Vertikal6 Inc. CEO Rick Norberg says statistics now show that 71% of people are working from home at least some of the time. With that percentage comes security risks in the form of cyberattacks, especially with small businesses that may lack proper cybersecurity infrastructures as a result of thinking they are too small to be a target.
Norberg recommends products, technology and practices that will help guard companies from the stress, downtime and expense of a cyberattack.
Beyond Cash Donations: How New Forms of Giving Are Transforming Not-for-Profit Accounting
Evolving Funding Landscape for Not-for-Profits Not-for-profit organizations are being asked to do more with less,…
Learn More
PBN: When we talk about cybersecurity, especially in the case of employees working from home, some may be surprised to hear that data access restrictions should apply to employees in the form of tiered access. Can you explain?
NORBERG: Human error is still the No. 1 root cause of security breaches and the historic “castle and moat” approach to securing your environment is no longer enough. As your team – employees, partners and contractors – access company data from smartphones, laptops or tablets, it’s essential to securely enable access regardless of their device, location or network.
We recommend a zero-trust approach to our clients. This “never trust, always verify” approach considers all network traffic untrusted to ensure everyone has the right level of access to the right resources in the right context. You start by giving the least amount of permissions and increase it as needed so the user’s level of access in the office matches what they have at home. Ideally, this access is also assessed continuously. Just because people need to access network data and applications remotely doesn’t mean they need to have access to everything hosted in the network from every device.
We recommend only allowing approved corporate devices into your environment. Additionally, you can also utilize Windows Virtual Desktop or Remote Desktop Services to access company data and desktops securely in the cloud. As a result, your team can access desktops from any device and the data will never be impacted by device failure. WVD and RDS have additional safety features and encryption services built into them for maximum data security.
PBN: Are there specific recent cybersecurity breaches you are aware of with companies here in the Ocean State?
NORBERG: As companies accelerated their digital transformation, opportunistic cybercriminals became more and more targeted during the pandemic.
Our Help Desk saw a surge of business email compromise attacks due to more-sophisticated and increased social engineering. In fact, a recent survey showed 47% of individuals fell for a phishing scam while working at home.
Industries being targeted via email and ransomware attacks include retail, health care, manufacturing and government. Nationwide, over the past few months, there has been a growing trend of hackers targeting critical infrastructure and physical business operations.
The first half of 2021 has already seen a 102% increase in ransomware attacks compared [with] the beginning of last year. As an organization, we are providing clients with AI-based [artificial intelligence] tools to help protect them, layered security, education and proactive testing.
PBN: What security adjustments, if any, are needed for companies that are now transitioning remote pandemic workers into permanent remote workers?
NORBERG: Before the pandemic, about 30% of employees were set up to work remotely. Now, almost everyone is remote-work-enabled from day one of employment. This makes it essential to establish the right remote work policies to keep a business secure. While many companies already have strong security protocols, it’s time to review them again.
Design adjustments are often necessary to implement a more secure, layered, zero-trust network access to keep remote users separated from the network. Businesses should have backups in place to maintain business continuity in the event of an attack, review access policies and increase cyber training for teams to keep them informed of new threats and how to combat them.
In addition, implementing two-factor, or multifactor, authentication wherever possible, reevaluating any existing bring-your-own-device policies and working with a managed security services provider to maintain a robust cybersecurity strategy are essential.
PBN: For a company that admittedly has let its cybersecurity lax, what would you recommend are the top three priority items to get started?
NORBERG: No business is too small to be hacked. Over 70% of reported breaches affect businesses with 100 employees or less. One of the most important steps in ensuring protection against cyber threats is an audit in the form of an IT [information technology] security assessment.
The goal of a cybersecurity assessment is to summarize the current state of a business’s security, including internal and external vulnerabilities, risk mitigation potential, highest-priority security risks, and the best and most cost-effective solutions.
Next, it’s critical to remedy the most critical items ASAP while adopting a comprehensive, multilayered approach that incorporates best-of-breed technologies, continuous monitoring and resilient processes.
Finally, we encourage companies to adopt a mindset of continuous improvement to remain ahead of the curve. Revisit your processes and policies on a regular and ongoing basis in order to stay abreast with the latest developments in the field. We encourage companies to take our six-question quiz to see if they have all cybersecurity bases covered.
PBN: How has COVID-19 impacted cybersecurity?
NORBERG: Hackers have been capitalizing on coronavirus to spread false information, increase fears, create stressful situations and extort unsuspecting victims. With the rise of remote work – a shift that happened very quickly – vulnerabilities only made it easier to carry out such attacks such as posing as reputable government agencies, elder abuse scams, relief organizations and more.
Cybercriminals are diligent and are on top of their game and their schemes have really evolved, often using multiple access points such as text, email, phone calls and mail. Now, “ransomware-as-a-service” businesses even have 24/7 help desks to help companies decrypt the servers they just took for ransom. For a fee, they’ll even offer to write custom code to help you! At the same time, digital currency has made it easier for the attackers to remain anonymous.
The sad truth is that companies don’t often see the benefit of cybersecurity until after a breach. We can’t stress enough the importance of taking the steps to properly protect your business before an event occurs, including acquiring the right level of cyber insurance.
Susan Shalhoub is a PBN contributing writer.
