Posts

Small Business Cybersecurity: 5 Steps to Stop Cybercrime 

Cyber Security Tips to protect your business - John Sileo

Small Business Cybersecurity Gone Terribly Wrong 

On August 12, 2003, as I was just sitting down to a tea party with my daughters and their stuffed animals, the doorbell rang. Standing there when I opened the door was a special agent from the economic crimes unit at the district attorney’s office—ready to charge me for electronically embezzling (hacking) $298,000 from my small business customers. The DA’s office had enough digital DNA to put me in jail for a decade. 

I was the victim of cybercrime, and I should have known better. You see, earlier that year my personal identity was stolen by cybercriminals out of my trash and sold to a woman in Florida. This woman purchased a home, committed a number of crimes, drained my bank accounts and filed for bankruptcy—all in my name. I learned all of this one day at the bank, right before I was escorted out by security guards.

The experience of losing my money, time and dignity motivated me to protect my personal information assets with a vengeance. Unfortunately, I didn’t apply my newfound cyber vigilance to my small business, which is how I ended up losing it. 

Like a lot of small business owners, it never occurred to me that my $2 million company would be targeted by cyber criminals. I figured we weren’t worth the effort, especially compared to large multinational companies like Target, Marriott, Google and Facebook. My naivete cost me my family’s business and two years fighting to stay out of jail. 

The fact is, cyber criminals are increasingly going after small and midsize businesses (SMBs) precisely because they are easier targets than larger organizations. According to the Ponemon Institute’s most recent Global State of Cybersecurity in Small and Medium-Sized Businesses report, 76 percent of  small and midsize businesses experienced a cyber attack in the past 12 months. The same report found that only 28 percent of companies characterize their ability to mitigate threats, vulnerabilities and attacks as “highly effective.” 

Not all hacking results in criminal charges being filed against the victim, as in my case, but that doesn’t mean there aren’t significant costs involved. According to last year’s Ponemon Institute study, companies spent an average of $1.43 million due to damage or theft of IT assets. On top of that, the disruption to their normal operations cost companies $1.56 million on average. 

In other words, your organization’s chances are greater than 50/50 that it will suffer a serious cyber attack in the next year or so and that the attack will have a significant negative impact on profitability. The good news is that you can eliminate much of the risk with a reasonable budget and some good leadership.

5 Small Business Cybersecurity Strategies

In my experience, good entrepreneurs begin with the following steps:

Identify All data is not created equal. Bring together the key players in your business and identify the specific pieces of data, if lost or stolen, that would make a significant impact on your operation, reputation and profitability. This could be everything from customer credit card, bank account or Social Security numbers to valuable intellectual property.

Evaluate Understand your business’ current cyber security readiness. During this step, I recommend bringing in an external security firm to conduct a systems penetration test. A good Pen Test will give you a heatmap of your greatest weaknesses as well as a prioritized attack plan. Have a separate IT provider implement the remediation plan, if possible, to provide an objective check on the security firm’s work. 

Assign Engage stakeholders from across your organization, not just those within IT. Assign a detail-oriented, tech-savvy leader other than yourself (if feasible) to oversee the analysis and implementation of your cyber strategy. Other players essential to this conversation are your lawyer and your accountant/auditor, who can help you build a breach response plan for when data is compromised. In today’s digital economy, theft and loss are part of business as usual and they should be planned for—like any other risk to your organization.

Measure Just as with any other business function, cyber security needs to be measured. Your security or IT provider should be able to suggest simple metrics—number of blocked hacking attempts (in your firewall), failed phishing attacks, days without a breach, etcetera—with which to keep a pulse on your data defense. 

Repeat Each one of these steps should be re-evaluated and updated on a regular basis. I recommend taking a look at your security during your slowest season annually. Strong cyber security thrives in the details, and the details in this realm change every year. 

The bottom line is that SMBs can no longer ignore the very real threat of cyber crime, including crime perpetrated by an insider (in 2018, 34 percent of data breaches involved internal actors and 2 percent involved partners). I learned both of these lessons the hard way. It takes an average of 73 days for organizations to contain an insider-related incident; my case dragged on for two years, during which I spent every day fighting to keep myself out of jail. 

In the end, I found out the cyber criminal was my business partner. A man I loved and trusted like a brother stole and used my banking login credentials to embezzle from our clients; he used my identity to commit his cyber crimes. He exploited my trust and then he cut the rope and let me take the fall. 

