News - IT and Cybersecurity Insights

Cybersecurity

News

What Germany's Hacks Mean for Cybersecurity

December 26, 2018

•

20 min read

Last month, hackers leaked sensitive data from hundreds of German politicians. The hackers distributed the information via the Twitter platform, and did not discriminate what they leaked based off of rank; the data pertained to members of the European parliament, German parliament, and regional state parliaments. Not only does this hack reflect just how global of an issue cybersecurity now is, but also points to some potential new patterns for governments to look out for in 2019.

The Revelation of Deeply Personal Information

The criminals and hackers involved in these cyber-attacks not only exposed and endangered their opponents, but borderline slandered them. This overexposure included deeply personal details about high profile figures and their families, including Chancellor Angela Merkel. The information release took place over several days, but were not formally removed until the following Friday.

Overall, it is fair to assume that the intent was not aimed at exposing state secrets, but more on exposing deeply personal information about particular Germans in the spotlight. This data includes internal political communications, credit card information, home addresses, phone numbers, personal identification card details, private chat logs, and voicemails from relatives and children. To make matters more difficult in finding a motive, the leaks contained information from almost all political parties across Germany, except from the far-right group Alternative for Germany.

Don’t wait for a cyber criminal to attack. Contact Gigabit Systems today.

What Could Have Prevented the Attack?

Warning signs indicating that a cyber attack loomed over Germany existed long before last December. In 2015, Germany security services uncovered a breach in their parliaments servers. While the parties represented did share a commitment to stop outside interference in German politics, no concrete action was taken to ensure that a similar attack would not be as successful. This example should serve as a reminder for governments across the world to invest in robust cyber-security infrastructure, especially if there have been signs of trouble in the recent future.

As previously mentioned, these attacks took place throughout the month of December. However, the public did not become fully aware of just how much damage had been done until several weeks later. To make matters worse, Germany’s Federal Office for Information Security (BSI) did not inform the Federal Crime Office until the rest of the general public received word of the attacks. The BSI then backtracked, and said that they only knew about five isolated cases - only when they were able to connect the dots did they decide to share with the public and the Federal Crime Office. This lack of communication exemplifies how all bodies and entities related to cybersecurity need to work closely with one another in order to prove their effectiveness.

The Future of Cyber Attacks

By failing to share the cyber attacks with the Federal Crime Office until the public was fully aware, Germany implies that they were not fully equipped to recognize matters of cybersecurity as a serious criminal concern. In sum, the Germany’s hacks not only demonstrate that cyber criminals will continue to play a role in international politics during 2019, but also the imperativeness of reacting to a threat as soon as it is realized.

Learn more about the latest in cyber security by subscribing to our blog; https://www.gigabitsys.com/news

Cybersecurity

News

Tips

Global Cyber-Terrorism: What Businesses Can Learn

November 21, 2018

•

20 min read

It is no secret that global cyber terrorism dominated headlines this year. In an era of “fake news,” and overall media skepticism, how should the international community interpret this attention? What explains this growing discussion lies in just how global cyber terrorism has truly become. Cyber-attacks, formerly covered as small incidents carried out by criminal organizations, are now associated with total war maneuvers leveraged by national governments to bring calculated, widespread devastation towards major businesses. Here are some causal trends associated with the growing global cyber terrorism crisis, and how your business can learn from these headlines.

The Expanding Cyber Landscape

Everything we seem to use, from personal to professional, has begun to go digital. One example includes traditional physical processes; even infrastructure industries (i.e. power utilities, water treatment services, and health and emergency systems) have shifted to online use. For example, imagine how a power grid interruption might affect your business. Now imagine if that power grid interruption was the result of a cyber-attack. What might this do to your bottom line?

To elaborate, some innovations within the electricity industry include automated controls; these are implemented through interconnected network systems. This automation, though efficient, creates a new opportunity for cyber-criminals to manipulate a business from within. If an attacker had access to these controls and effectively interrupted a power grid, the affected business should expect lost revenue, additional expenses to restore operations and improve cyber security defenses, regulatory fines, and reputational damage.

While the growing use of connected devices may be compatible for economies of scale, businesses should also consider how a digital world centralizes risk. How do we balance a need for more efficiency with the need to protect our systems and operations? These debates surrounding technology and the internet will likely continue throughout the decade as we become more connected. However, businesses need not choose, and can do both by investing and evaluating in an optimal cybersecurity infrastructure on an annual basis.

