High Risk, High Reward: The Cannabis Industry and Cyber Security

Gigabit Systems

November 11, 2018

•

20 min read

Share this post

Risk: A situation involving exposure to danger.

Reward: To make a gift of something to (someone) in recognition of their services, efforts, or achievements.

The Cannabis Industry: A combination of risk and reward that has become a target to hackers.

Cyber Security and The Cannabis Industry: The solution to keeping hackers out, and sustaining the future of the cannabis industry.

The Cannabis industry, while unique, is as vulnerable to cyber-attack as any other market. Its lucrative nature compels hackers to target cannabis businesses as they have amassed both private information and business intelligence, including social security numbers, bank account information, credit card information, etc. Instead learn from MJ Freeway, a cannabis POS software company that fell victim to hackers, and discover how to optimize the your cyber security, and prevent hackers from targeting your cannabis business.

‍Learning from the MJ Freeway Attacks

‍MJ Freeway, one of the first companies to create “seed-to-sale” tracking and business software for the legal cannabis industry, recently fell victim to a string of cyberattacks. The Denver-based firm offers tracking software for several state regulatory systems as well as 1,000 cannabis retailers across the United States. There were two attacks: one in November of 2016, and one in January of 2017. The November 2016 pertained to stolen information; this information included customers’ date-of-birth and contact information, but fortunately did not contain any Social Security identification and credit or debit card numbers. The January 2017 attack consisted of an outage of the company’s inventory system; due to an attack on both its main and backup databases, this left the firm temporarily unable to process transactions.By exposing the industry to recognize how cyber-hackers work, the MJ Freeway attacks set the precedent for why the cannabis industry must ensure the security of their point-of-sale (POS) system. Cannabis firms should regularly check-in with their POS provider to ensure full transparency regarding how to secure data, services, and privacy of patients.

‍Abiding by the Health Insurance Portability and Accountability Act (HIPAA)

‍HIPAA is a national legislation intended to maintain security of protected health information. Under this law, medical cannabis information must demonstrate compliance in order to treat any and all patients who hold a medical cannabis card. Regularly checking-in with your POS and and enterprise resource planning (ERP) software helps ensure that an entire company is in compliance with HIPAA. Another preventative measure regarding HIPAA includes how cannabis firms collect information. For example, restricting information collection to a need-to-know basis limits the pool of vulnerable content able for hackers to get a hold of.

‍Keeping your business safe from cyber criminals is priceless. But that doesn’t mean cyber security should cost more than your business is worth. Contact Gigabit Systems to find out how we can keep your business safe at a price you can afford.

‍Understanding Cyber Security in a Healthcare Context

‍The ability to perceive cyber-security as an essential part of the cannabis healthcare system will help your cannabis firm maintain perspective. When considering how and why today’s healthcare system is more efficient than 20 years ago, almost all of the reasoning points back to technology. The exchange of information occurs more quickly than ever before, as documentation is easily stored within networks, too.Cyber security keeps the healthcare industry up-and-running, not to mention provide life-saving services to their patients. By providing services like endpoint security, checking for vulnerabilities, penetration testing, and employee training, cannabis dispensaries and other businesses can keep their data safe and secure. Additionally, the POS software that is being used by the cannabis dispensary or other cannabis businesses, is only as good as its cyber security. Often times, the POS software will malfunction either by freezing, shutting down the software without permission, files are either corrupt or missing, etc. Many cannabis dispensary founders, owners, or CEO’s, don’t understand that it is not the software, but the lack of cyber security. These “glitches” or malfunctions are due to hackers gaining access to the software, and sending malware, phishing schemes, or just stealing private data.The cannabis industry needs to understand just what technology can do, both positive and negative, for a single firm. The sooner that cannabis firms realize just how vital secured networks are to their healthcare counterparts (hospitals, pharmacies, private practices, etc.), the more likely the cannabis industry will value cyber security as an essential function.

‍Cannabis and the Future of Technology

‍There is more to the cannabis industry than what meets the eye. As an essential function towards many individuals and their quality of life. A single cyberattack can cause real, physical human interference. In sum, by learning from the MJ Freeway attacks, abiding by the Health Insurance Portability and Accountability Act (HIPAA), and ultimately evaluating one’s cyber-security in the context of the health-care industry, the Cannabis industry can optimize their network security and continue to evolve.

‍Learn more about the latest in cyber security by subscribing to our blog;

‍https://gigabitsys.com/news

Share this post

See some more of our most recent posts...

Cybersecurity

News

Tips

3 Cyber Security Predictions for 2019

November 4, 2018

•

20 min read

The new year is around the corner. This, of course, means new trends and predications for what’s to come. Here are 3 cyber security predictions to be on the lookout for in 2019.

‍The Prevalence of Nation-State Attacks

‍In light of recent acts of terror, we can safely assume that nation-state cyber-attacks will likely continue in 2019. These attacks, as they are now, may be state-conducted or sponsored targeted cyber attacks on any and all adversaries such as, but not limited to, journalists, politicians, business leaders, and entire governments, etc. We unfortunately find evidence to support this from the murder of Saudi journalist Jamal Khashoggi, or NotPetya, the most costly cyber security attack in history, caused by Russia in an attempt to destabilize Ukraine.

