR), it is estimated the financial loss from 700 million compromised records cost various industries over $400 million.  The least expensive breach was $750,000 and the single most expensive breach was $31 million, discovered Fortalice Solutions.  These are devastating and costly breaches companies cannot afford.  It’s time to get in the cyber know.

Know the Cyber Lingo

What is the difference between a security incident and data breach?  DBIR clarifies:

Security Incident: Any event that compromises the confidentiality, integrity, or availability of an information asset.

Data Breach: An incident that resulted in confirmed disclosure (not just exposure) to an unauthorized party.

A Detection Deficit is Growing

Detection Deficit is a term used to describe the time it takes for hackers to compromise a network and the time it takes for the organization to discover the hack.  According to the DBIR, 60% of attackers are able to compromise an organization within minutes, but it may take days, months, and even years for the organization to discover the breach.  The ‘detection deficit’ between attackers and cyber defenders continues to grow.

According to RiskAnalytics, 75% of attacks spread from Victim 0 to Victim 1 within one day (24 hours). Over 40% hit the second victim in less than an hour.

No Phishing Allowed

Out of 150,000 emails sent, nearly 50% of the recipients opened the e-mails and clicked on the phishing links within the first hour, DBIR findings revealed.  Phishing typically targets more of an individual rather than an organization.

If the email claims to be a financial institution wanting updated account info, contact information, or to change a password, STOP.  This is the red-flag salute of a comprise trying to take a foothold in your network.

Beware of Malware

According to DBIR, 70-90% of malware samples are unique to an organization.  Malware has a shelf-life and typically is short lived, DBIR explained.  Ninety-five percent of malware types showed up for less than a month, and four out of five didn’t last beyond a week.  Though malware events may not be long lasting, their maliciousness is.  These numbers demand smarter and more adaptive approaches to combating malware.

Calibrate a Cyber Security Solution

It appears the common the cold is no longer what is to be feared.  As a community, businesses can achieve together and unfortunately, businesses can fail together.  The Calibration Group is committed to taking action to thwart off cyberattacks and enlarge the secure perimeter of its business community.  Being a communication facilitator it is quite easy for Calibration to streamline the collective business preparedness.

Ellen Powers, The MITRE Corporation’s Information Security Awareness Program Manager, identifies companies’ most effective asset to stopping cyber breaches, “Employees, our human sensor network, detect 10% of advanced cyberattacks.”

Lance Spitzner, Training Director for the SANS Securing The Human Program, echoes Ellen’s sentiments, noting that “one of the most effective ways you can minimize the phishing threat is through effective awareness and training. Not only can you reduce the number of people that fall victim to (potentially) less than 5%, you create a network of human sensors that are more effective at detecting phishing attacks than almost any technology.”

Contact The Calibration Group today to request a customized company cyber security employee awareness program. Educated employees reduce breach costs by 76%,  Fortalice Solutions and The Calibration Group report. With Calibration’s decades of industry expertise, the employee firewall will become companies’ best line of defense against costly cyber breaches.

7 Tips to Protect Your Company from a Cyber-attack

Cyber security is a growing concern. In 2014 Apple, Sony, Neiman Marcus, and Target were high profile victims of cyber theft. But for every big company that has fallen prey to a cyber-attack, there are hundreds of small businesses which have also been targeted. The potential for a cyber-attack is real for all companies, big and small, from cutting edge, high-tech corporations to traditional institutions. Phone companies, credit card services, department stores, hospitals, social media sites, and even government offices are possible targets. The scale of cybercrime is growing and no company is safe. It seems the bad guys are forging ahead in this race. It is important for you to understand: Cyber security is your problem.

Many companies resort to hoping that a cyber-attack doesn’t happen to them and fail to prepare for one. Ernst & Young, in its “Get Ahead of Cybercrime” report, says that companies “lack awareness, budget and skills to prevent a cyber-attack.”

The challenge is how do you manage risk, reduce the threat of cyber-attack, and implement sufficient security while budgets for these activities remain static? How do you allocate resources and staff to address the growing concerns of cyber-attack while conducting everyday business? Where can you find trained cyber security specialists to help you begin to build your defenses against cyber-attacks? If you do experience a cyber-attack, how can you minimize the damage it could cause?

Here are some tips for protecting your company and preventing or reducing loss:

  1. Educate your employees through cybersecurity awareness and training. Educated employees reduce breach costs by 76 percent!
  2. Be aware of what data is vulnerable to a cyber-attack. This allows you to focus on the areas of your business that need the most protection.
  3. Work to install multi-factor authentication systems rather than using a single password. Making it difficult for cyber hackers to break through the security wall may deter them from their nefarious tasks.
  4. Be vigilant. Early detection is vital. Notifying your company’s security team and law enforcement in the earliest stage of a cybercrime may significantly limit your losses.
  5. Act quickly. Fast action may hamper the efforts of your cyber-attackers to access or use your information.
  6. Make an effort to secure your data with workable solutions such as setting up segmented networks, deleting unneeded information, or using encryption.
  7. Keep informed about the latest equipment and security systems as they become available. This may require an investment of funds, but managing risk and protecting your company is worth the cost.

Cybercrime is a real threat. “Heartbleed” bugs, “Shellshocks,” and “Sandworms” can penetrate your company’s computers, databases, and security walls. A breach in security can undermine your daily operations, destroy consumer trust, and leave you wondering what to do next. Though it is impossible to protect your company from every threat, there are things you can do and steps you can take to thwart cyber attackers. Is your company protected from cyber-attack?