Don’t wait for a cyber criminal to attack. Contact Gigabit Systems today.

Advanced Threats: The Difference and the Significance

One commonly held myth among involves the intelligence of cyber hackers. While some define all hackers as evil geniuses, others maintain a more grounded thought in assuming that these are merely individuals trained by other individuals how to perform and complete a criminal task for profit. As the cyber landscape grows and grows, so does the scale of these attacks. Since many of these attacks now involve nation-states and their respective governments, 2018 has consequently seen an upsurge of highly skilled hackers.

This backing not only makes a hacker’s criminal intent more politically feasible, but fiscally feasible. With national backing, these hackers are not limited to their past tendencies of merely implementing knowledge passed on from their so-to-speak “colleagues.” As global cyber terrorism and its association with nation-state war tactics expands, so will the access to more sophisticated resources. Businesses must prioritize comprehensive internal IT training, complemented by external consultations, should their cyber security infrastructure remain equipped to combat contemporary threats.

The Future

The expanding cyber landscape is reflected in everything we see and do. With total war tactics identifying targets using the World Wide Web, businesses should understand their role as a potential victim and plan accordingly. It is with little-to-no doubt that we may assume the international community’s continued reliance on the internet in the decades ahead of us. In light of this reality, all businesses must realize that cyber security is more than just online protection, but a critical means of survival.

Learn more about the latest in cyber security by subscribing to our blog; https://www.gigabitsys.com/news

Cybersecurity

News

The Worst of the Worst: 3 Common Types of Cyber Attacks

November 25, 2018

•

20 min read

Cyber Attack: A cyber or internet based criminal stealing your private information

On the World Wide Web, the potential to fall victim of a cyber attack exists at every turn. Of these likely threats, what differentiates one from another? Here are some of the most common types of cyber attacks and how you can recognize one from another.

Ransomware

Ransomware is a type of malware that prohibits users from accessing either the system and/or personal files. In order to regain access, users are coerced into making a ransom payment. The first ransomware developed in 1980s; to regain access, users needed to send payment via snail mail. The malware has since evolved to keep up with the times, as authors now demand that payment be sent either via cryptocurrency and/or credit card.

Some common tactics used to spread ransomware involve malicious spam, otherwise known as malspam. You can identify a malspam message by an unsolicited email with foreign attachments used to entice the reader. These attachments could include PDFs, Word Documents, or malicious websites. Through social engineering, hackers are able to trick potential victims into a ransomware attack vis-a-vis clicking on attachments, links, and etcetera. For example, some cyber criminals will disguise themselves as a powerful entity, such as the Federal Bureau Investigation (FBI), in order to trick individuals into paying a large sum of money towards regaining file access.

DoS Attacks

Denial of services (DoS) cyber attacks flood a website with frivolous traffic in order to slow a website’s speed. The ultimate goal of these attacks are to take a website completely offline, and should be taken very seriously in their potential to threaten your business’s bottom line. By discouraging visitors, potential consumers will likely become frustrated, leave the website, and could even give competitors an upper-hand in acquiring new business. Making matters worse, these attacks are simple to execute and comparatively inexpensive. They are consequently one of the most common among cyber criminals. In fact, the average organization understandably faces approximately eight DoS attacks per day.

Businesses can detect a DoS attack by monitoring their website’s speed. Customers expect a website to load in 3 seconds or less, but any deviation of the norm should be noted and reported internally. While most servers completely crash during a DoS attack, error messages may also point to danger as well. Those looking to improve their DoS detection should explore the “Netstat” command, an evaluation tool found on any Windows or Linux operating system. The command yields detailed information about how your computer communicates with other computers or network devices. Such information is incredibly useful in identifying and troubleshooting any and all networking issues, especially when explored by well-skilled IT professionals.

Man-in-the-Middle Attack

Due to its inconspicuous nature, a man-in-the-middle attack is especially dangerous. Hackers are able to insert themselves into a two-party transaction and steal sensitive data from each party involved. There are specific circumstances that must be in order for a man-in-the-middle attack to thrive - acknowledging how these attacks are successful can become a preventative measure in and of itself. When a network is insecure, i.e. on a public Wi-Fi, attackers are seamlessly able to enter a two-party transaction. Hackers are also able to conduct Man-in-the-Middle attack if they were previously successful during a malware attack. If these hackers breached a device by using malware, the same hacker can install software that enables them to process any and all of the victim’s information.

