The Enemy at the Gate

 

The Enemy at the Gate

As an MSP (Managed Service Provider)  who has been supporting small to mid-sized businesses for over 30 years, one thing I can tell you is that the mindset of "we are too small to be the target of a cyber-attack" is far more widespread than one might think.

Some might accuse me of exaggerating, or spreading FUD (Fear, Uncertainty & Doubt) like so much manure on the garden of business.. But in all fairness, I would say that I am understating the gravity of this phenomena.  The data doesn't lie. A recent Accenture/Ponemon study (PDF) shows that 68% of business leaders feel their cybersecurity risks are increasing, and Verizon found that 43% of breach victims were classified as small businesses.

Now, back to my initial postulation that SMB's seem to have a tendency to underestimate their risk.  How I know this to be true is that I find in many cases when doing cybersecurity assessments of prospective new clients, the most often overlooked facet of their cybersecurity maturity score is the firewall.  If there is one element of a businesses defense system that should not be ignored, it's network infrastructure, especially the firewall.

The simple fact is - an outdated firewall not only is likely to be laced with unpatched vulnerabilities, it also is not equipped to handle the threats todays cybercriminals bring to the party. Proper lifecycle management of perimeter security devices is about 5 years.  By that point, the technology has changed to meet the current level of threat to a point where simple subscription based services can no longer keep up.

Case in point - over 70% of all Internet traffic is secured by SSL encryption. The familiar HTTPS preceding the web URL tells you that the connection between you and that web server is secure.  But is it really? Many firewalls can not inspect SSL traffic, and so it passes directly to your browser, with all the potential vulnerabilities intact.  In fact, many of the bad actors who are perpetrating cyberattacks on all levels of business are working in that same "secure" space because they KNOW, most firewalls are either incapable of ferreting them out, or are not properly configured to do so because of the performance hit that results from deep packet inspection of SSL traffic.  It takes serious horsepower to un-encrypt, scan, and re-assemble SSL traffic.

More concerning to me on these visits is when I see big-box store level wireless routers often found on sale for under $100 and touted as a "firewall" being used in a business setting. Or even worse, just using the modem provided by the broadband provider du jour. Let me help you with this - for free - it's not good! No bueno, sehr schlect, call it what you will, but don't call it a business class firewall.  These devices do not have the intrusion prevention mechanisms, country of origin, BotNet, or malicious content filtering capabilities needed in today's cyberthreat landscape.

Yes, I see you out there with the sheepish grin.. While I might call you out for neglecting your businesses security, I don't blame you. Running a business is expensive, and you were probably given advice by someone, or read a review online, or have fallen victim to an IT support provider that really does not understand cybersecurity..  and so, I won't judge.  I would rather educate business owners on the harsh reality of why they need to work with a professional security focused MSP to ensure that the most critical component in their cyberdefense arsenal is right-sized for their current and mid-term needs.

The average payout for a ransomware intrusion on a typical business network is up to $111,605 (bankinfosecurity.com April 2020 study) and as a small business owner myself, the last thing I want to be doing is footing that kind of bill.  While you may recover from the problem, what is often missed in this calculation is the lost customer confidence that can further erode your bottom line over time.  Having the right firewall is the best first step a small business can take to defend against this type of intrusion, and a small price to pay in comparison to the risk.

With the average time to detect an intrusion ranging from 90 - 180 days, sometimes more, having a strong barrier to intrusion is the best first step you can take other than educating your workforce on how to recognize common threats. (Cybersecurity awareness training should be both mandatory and ongoing, and directed from the top down). The amount of downtime that occurs when a malicious intrusion happens can be staggering. To a a small business, this can often result in becoming the straw that breaks the camels back.  

Investing in the right firewall can mean the difference between long term success and failure. If you have not had a cybersecurity assessment performed in a couple years, partner with a reputable MSP or MSSP (Managed Security Service Provider).  They should be able to sit down with you, determine your organizational cybersecurity maturity level and make the right recommendations to help you safeguard your business.  If you are in the Western Massachusetts, Northern Connecticut area, contact us by web, or call us at (413) 786-9675.

Stay tuned for our next look at securing your business with our upcoming blog on endpoint protection.

The Hard Truth

The Hard Truth..

Whenever there is a crisis, the vultures and jackals will circle (and I mean no disservice to those vultures and jackals of reputable nature)..  In the days and weeks of the COVID-19 pandemic, the ner’-do-wells have stepped up their game, and cyber-attacks on businesses and individuals has escalated.  While this speaks to the baser side of human nature, that side that would maliciously take from others for personal gain, this post is not directly about that..

What this IS about is what we can do about it.

Sadly, many of us have the tendency to bury our heads in the sand and tell ourselves that “it will NEVER happen to me”.

Well, friends..  yes, in fact, it IS going to happen to you.  Maybe not today, perhaps not tomorrow.. but at some point, you will find yourselves in the cross-hairs of the enemy, and he ain’t flinching when he pulls that trigger.  Whether or not you are the recipient of a cyber head-shot or not is entirely up to you.

In the day and age of a heightened state of cyber-threats, the smart money is on ensuring that you have covered every base when it comes to securing your digital house from the jackals at the door.  As a US military veteran from the Cold War era, I could extol you with stories of the days of foreign agents in trench coats trying to turn people to the dark side.. and while some of the foundations are the same, the tools are far more sophisticated than getting a sailor drunk and offering fat wads of cash for information.

The concepts are not new, but the tools have evolved. Understanding the mechanics of the threat is vital to protecting our assets.  Too many examples exist of a “lock up after the bad guy has been and gone” mentality. One stunning example is the Equifax breach, but that is just one of many examples where the bad actor has been well entrenched. It’s time to have the hard conversation with ourselves about how much risk is too much?

Rather than spout a collection of buzz-words and fall victim to trendy posturing, we need to roll up our sleeves and get down to business. A deep assessment of where we are, and how do we prepare ourselves for those who would do us harm. For starters, we need to ask ourselves several direct questions:

• Are we ready to take security seriously?
• Do we have the right policies in place to educate, guide and hold our workforce accountable?
• What are our strengths, weaknesses, opportunities, and threats?
• Do we have the right people in place, both internally and externally, to make a move to a more secure footing?
• Do we understand the potential cost of doing nothing?
• Are the experts we are paying for doing the job? 

For many, especially in the SMB space, the answers to these questions can be an eye opening experience. No one is too small to be noticed.  No industry escapes the scrutiny of those of malicious intent. The key to a successful security policy is to understand that it is going to change. It has to be able to evolve along with the threats that are present - this means it has to be regularly re-evaluated.  There is no such thing as a once-size-fits-all policy.  Even the NIST Security Framework has components that may or may not apply to your organization.

Like in any 12 step program, the first step is accepting that you have a problem.  We ALL have a problem. Do we have the willingness to address it?  The important thing to understand is that you don't have to go it alone.

If you are ready to have that conversation, we are ready to help. With over 30 years in the information security arena, NetWerks is ready to guide you to a much more secure place.  Reach out to us through our web site to set up a no-cost, no-obligation meeting to get an idea where you are at.