Check out a cybersecurity stat video we created in collaboration with our partner, Fortalice Solutions.  We partner with Founder and CEO of Fortalice, Theresa Payton, to create dynamic and inspiring cybersecurity awareness solutions for all types of businesses.  Payton is the former CIO of the White House in the Bush Administration.

NEWS: Calibration Partners with Former White House CIO

Calibration Partners with Cybersecurity Expert Fortalice Solutions, LLC to Help Retailers Tackle Cybersecurity Awareness

Former CIO of the White House partners with messaging expert to deliver valuable cybersecurity educational resources to retailers

ATLANTA, March 5, 2015 – Calibration, LLC and Fortalice Solutions, LLC form a partnership to help retailers tackle cybersecurity awareness for their front-line employees.  The costs for security events, like data breaches, are reduced by 76 percent when employees are effectively trained.  This partnership combines Fortalice Solutions’ un-matched cybersecurity expertise with Calibration’s proven formula of inspiring action within corporate cultures to create a valuable awareness solution for retailers.

“We are extremely proud to partner with Fortalice Solutions and Theresa Payton, former White House Chief Information Officer (CIO),” said Amber Bradley Virgillo, owner of Calibration, LLC. “Combining Theresa’s and her team’s expertise with our messaging and communications capabilities is the perfect marriage to make an impact for retailers.”

“With the least expensive security breach costing one retailer more than $750,000, retailers are in a must-act position when it comes to securing their digital assets,” said Theresa Payton, chief advisor and chief executive officer of Fortalice Solutions, LLC.  “We’re excited about this partnership because it helps retailers communicate with an audience most vulnerable to cyber scams: their employees.” Fortalice Solutions, LLC designs, develops, and deploys affordable customized services to protect against internet predators.

About Calibration, LLC
Calibration Marketing is a full-service marketing and communications firm specializing in customized marketing solutions for any size business.  Calibration has mastered the ability to move beyond simple awareness and communication, but inspire action.

About Fortalice Solutions, LLC
Fortalice Solutions, LLC founder, Theresa Payton, served as the White House Chief Information Officer (CIO) for two years.  She was the first woman to hold this position, and her team served the President and the 3,000+ members of the Executive Office of the President.  Now the Chief Advisor and CEO of Fortalice Solutions, LLC, Payton delivers security, risk and fraud consulting services to private and public organizations.

###

Get Your Breach Defense On in 2015: Top 5 Security Trends in 2015

It seems like 2014 might be known as the year of the “breach.”  The constant stream of breaking news of data breaches affecting retailers, banks, governments and more kept us wondering, “who’s next?”  As criminals evolve and their targets widen, it begs the question, “what’s next for 2015?  More of the same”?

According to Thor Olavsrud, senior writer at CIO magazine, we can expect the “size, severity and complexity of cyber threats to continue increasing.”  Olavsrud cites the nonprofit association the Information Security Forum (ISF) to explain the top five security trends that will dominate 2015.

Summarized below are the key action items Olavsrud uncovers about each trend, as well as some questions relevant for your organization:

Trend 1: Cybercrime

Because cybercriminals use 21st century tools on 20th century systems organizations must be prepared for the unpredictable, which means:

  1. Know the cost of compliance and a potential breach
  2. Know what your business relies on the most to make a business case for protection

Question to consider:

–      How are you protecting your point-of-sale, networks, and in-store computers?

Trend 2: Privacy & Regulation

Treat privacy as both a compliance and a business risk issue to reduce regulatory sanctions and business costs such as reputational damage and loss of customers due to breaches.

Questions to consider:

–      How are we safeguarding personally identifiable information?

–      As more government regulations are imposed, do we have in-house counsel to help make sense of them?

Trend 3: Threats from Third-Party Providers

Are you remembering your supply chain?  Even the most innocent connections can be at risk. The Target attackers exploited a web services application that a company’s HVAC vendor used to submit invoices.  “Organizations should have business continuity plans in place to boost both resilience and senior management’s confidence,” quoted Olavsrud.

Questions to consider:

–      Do we have a risk assessment for our supply chain?

–      Is it scalable and repeatable for even our smallest vendor/supplier?

Trend 4: BYOx Trends in the Workplace

Remember BYOB?  This is less fun with the acronym “Bring your own box” – meaning employees brining their mobile devices to work.  And it’s a trend that is here to stay.

Olavsrud says that few organizations have comprehensive policies that help manage these devices at work.  Organizations should consider that employees often blur the boundary between work and personal information if they bring their mobile devices to work.  Expect your users to find a way to use their own devices for work even if you have a policy against it.  Instead of trying to fight the inevitable, construct a policy to ensure your organization has some recourse.

Questions to consider:

–      Do we have a comprehensive mobile device policy?

–      Is it followed?  Do we have consequences spelled out in the policy if it is not followed?

Trend 5: Engagement with your people

Everyone’s greatest asset and their most vulnerable target is its people.

Organizations should consider making sure its people are vastly aware of security protocol and the consequences of when it is broken.  Employees should also understand the data security protocol is each of his or her individual responsibilities, not just management. 

But organizations should also be proactive by making security behaviors part of the business process, “transforming employees from risks into the first line of defense in the organization’s security posture.”  Remember, people are the strongest part of control they have.

Questions to consider:

–      Are we addressing the human element of information security?

–      Do we have a comprehensive information plan that inspires people to protect our information?

–      What new behavior can we implement to reduce our risk?

To read Olavsrud’s original article published on CIO.com, click here.

This article was originally published in the Restaurant Loss Prevention & Security Association’s (RLPSA) newsletter, January 2015.