Of course, businesses can effectively mitigate the opportunity of a successful Man-in-the-middle attack by making sure each and every one of their networks are secured. Such practices should be clearly communicated both inside and outside office premises - for example, if a company has a remote work policy for their employees, leadership must convey the necessity of conducting business on a secure, private network. By preventing malware, businesses can also prevent Man-in-the-middle attacks. Several external IT providers offer anti-malware software, however, such security can be compounded by keeping all operating systems up-to-date and free from unused software and applications.

Staying Ahead on Cyber Security

Several types of cyber attacks exist - while each have devastation in common, each type is unique. Understanding just how commonplace ransomware, DoS, and Man-in-the-Middle attacks thrive is a necessary part of any cyber security strategy. In sum, businesses should support continued education and learning about the different types of cyber attack threats that exist for the purpose of exploring all possible security alternatives.

Cybersecurity

News

New Year, New Me: How to Learn from 2018’s High-Profile Data Breaches

November 18, 2018

•

20 min read

From year to year, cybersecurity attacks continue at an exponential rate. In fact, the Identity Theft Resource Center reported that U.S. data breaches increased by 44.7% since 2016. Each and every business can learn from the shortcomings highlighted by specific 2018 cyberattacks in order to strengthen and progress their cyber-security. Below are three lessons to consider applying your business’s cybersecurity strategy and how other companies learned them by example.

Securing Your Security Department: Why Evaluation Measures are Viable

Earlier this year, Panera bread suffered from a data breach that leaked millions of customer records. The attackers captured this information from individuals who had placed their orders online. To make matters worse, the journalist who broke this story (Brian Krebs) was dismissed by the company’s information security team. In fact, the team deemed his findings as a “scam” when initially presented with them in August of 2017. Little did they know that eight months later, the company would need to take their website offline to patch the issue once and for all. Estimates reveal that 37 million customer records were compromised from this breach.

Don’t wait for a cyber criminal to attack. Contact Gigabit Systems today.

This case study ultimately revealed the flaws of Panera’s security approach. Although the company had an entire department devoted to implementing their cybersecurity strategy, the team failed to effectively identify an imminent threat in a timely manner. Had the company placed evaluation measures to assess the department’s approaches and measures, perhaps they would have mitigated some of the damage associated with the breach. Moving forward, businesses can evaluate their cybersecurity strategy by involving a third party. Involving a neutral, third party insight increases the likelihood of uncovering shortcomings that have internally gone unnoticed. Identifying and attacking these gaps through regular, scheduled security tests should be considered for all businesses looking to up the ante with their evaluation measures.

Keeping it Consistent: The Importance of Third Party Vendors

To elaborate on the topic of third parties, it should come as no surprise that a vendor’s strength should mirror their client’s. For example, Delta Airlines, who outsources some aspects of their customer service engine to an online chat services platform known as [24]7.ai, was forced to notify thousands of customers that their sensitive information had been exposed. This information almost exclusively was limited to payment information that customers had shared via the [24].7ai platform. Other companies who contract with [24].7ai, including Best Buy and the Sears Holding Corporation, also announced that they had customers potentially affected by this same breach.

To share your business’s data and services with another is to share the same values. For this reason, the security controls and measures of your vendors should be of the same or greater quality of your own business. As we transition in 2019, one important strategy to take away from this 2018 incident includes understanding how your vendors implement cyber security. Businesses should read up on each of their provider’s security protocols, and how compatible these are with your own team’s.

Maintaining Cyber Security

With data breaches showing little-to-no sign of slowing down in 2019, we’ve now approached a pivotal moment in cyber security. Within your business’s networks, ask yourselves - we have a strategy, we have an understanding of the issue, but how do we maintain its effectiveness? Overall, the data breaches of [24]7.ai and Panera Bread emphasize the need for quality control and maintenance in cyber security. Cyber security is no longer a foreign concept in 2018; it is reflected in security approaches across all industries and all markets. In sum, keeping these approaches effective and useful requires robust evaluation measures and value consistency when working with third party vendors.

