Securing Your Business Against Phishing, Ransomware, and Credential Stuffing

It is incredibly difficult to miss the massive spike in technology criminality lately. Every other week, there is a new headline about a massive data breach or a municipality being held hostage by hackers.

Here is the truth of the matter: people aren’t afraid of cyberattacks; they’re afraid of the consequences. For most people, the idea of a cyberthreat is still pretty nebulous. Your biggest concern isn’t the attack itself. It’s the impact. You don’t want the fines, you don’t want to lose business, and you certainly don't want to be stolen from.

Let's strip away the technical jargon and look at the most common criminal activities businesses are actually dealing with right now, and more importantly, how you can defend your livelihood.

Phishing and Business Email Compromise 

Most people want to be useful. We want to do our jobs well, pay our vendors on time, and keep the boss happy. Cybercriminals know this, which is exactly why phishing and business email compromise remain so prevalent.

This isn't just a Nigerian Prince asking for iTunes gift cards anymore. A modern BEC attack usually looks like a perfectly normal email from a vendor you already work with. The attacker will spoof the vendor's email address and politely ask you to update their ACH routing information before you process an outstanding $14,250 invoice. If your accounting department doesn't catch it, that money goes straight into a criminal's account.

Being a victim of a scam isn't your fault. These attacks are specifically designed to manipulate human nature and standard business routines. I'm not going to tell you that being more mindful of these things would have prevented it, but implementing a strict, offline verification policy for any financial changes absolutely will.

Ransomware

Ransomware is the cyberthreat that keeps business owners awake at night. Malicious software infiltrates your network, encrypts your critical files, and demands a cryptocurrency payment in exchange for the decryption key.

Downtime is an absolute thief. Even if you have the funds to pay the ransom (which you should never do, by the way), your operations are entirely halted while you sort it out.

Your first step should always be implementing a robust, tested backup strategy. The process is actually pretty simple: if your data is backed up in a segmented environment that the ransomware cannot reach, you don't have to pay the ransom. You just wipe the infected hardware and restore from your backups. A word to the wise: if you aren't regularly testing your backups to ensure they actually restore properly, you don't really have backups. You just have hope.

Credential Stuffing

Password standards demand quite a few variables to be met in order to ensure security, from minimum length requirements to certain symbols to be included alongside an alphanumeric blend. When you take these standards into account and combine them with the fact that the average person today has dozens of online accounts, it only seems natural that someone would come up with one password that meets these requirements and use that one on repeat.

Criminals exploit this. 

They purchase massive lists of compromised usernames and passwords from older breaches, and they run automated scripts to test those credentials across hundreds of other platforms—from your email servers to your CRM—until they find a match.

A company-wide password management system can eliminate that temptation for your staff. It generates and stores complex, unique passwords for every single login, meaning your employees only ever have to remember one master password.

You need to protect your business, but you also cannot afford to lock down your network so tightly that your employees can't actually do their jobs. With some of the controls that have been proposed by overly aggressive security vendors, the outcome is usually less productivity, less employee satisfaction, and less retention.

Security restrictions are necessary, but they should be largely invisible. Enforcing Multi-Factor Authentication (MFA) across all your accounts is a perfect example. It takes three seconds for an employee to tap an approval on their phone, but it stops credential stuffing attacks dead in their tracks.

It really is that easy. You don't need to be paranoid; you just need to be prepared. To get help with your network, give us a call at 607-433-2200.