Another prediction regarding nation-state attacks in 2019 includes how affected nations will take responsibility, or neglect to take responsibility. Like-minded governments, who target dissenting opinions, are likely to turn the cold shoulder to attacks within their own borders. If businesses are under the impression that their own government might not even stand firm against cyber criminals, perhaps this may motivate corporate leaders to strengthen their cyber-security infrastructure more than ever before.

Don’t wait for a cyber criminal to attack. Contact Gigabit Systems today.

The Rise of Multi-Factor Authentication‍

Multi-factor authentication (MFA) entails confirming a user’s claimed identity by only granting access after successfully presenting several pieces of evidence to an authentication mechanism, such as, but not limited to: possession, inheritance, or knowledge. Sometimes, multi-factor authentication is limited to a combination of only two-factors (2FA): something the user knows, has, or is.

While this solution is far from perfect, it is likely that more and more websites and online services will provide multi-factor authentication as opposed to password-only access. This switch is motivated in-part by the increasing number of phishing attacks associated with password use. To accommodate this switch, FIDO2 browser enhancements and the Duo/Cisco acquisition may tip the scales in MFA's favor. These system improvements will make MFA more tempting to use than not to, despite some initial frustration on how to use the mechanism.

‍The Decline of Ransomware

‍Ransomware describes a type of malicious software that denies access to a computer system or data until there is a ransom paid. It is likely that cyber criminals will begin to stray away from ransomware in pursuit of new ways to generate revenue. For example, the number of users who encountered ransomware in 2017 and 2018 fell by nearly 30% over the 2016-2017 time period. Some experts predict that while ransomware will still be employed, it will be more of a targeted attack.

What attributes to the decline of ransomware? Some associate this decline to cryptojacking, where a hacker hijacks a target’s processes for the purpose of mining cryptocurrency on the hacker’s behalf. Since the number and quantity of cryptomining tools require little-to-no technical training, schemes seem more appealing to money makers than traditional ransomware attacks. Ultimately, cryptomining offers attackers a means of making quick cash from an infection, which is exemplified by the 44.5 percent rise in number of users that have experienced a cryptomining attack in the past year.

‍The future of 2019

‍While trends are expected to shift in the upcoming year, an evaluation of what to expect in 2019 should come as no surprise. Overall, in the upcoming year, cyber-security will likely shift focus away from ransomware, and towards multi-factor authentication. The international community should also be on the lookout for nation-state attacks, while also bearing in mind the impact of these on individual businesses and consumers. At the end of the day, it is important to remember, that no one is immune is to a cyber security attack and it is best to implement a cyber security strategy and recovery plan.

Learn more about the latest in cyber security by subscribing to our blog; https://gigabitsys.com/news

Cybersecurity

News

How IT Departments Ensure Cybersecurity

December 18, 2018

•

20 min read

We often think of our information technology (IT) departments as a team full of computer “nerds” who roam the floors to make sure your laptop isn’t on fire and the like. Believe it or not, there is far more to our IT departments than what meets the eye. Information technology and its professionals provide essential functions and services towards ensuring their business’s vitality. The IT department is not just responsible for your business’s company-wide networking, but also its’ cybersecurity.

Emergency Management
In the event of a cyberattack, all eyes and ears are likely on your company’s IT department to lead emergency management. In 2019, the international community should expect to see more frequent, and more costly attacks than ever before. Some research finds that the cost of data breaches will exceed $2 trillion, quadruple the cost estimates in 2015. With such stunning figures as these, it should come as no surprise that most (if not all) firms with robust cybersecurity infrastructure place their IT department at the center of their cyber-attack management plan.
As the “experts,” IT departments tend to take direction in how a company responds to a cyber-attack. This means that each and every IT team member should be alert and aware at all times of any possible threat to their organization. The IT team members will have to create a cybersecurity plan that includes endpoint security, employee training, penetration and vulnerability testing, and of course a recovery plan. With that said, the international community should overall expect to see cyber threats at every corner, and will continue to need leadership as they meet and defeat these attacks.

Knowledge Sharing
It is safely assumed that a vast majority of a company’s cyber-security knowledge is concentrated within their IT department. In order to maintain the company’s approach to cybersecurity, IT departments must take ownership over organization-wide cyber-education. This can protect a business from external threats by establishing a shield from within.
Successful IT professionals know that they must instruct their colleagues on their individual role in protecting the company’s systems and processes. The organization as a whole must be aware of how their every online behavior puts both themselves and their work environment at risk. Their efforts to keep each employee aware of the potential dangers (type of cyber-attacks, type of tactics that hackers use, and etcetera) helps streamline accountability, while also placing themselves as the first line of defense.
By providing the company’s employees with not just a company conference, but through actual phishing and malware attempts, and real life scenarios, a successful IT department can keep the business cyber secure.

Don’t wait for a cyber criminal to attack. Contact Gigabit Systems today.