Learn more about the latest in cyber security by subscribing to our blog; https://www.gigabitsys.com/news

Cybersecurity

News

Tips

High Risk, High Reward: The Cannabis Industry and Cyber Security

November 11, 2018

•

20 min read

Risk: A situation involving exposure to danger.

Reward: To make a gift of something to (someone) in recognition of their services, efforts, or achievements.

The Cannabis Industry: A combination of risk and reward that has become a target to hackers.

Cyber Security and The Cannabis Industry: The solution to keeping hackers out, and sustaining the future of the cannabis industry.

The Cannabis industry, while unique, is as vulnerable to cyber-attack as any other market. Its lucrative nature compels hackers to target cannabis businesses as they have amassed both private information and business intelligence, including social security numbers, bank account information, credit card information, etc. Instead learn from MJ Freeway, a cannabis POS software company that fell victim to hackers, and discover how to optimize the your cyber security, and prevent hackers from targeting your cannabis business.

‍Learning from the MJ Freeway Attacks

‍MJ Freeway, one of the first companies to create “seed-to-sale” tracking and business software for the legal cannabis industry, recently fell victim to a string of cyberattacks. The Denver-based firm offers tracking software for several state regulatory systems as well as 1,000 cannabis retailers across the United States. There were two attacks: one in November of 2016, and one in January of 2017. The November 2016 pertained to stolen information; this information included customers’ date-of-birth and contact information, but fortunately did not contain any Social Security identification and credit or debit card numbers. The January 2017 attack consisted of an outage of the company’s inventory system; due to an attack on both its main and backup databases, this left the firm temporarily unable to process transactions.By exposing the industry to recognize how cyber-hackers work, the MJ Freeway attacks set the precedent for why the cannabis industry must ensure the security of their point-of-sale (POS) system. Cannabis firms should regularly check-in with their POS provider to ensure full transparency regarding how to secure data, services, and privacy of patients.

‍Abiding by the Health Insurance Portability and Accountability Act (HIPAA)

‍HIPAA is a national legislation intended to maintain security of protected health information. Under this law, medical cannabis information must demonstrate compliance in order to treat any and all patients who hold a medical cannabis card. Regularly checking-in with your POS and and enterprise resource planning (ERP) software helps ensure that an entire company is in compliance with HIPAA. Another preventative measure regarding HIPAA includes how cannabis firms collect information. For example, restricting information collection to a need-to-know basis limits the pool of vulnerable content able for hackers to get a hold of.

‍Keeping your business safe from cyber criminals is priceless. But that doesn’t mean cyber security should cost more than your business is worth. Contact Gigabit Systems to find out how we can keep your business safe at a price you can afford.

‍Understanding Cyber Security in a Healthcare Context

‍The ability to perceive cyber-security as an essential part of the cannabis healthcare system will help your cannabis firm maintain perspective. When considering how and why today’s healthcare system is more efficient than 20 years ago, almost all of the reasoning points back to technology. The exchange of information occurs more quickly than ever before, as documentation is easily stored within networks, too.Cyber security keeps the healthcare industry up-and-running, not to mention provide life-saving services to their patients. By providing services like endpoint security, checking for vulnerabilities, penetration testing, and employee training, cannabis dispensaries and other businesses can keep their data safe and secure. Additionally, the POS software that is being used by the cannabis dispensary or other cannabis businesses, is only as good as its cyber security. Often times, the POS software will malfunction either by freezing, shutting down the software without permission, files are either corrupt or missing, etc. Many cannabis dispensary founders, owners, or CEO’s, don’t understand that it is not the software, but the lack of cyber security. These “glitches” or malfunctions are due to hackers gaining access to the software, and sending malware, phishing schemes, or just stealing private data.The cannabis industry needs to understand just what technology can do, both positive and negative, for a single firm. The sooner that cannabis firms realize just how vital secured networks are to their healthcare counterparts (hospitals, pharmacies, private practices, etc.), the more likely the cannabis industry will value cyber security as an essential function.

‍Cannabis and the Future of Technology

‍There is more to the cannabis industry than what meets the eye. As an essential function towards many individuals and their quality of life. A single cyberattack can cause real, physical human interference. In sum, by learning from the MJ Freeway attacks, abiding by the Health Insurance Portability and Accountability Act (HIPAA), and ultimately evaluating one’s cyber-security in the context of the health-care industry, the Cannabis industry can optimize their network security and continue to evolve.

