Contact Us

Cybersecurity Training for Your Workforce

hctechguysdev on October 31, 2022

Recent hacks at Uber and Rockstar games have many companies on edge, wondering about their own security. For many, the hacks have highlighted a huge vulnerability that every company has, regardless of size and industry. Human error. The number one vulnerability for any company is their employees. Let’s be clear, we’re not saying your employees are out to intentionally sabotage your company. That might actually be easier to spot and stop. Rather, we’re saying that the unintentionally bad call is easy to make. This is why ongoing cybersecurity training for your business is vital. Mark Jordan, Director of Cybersecurity at Hill Country Tech Guys echoed the need for ongoing conversations around the hack. “Time and time again, massive breaches like this one are the result not of highly sophisticated intrusion methods, but rather tricking an unsuspecting employee into simply opening the door for them.”

How Was Uber Compromised

cybersecurity training blog post quote "time and again, massive breaches like this one are the result not of highly sophisticated intrusion methods, but rather tricking an unsuspecting employee into simply opening the door for them."Most companies have 2 factor authentication or multi-factor authentication set up for access by employees to their tools. These systems create checkpoints to ensure that the person(s) attempting to gain access do in fact have permission to do so. In Uber’s case a push notification was spammed to employees repeatedly until someone finally accepted the request, granting access to the threat actor. The consequences are dire.

The solution isn’t as clear as the threat, and that’s a big problem for most companies. There’s no one thing you can do to stop threats from coming. The numbers paint a frightening picture of the current landscape of data sabotage in 2022.

According to The State of SMB Cybersecurity in 2022 from ConnectWise, “76% of SMBs in the 2022 study have been impacted by at least one cybersecurity attack, a considerable increase compared to 55% that said this in 2020.”

What Basic Steps Can You Take to Help Protect Your Company from Threats?

  1. Cybersecurity Training for Employees

    When most organizations think of cybersecurity training, they likely envision a one-time training on how to securely operate. This simply isn’t enough. According to the same report, 67% of companies don’t feel they have the in-house skills to adequately handle security issues. If a company the size of Uber, with the IT and security budget to match was so easily taken down its not far-fetched to assume it would likely be just as easy, if not far easier to compromise most small and medium businesses.

  2. 2-Factor and Multi-factor Authentication

    Yes, the hacker was able to socially engineer their way through these systems but that doesn’t mean they shouldn’t be a component of your company’s security. These systems are built to be a sort of armor for passwords. Passwords are (generally) created by the user, making them easy to figure out because people often use information they can easily recall like names, birthdates, pets, etc. Additionally, there are programs that can be run to try infinite combinations until they crack the “code.” Further authentication is just a double check. It’s like your computer, phone, or account saying “hey, just want to be sure this is really you?”

  3. Robust Passwords That are Frequently Updated

    small infographic about how strong passwords are an essential part of cybersecurity training for employeesThis seems like a no-brainer but as we stated earlier, people like to create passwords that are easy to remember, often using the same password across multiple devices and accounts. Ensuring a minimum number and the use of special characters will significantly increase the security of every password in the organization. Requiring employees to update these passwords frequently will help keep your defenses tight.

  4. Communication is Key

    If your employees don’t know what the vision is, how can they help your organization achieve it? Including your workforce in conversations around the goals and roadmaps to meeting those goals is vital to the creation of an effective security protocol. When the policy changes (and it should change and grow with your organization), employees need to be updated. Often these updates are cascaded by email but there are more effective ways to have these vital conversations. Utilize staff/ departmental meetings. Have leaders create videos explaining the updates and their significance. Invite employees to ask questions.

Ongoing Cybersecurity Training Makes a Difference

People tend of think of “hacking” as this complex system. Often, access is gained because the users are lazy. They may not even realize they’re being lazy; they’re just trying to be efficient. So are threat actors. They’re looking for the easiest in. Make your company a harder target to hit. Educate your workforce on the threats and the simple steps they can take, or in Uber’s case not take, to help keep things secure.

Make security an ongoing conversation. It shouldn’t be a one-way communication. Cybersecurity training shouldn’t be one-way communication. Make it an ongoing conversation with your workforce. Engaging your employees on any topic will lend itself to more buy-in. Security is no different.

 

Block and Tackle Cybersecurity

hctechguysdev on March 18, 2022

Block and Tackle Cybersecurity

 

If it seems like all we’re reading in the news recently is “Cyberattack this” and “ransomware that…” it’s because the new reality for businesses is a world where nobody, regardless of size, are safe from cyber threats. Gone are the days of “I’m too small to be an attractive target.” While this seems like a bleak forecast, and it is, it should be a wake-up call to become more aware of what these threats look like and how they can happen. As ransomware groups continue to grow their knowledge in selecting victims and carrying out attacks, it is important for all businesses small to large, schools and other organizations truly take cybersecurity seriously. One strategy to start when taking security seriously is Block and Tackle Cybersecurity.

 

No One is Immune

Many small to mid-size businesses (SMB) owners underestimate their risk to cyber threats. In a recent poll 42% of small businesses experienced a cyber-attack in 2021, with email spear-phishing attacks leading the pack for methods of compromise. Spear phishing are target attacks customized to explicitly fool a specific business, or individual. Gone are the days where attacks like these are reserved for high profile companies.

 

According to a Cyber Threat Report released by SonicWall, the world saw an alarming 148% uptick in ransomware attacks in 2021. These numbers are also predicted to rise in 2022. From colleges and government entities to small doctor’s offices and retail businesses… there’s no limit or filter to who ransomware groups will choose which is why more and more skilled IT cybersecurity experts are leaning on a proactive block and tackle cybersecurity strategy.

 

Block and tackle Cybersecurity… What is it?

“Football is two things. It’s blocking and tackling. I don’t care about formations or new offenses or tricks on defense. You block and tackle better than the team you’re playing, you win.” – Vince Lombardi

 

While that quote does apply to football, we can also look at it from a cybersecurity standpoint. Foundational items such as security awareness training, thorough and efficacious patching, and written security policies and paramount to creating an effective defensive line against wrong doers.

 

The Best Defense is Only the Beginning…

George Washington stated “…offensive operations, often times, is the surest, if not the only means of defense…” and the keys to offensive security lie in the assumption that your business is already compromised. The traditional mentality views our networks as a “fortress” of which we defend a hardened parameter; Meanwhile modern adversaries exploit us from the inside by taking advantage of untrained and unaware employees, and reactive security policies targeted at static, externally inward threats. By assuming these threat actors already operate in our networks, we move towards the zero-trust mindset of containing and mitigating breaches, moving threat management from the reactive realm to the proactive.

 

The current state of our technological world might make effective, proactive cybersecurity seem like a daunting task, but Hill Country Tech Guys are here to be to be both your offensive and defensive lines against malicious threat actors. We utilized bleeding edge tools, expert staff, and proven strategies to help your business build a modern, dynamic security posture.

 

4 basic things your SMB needs for DIY cybersecurity

hctechguysdev on August 20, 2018

DIY cybersecurity is an issue all SMBs need to consider. Cyberattacks on SMBs is on the rise, require heavy investment to fix, and put many SMBs out of business. Many SMBs find that working with a managed service provider and backing up in the cloud is a good cybersecurity alternative.

Surefire Steps for Complete Network Security

hctechguysdev on November 29, 2017

At Hill Country, we want to ensure your business can handle and overcome all the latest security threats. With the right security solutions and services to watch your back and back you up, you can work with greater flexibility, confidence and productivity.