Innovation
Your business’s IT department helps keep your organization’s cyber-security infrastructure contemporary and effective. They are some of the most equipped employees to optimize your cybersecurity approach. Some ways that IT departments can promote innovative idea-sharing and strategy evolution is through in-house seminars on how to better-perform certain job functions and data evaluation aimed at predicting future incidents. This comprehensive approach keeps IT departments proactive, as opposed to reactive.

Summary
IT departments are not just a group of your go-to technology colleagues. Rather, they are leaders in how your business has, and will continue to face cyber-security threats. Through emergency management, knowledge sharing, and innovation, organizations should continue to rely on and capacity-build their IT departments for the purpose of remaining competitive in a technology-reliant world.

Learn more about the latest in cyber security by subscribing to our blog; https://www.gigabitsys.com/news

Cybersecurity

News

Tips

Business Email Compromise (BEC): How to Prevent ‘Gifting’ In

February 5, 2019

•

20 min read

No matter the season or the occasion, consumers frequently turn to gift cards as one of the only gift giving options with versatility. In today’s digital age, you might not be surprised to hear that even gift cards pose a threat to your online safety. The Federal Bureau of Investigation (FBI) issued a warning in December of 2018 surrounding Business Email Compromise (BEC) scams that specifically involve gift card fraud. Although these tactics do not have a high success rate, hackers can still yield a handsome profit. Here’s what you should know about this up-and-coming cyber-attack method.

What is Gift Card Fraud?

Business Email Compromise scams, also referred to as “CEO Fraud” or “Whaling” pose a significant financial cyber threat to businesses across the United States. The FBI’s Internet Crime Complaint Center, IC3.gov, reported that gift card fraud led to estimated losses of over $1 million. These damages are felt on a local level as well. In Arizona, BEC gift card scams went from amounting $845 in losses during 2017, to $90,000 in 2018.

The FBI explained in their December 2018 press release that BEC gift card fraud takes advantage of employees using concise, assertive language. Prior to the attack, an assailant organization will look to gain access to the intended victim organization’s emails. This helps the hackers craft as convincing of a message as possible. Here, timing is everything - BEC is far more successful around the holidays, or among employees who work closely with clients, third-party vendors, and etcetera.

Messages looking to accomplish gift card fraud appear to come from a CEO or another powerful executive, and typically encourage their employees to buy gift cards for a holiday party, personal use, and etcetera. The email usually asks the employee to send the gift card information, i.e. the number and PIN, back to the executive who allegedly sent the email. The hacker who is behind the email will then cash out the value.

The Scarlet Widow Case Study: Why Your Business Should Take Gift Card Fraud Seriously

There have been several international examples that shed a light on the potential consequences of a successful BEC maneuver. One includes a Nigerian organization known as the Scarlet Widow, which targets thousands of nonprofits, education-related institutions, and their associated individuals using gift card fraud. They typically request Apple iTunes or Google Play gift cards using a narrative that makes the suggestion fit. For example, Scarlet Widow was able to convince an Australian university administrator into both purchasing and distributing $1,800 of iTunes gift cards. The administrator later admitted that they believed the request came from the head of the university’s financial department. Scarlet Widow completed their mission by selling the cards via bitcoin and converting that to cash, all in a little over two hours.

What this case study shows us is just how quickly this type of social engineering can flourish. A single employee’s mistake led to thousands of dollars lost in a matter of hours. Given the ability of organizations like the Scarlet Widow to identify and mask themselves within their intended victims organization, all businesses should take this incident into serious consideration when developing their cyber-security strategy.

How to Prevent Gift Card Fraud

If you suspect that an email might not have come from its alleged sender, first look at the email header of the sender. Hackers sometimes will send an email from an address that looks similar, but slightly varies, from a legitimate executive. If you are still unsure about the email’s validity, do not be intimidated to ask from help. Reaching out to your CEO or executive directly is the easiest and quickest way to conclude fraud.

Are you looking for an IT company that specializes in Cyber Security while staying within budget? Contact Gigabit Systems.

The email’s contents can, too, point you in the right direction. The FBI warns that requests to buy multiple gift cards, even if the request itself doesn’t seem too outrageous, should concern you. Employees should also watch out for overly assertive language, i.e. a tone that pressures you to purchase the cards and/or send the gift card number and PIN as quickly as possible. Lastly, any sort of odd phrasing, grammar errors, and any instinctive variation from the sender’s usual emails should warrant some hesitation. As is the case with all types of widespread social engineering attacks, business leadership and information technology experts must educate on an organizational level as a means of dwindling any possible financial or reputational damage.

Conclusion

Business Email Compromise, specifically in the context of gift card fraud, poses a severe threat to businesses of any size. Since hackers are able to identify as apart of their intended victims' organization, these assailants have a great opportunity at success. Encouraging your employees to say something when they see something, study previous examples, and carefully read through their messages must become commonplace in order for these damages to dwindle.

Learn more about the latest in cyber security by subscribing to our blog; https://www.gigabitsys.com/news