‍Learn more about the latest in cyber security by subscribing to our blog;

‍https://gigabitsys.com/news

Cybersecurity

News

Cybersecurity: An Unsung Hero of Small Business

September 24, 2018

•

20 min read

Take a moment to think about what your day-to-day activities were ten years ago. From your morning routine to your nighttime rituals, now think about how those activities have transformed over the past ten years. More likely than not, the largest variation in these activities comes from the addition and expansion of technology’s influence in our everyday affairs. It is undeniable that technology provides each and every global citizen with the resources to reach larger audiences than ever before. Yet with great power comes great responsibility – technology’s influence wages just as large of a threat as it does a benefit. The international community and its discourse is more fascinated than ever with their phones, laptops, iPads, and etc., but why do small businesses neglect to realize technology’s most dangerous externality? More importantly, with technology showing little-to-no signs of slowing down, how should the small business community optimize their cyber-security processes? ‍

The impact of a single cyber-attack: How did we get here?

‍As discussed in an interview with Security magazine and Paul Barbosa, the Cyber Security Sales Director, U.S. Commercial, at Cisco, small businesses frequently misstep when it comes to their negligence of cyber-security. In a world as obsessed with their screens as ours, why does this mistake recur? More often than not, small businesses do not realize just how imperative a robust cyber-security management is until it is too late. For example, the cost of a single cyber-security breach can jeopardize a small business’s existence. Cisco’s SMB Cybersecurity study, “Small and Mighty: How Small and Midmarket Businesses Can Fortify Their Defenses Against Today’s Threats” reports that 53% of the survey respondents experienced a security breach. 54% of these attacks cost $500,000, an amount large enough permanently shut a small business’s doors. Notably, small businesses and midmarket organizations also reported to face less than 5,000 security alerts a day – 55.6% of those alerts were investigated.

Investigating on how a cyber-attack could injure a small business should also include an evaluation of potential productivity implications. Simply put, coworkers cannot work at an optimal speed post-attack. Systems will need repair and will likely be inaccessible, which can multiply the turnaround time of a single service. Cisco’s study found that small businesses experienced eight hours or more of system downtime due to a severe security breach in the past year. Even if a small business is not driven out of the market by a single breach, one attack’s ability to slash a small business’s productivity can also wage significant damage to long-run profits. Consider the immeasurable effort and time that goes into rebuilding and sustaining a positive reputation. When an unsuspecting cyber-attack plagues a small business, their clients and employees are consequently at risk of having sensitive information digitally shared. Since small businesses are required by law to communicate if a cyber-attack has compromised a client and/or employee’s data, this could build a lack of trust, and perhaps even a loss of clientele and reputation.

Proactivity versus Reactivity

‍If small businesses considered optimizing their cyber-security infrastructure as a means of remaining a favorable competitor, perhaps there would be more proactive than reactive means of establishing cyber-protection. A robust, sustainable cyber-security infrastructure should offer services that allow a small business to detect an attack before it reaches full throttle. Such management would save a business thousands of dollars, clients, and hours of productivity.

When keeping in mind the benefits from a proactive approach to cyber-security, Security’s four recommended best practices in cyber-security prove incredibly rational. Security recommends the following: driving simplification and integration, “quick wins,” internal security talent and/or partnering with a Managed Security Service Provider (MSSP), like Gigabit Systems. When used in conjunction with each other, these best practices suggest that small businesses develop security training from within. It is important to note that such internal enhancements do not promote isolation, and rather promote collaboration. Barbosa recommends working with a qualified training provider, such as a local university, as a great source of early-in career talent.

Another focus of developing training from within includes responsibility. In the event that a small business chooses to outsource their security management, risk ownership should remain with the SMB’s executive. This “quick win” allows small businesses to seek as refined of a professional expertise as possible, as quickly as possible. Such a decision will integrate the brightest and most reliable thought leaders in the field, while simultaneously ensuring their commitment to protecting their business’s unique, competitive functions.

Are you looking for an all-in-one IT solution? Look no further. Contact Gigabit Systems today.

Moving Forward

‍At the interview’s conclusion, Barbosa admits that more than half of security alerts going uninvestigated is the finding that surprised him most. He attributes this to different tools (such as, but not limited to: cloud systems, anti-virus protection and removal, Ethernet) failing to integrate with one another. All small business should make sure that all processes are in sync, regardless of which security processes are internal and external.

Yet another key takeaway in terms of determining what is next for small businesses and cyber-security lies in knowing that a “one-size-fits-all” model does not exist. There are recommendations, but no recipes. This is why small businesses are encouraged to learn from experts, like Gigabit Systems, as well was one another, about successes and failures in security management. Deciding what works best for a small business may take some time – the Cisco report also reiterates that slow change over time should be expected, and is better than no change at all.

Small businesses need a strong cyber security management plan in order to both survive and thrive in today’s markets. While these investments may have high start-up costs, ensuring that a SMB can effectively detect and combat an upcoming cyber threat can offset thousands of dollars in business-threatening expenses. It is recommend that small businesses continue to work within their staff, while collaborating with external stakeholders, to guarantee that our world’s evolving technologies continue to work in their favor. ‍

Learn more about the latest in cyber security by subscribing to our blog;

‍https://gigabitsys.com/news

Cybersecurity

News

Tips

Evaluating your Cyber-Security Approach: The Argument Against Return on Investments

October 15, 2018

•

20 min read

A company’s cyber-security strategy should tailor to the unique needs and characteristics of your business. When considering whether or not a strategy needs improvement, organizations will often ask one another about their security budget. This evaluation involves asking questions about whether or not the budget is similar to budgets of the same size, or how to calculate the return on investment (ROI) for security spending. On the contrary, corporate leadership should focus on network defender first principles instead of ROI as a means of evaluating a cyber-security’s efficacy. ‍

What Are Network Defender First Principles?

‍The first principles approach stems from Greek philosophy. Aristotle believed that first principles, atomic in their nature, couldn’t be broken down any further. As building blocks, first principles drive every decision that one makes. Keeping this in mind, ask yourself the following question. Is your organization, above any other priority, driven by what other organizations are doing? Most likely, the answer to the question is no. Comparing one organization to another and/or calculating ROI are rarely a motivation factor behind business decisions, but rather an afterthought.

In this example, let’s evaluate material impact as a security first principle. A single cyber hack can inflict hundreds upon thousands of dangerous consequences on an organization. If you decide to follow the lead of other organizations and determine an ROI in the process, you are inadvertently focusing on how to make a profit on diffusing a hack. This approach is inadequate, and should instead be sculpted around how dismantling a hack preserves your business’s most essential functions.

Keeping your business safe from cyber criminals is priceless. But that doesn't mean cyber security should cost more than your business is worth. Contact Gigabit Systems to find out how we can keep your business safe at a price you can afford.

How Should Leadership Determine its High-Probability Cyber Risks?

‍Instead of focusing on your cyber infrastructure’s ROI, your IT department should focus on identifying high-probability cyber-threats. These threats should, in theory, have significant material impact in a one to three year period. Leadership should hone in on which threats are the most probable in the short-term. This approach allows your IT department to think most realistically about what could pose a risk. Once these threats are identified, an organization will be better equipped to mitigate the risk of a successful attack sequence.

Seeking input from the senior level helps clarify which threats are more significant than others by putting these threats in the context of the organization’s greater functions and purposes. It is important to note that no threat can be thoroughly realized nor understood without proper metrics. According to Phillip Tetlock’s book “Superforecasting: The Art and Science of Prediction,” risk managers cannot be held accountable for their estimates if metrics did not play a deciding factor. This, in essence, explains why board members should adopt a quantified approach towards risk evaluation.

A quantified approach involves determining if a risk is detectable/observable. Douglas Hubbard, who expanded on Paul Meehl’s concept around clarification chains, affirms that a detectable risk should be detected as either an amount or a range of possible amounts. Any risk found to be a range of possible amounts could also be measured. Board members must therefore ensure that identified risks can be quantified and subsequently measured in its potential threat to the organization.

‍Current and Future Priorities

‍Your cyber-security priorities should echo the first defender principles of your organization. At the foundation of every decision your business makes, what are the bedrock factors? If this is not echoed in your cyber-security defense, changes are in order. A return of investment approach to security infrastructure fails to account for top organizational priorities, such as keeping a business’s unique functions, goods, and services productive at all times. In summary, the more that a board collaborates with their own IT department to identify plausible, metric-backed risks within a specific time frame, the more likely a board is to promote a robust cyber infrastructure.

‍Learn more about the latest in cyber security by subscribing to our blog;

‍https://gigabitsys.com/news

Cybersecurity

News

Lessons Learned: Evaluating Cybersecurity in the context of Maersk

October 1, 2018

•

20 min read

Businesses continue to rely on technology more and more as a means of making their goods and services more affordable, useful, and accessible. By consequence, these digital systems encompass large volumes of information – however, where does this information go? Who can access our information? How do we know this information will be secure, and not maliciously utilized?

‍Cyber-Emergency Preparedness under Maersk

‍When concerning cybersecurity, ignorance does not mean bliss. For example, Maersk demonstrated that they did not have a robust cybersecurity infrastructure in place to effectively detect the attack. During a cyber-attack in June 2017, employees first suspected danger once they saw disturbing, abnormal messages on their screens, with some different than the next. After almost two hours, the IT department effectively disconnected the company’s entire global network. This would be the first of many efforts by the IT department to demonstrate their cybersecurity capabilities.

All personnel were required to shut down their computers and phones, with some employees even sent home for the day. The hackers not only cut corporate productivity down to a sliver, but Maersk’s shipping terminals too were inoperative. In Elizabeth, New Jersey, vehicles were lined up for miles outside Maersk’s shipping terminal; since their gate shut down for the day, every customer was unable to get their cargo in and out of the gate.

Ultimately, Maersk was able to withstand the attack and remain in business. Their recovery strategy began strictly by chance – during the attack, one remote office in Ghana had a power outage. This allowed Ghana to retain an unaffected copy of the company’s server system map, which the company’s IT department used for an offline data backup. Had Ghana’s office been online during the attack, no offline data backup would exist. Most importantly, the company would have been completely shut down. Over the ten days immediately following the attack, the company’s IT department reinstalled 4,000 new servers, 45,000 new PCs, and 2,500 applications. Maerk’s chairman Jim Hagemann Snabe, who previously worked for the IT Industry, notes that the ten-day effort usually takes around six months.

“It is nearly impossible for any business, no matter how lucrative, to unsuspectingly face nine figures worth of damages without any fear of what the future might hold.”

NotPetya and their Impact to Global Technology

‍The term “warfare,” instead of conventional artillery, now encompasses both technology and the World Wide Web. A prominent example includes the battleground between Russia and the Ukraine. Russia’s cyber offense includes a group of agents (called Sandworm) that hacked into dozens of the Ukrainian government’s organizations and companies. During June 2017, Sandstorm released their most dangerous cyber weapon to date, known as NotPetya. Sandstorm effectively deployed this malware by identifying thousands of PCs around the country and the world that have M.E.Doc (an accounting software). Sandstorm entered a code that spread the NotPetya malware faster than any of its viral predecessors.

NotPetya indiscriminatingly wreaked havoc on machines across the world. Not only did Maersk feel the devastation, but also several multinational companies faced crippling destruction, including pharmaceutical giant Merck, FedEx’s European subsidiary TNT Express, and French construction company Saint-Gobain. While the average cost for a small business to recover from a cyber-attack amounts to $500,000, each of these multinational companies inflicted nine-figure costs to repair from NotPetya’s wrath.

It is nearly impossible for any business, no matter how lucrative, to unsuspectingly face nine figures worth of damages without any fear of what the future might hold. NotPetya will always be a nightmare-case scenario in the dimensions of cybersecurity. Think of the devastation felt across Europe during World War II, where “total war” strategies waged unrestrained warfare aimed at the total destruction of military and civilian populations. The majority of ports in Europe and many in Asia had been destroyed or badly damaged. Now, think of how the terms of military engagement have expanded to digital realms, and how said warfare could attack far beyond the intended target.

Don’t wait for a cyber criminal to attack. Contact Gigabit Systems today.

Technology, Cybersecurity and the Future

‍Technology is continuously changing the landscape of how we share our information, optimize or systems and processes, and in the most dangerous of cases, fight our battles. Our phones, tablets, and laptops, specifically the information we share on these devices, are more desired, and targeted from afar, discrete locations than any precedent. Individuals and businesses alike must be mindful of how technology makes our information not just valuable, but attainable.

We consider technology as a means to (in layman’s terms) make our lives easier, we hardly look up from our phones enough to consider the possibility that technology could make our lives more difficult. Although Maersk survived the NotPetya cyber-attack, the malware should serve as an example for businesses across the international community about the potential consequences of not having a sustainable cybersecurity system, as well as the essential necessity for regular offline data backups. The Maersk example provides context to how how total war tactics between two nations can threaten cybersecurity, and even jeopardize a multinational corporation’s bottom-line. Given this context, NotPetya should exist as both a warning and an international standard for all cybersecurity infrastructures to detect and dismantle.

Learn more about the latest in cyber security by subscribing to our blog;https://gigabitsys.com/news

Cybersecurity

News

Head in the Clouds: Why IT’s Value of Cloud Security is Just Beginning

October 8, 2018

•

20 min read

It should come as no surprise that companies both small and large are concerned with keeping their security solutions relevant with global trends in technology. As told in a new Threat Stack report, over half of companies worry that they may soon outgrow their current security solutions. A Threat Stack press release insinuated that this widely held opinion has inspired a growing interest in cloud workload security. With information technology budgets also on the rise, companies should pay close attention to cloud security and its advantages in making a business competitive.

‍The Corporate Feasibility of Cloud Security

Companies must ensure that investments into refining security systems and processes offer the most “bang for their buck.” As demonstrated by present trends in IT infrastructure, statistics prove that there is a climate for cloud security to grow. For example, only 41% of respondent infrastructure operates on an office’s premises. Alternatively, infrastructure options such as laaS (25%), PaaS (17%), and containers (10%) have become more favorable. However, there is still some hesitation regarding whether or not to invest in cloud security. This may come as a surprise, as we are beginning to see businesses spend more money than ever before on information technology (a 19% IT budget increase on average, for example). Yet using the same data sample, Threat Stack’s press release also found that 90% of businesses are struggling with budget allocation. This implies that while there is growing interest in how cloud security can benefit your business, corporate leadership still struggles to determine if it’s congruent with overarching budget considerations.

Why might this be? One idea suggests that there is simply not enough awareness surrounding how cloud security operates. It is hard to generate support for a tactic without fully comprehending what there is to support and how a difference might actually be made. Cloud security offers several levels of control within network infrastructure, consequently providing continuity and protection for cloud-based assets such as websites and other web applications. If corporations do not circulate internal communications explaining cloud security and how such mechanisms keep data secure, it will likely remain unpopular, hard to implement, and ultimately unfeasible.

Are you looking for an IT company that specializes in Cloud Security while staying within budget? Contact Gigabit Systems.

What Cloud Security Can Offer Your Business

‍Think about how many minutes you could have saved if every morning this year, you didn’t have to think twice about knowing where your keys were. The logic behind this, in essence, advocates for cloud security – when data is saved under a cloud application, there is rarely a concern about how a loss of a physical device might affect your access to information. Cloud security’s ability to withstand physical emergency also suggests its compatibility with emergency preparedness. The ability to keep data secure from physical elements (natural disasters, power outages, etc.) also advocates for improved productivity. Cloud security also enhances productivity by providing consistent, 24/7 protections for a company’s assets. By keeping IT constantly monitored throughout the year, businesses can confidently work at any time of the year at optimal security levels. Cloud security also gives employees the opportunity to collect their knowledge from a single location, at any location. Yet with the power to access information across borders comes the responsibility to ensure their security. By encrypting all data, cloud security encourages easy and safe information exchanges between employees. This is particularly beneficial to businesses whose team members live in a different geographic location, but share projects and/or responsibilities.

‍The Future of Cybersecurity is in the Cloud

‍Businesses that are looking to pivot towards updating their information technology infrastructure should consider cloud security mechanisms as a means of keeping their data secure. While the initial start-up cost and uncertainty about how cloud security operates may discourage corporate leadership from investing, advantages to data’s physical security and business productivity certainly outweigh the risk. As IT budgets expand, we encourage businesses both small and large to learn more about cloud security and how its IT innovations catalyze new opportunities and growth.

‍Learn more about the latest in cyber security by subscribing to our blog;

‍https://gigabitsys.com/news