And I should have known better. So if you think your company is too small to be targeted or you’re too smart to be victimized, think again. 


About Cyber security Keynote Speaker John Sileo

John Sileo is the founder and CEO of The Sileo Group, a cybersecurity think tank, in Lakewood, Colorado, and an award-winning author and Hall of Fame Speaker who specializes in providing security-awareness training to small businesses as well as large organizations. He has shared his experiences on “60 Minutes,” “Anderson Cooper” — and even while cooking meatballs with Rachael Ray. John earned a BS with honors in political science from Harvard University. 

 

Conference Preview: 'Thieves, Hackers, and Facebook Attackers'

February 26-28 will mark the presentation of the National Association of Federal Credit Unions (NAFCU)'s Technology and Security Conference in Austin, Texas. A keynote speech at the event entitled "Thieves, Hackers, and Facebook Attackers: Credit Union Privacy Survival in a Social World," will be given by fraud expert John Sileo. The talk will present credit unions with the knowledge they need to help stop fraud before it starts. 

Online security is more perilous and precious than ever. In times of constant attack, how will you keep your information safe?

Social media, data sharing and the wonders of the cloud all offer so many advantages to modern commerce that the myriad dangers often go unseen. Who has access to your data? What kind of habits are you enforcing? We live in a time where we are asked to scatter our personal information to the wind without a second thought – and we often do.

This presentation aims to help credit unions figure out what they're doing wrong and will teach them how to keep their enterprises afloat. Topics will include:

  • The hazards of social connectivity
  • The particular threats targeting credit union security
  • What steps you can take to combat them.

The talk will also focus on efficient methods of prevention, such as fraud awareness training and the use of proper tools and methods you may not even know exist. The NAFCU is right to recognize the importance of these issues. Enemies to your company are going to be crafty, but you can outwit them with the right preparation.

Many businesses are aware that threats are lurking, but are unsure where to begin to take action. This discussion will help point concerned parties in the right direction towards better cyber data security.

John Sileo is an online privacy expert and keynote speaker on social media privacy, identity theft and fraud. His clients included the Department of Defense, Pfizer, and Homeland Security. See his recent work on 60 Minutes, Anderson Cooper and Fox Business.

Gadgets Attract Thieves at Starbucks – Privacy Project Episode #01

On this episode of Privacy Project, John confronts a coffee drinker about leaving their laptop totally alone as they talked outside on the phone at Starbucks.

America’s top Privacy & Identity Theft Speaker John Sileo has appeared on 60 Minutes, Anderson Cooper, Fox & in front of audiences including the Department of Defense, Pfizer, Homeland Security and hundreds of corporations and associations of all sizes. His high-content, humorous, audience-interactive style delivers all of the expertise with lots of entertainment. Come ready to laugh and learn about this mission-critical, bottom-line enhancing topic.

John Sileo is an award-winning author and keynote speaker on the dark art of deception (identity theft, fraud training, data privacy, social media manipulation) and its polar opposite, the powerful use of trust, to achieve success. He is CEO of The Sileo Group, which advises teams on how to multiply performance by building a culture of deep trust.

Don't Get Cyber-Scrooged on Cyber Monday!

Why fight parking-lot-road-rage, UFC-sanctioned-psycho-shoppers and 12 a.m.-midnight-start-times on Black Friday when you can shop from the comfort of your laptop or iPad while sipping eggnog on the couch (or more likely, from your office desk)? I’m talking about Cyber Monday, of course – the day that online merchants heavily discount their products and generally give free shipping as well. By shopping online, you get most of the same deals and discounts (some of them better) without the breakneck competition common in stores the day after Thanksgiving.

Online shopping during the holidays is a convenient, green, inexpensive way to celebrate the season with less stress. In fact, it’s such an efficient way to buy gifts that cyber shoppers will spend close to $2 Billion this coming Monday. If you are one of them, take a few steps to add peace-of-mind to your peaceful holidays.

How to Protect Your Private Data Online on Cyber Monday

  • Never Shop on a Public Wi-Fi Connection – Although you may trust the baristas at your local coffee shop, you can’t always trust the person sitting next to you. Hackers can easily tap into Wi-Fi connections at public hot spots to steal your identity information. This can be especially dangerous when you are making purchases with your credit card on unsecured connections. Options: surf at home or set up Internet Tethering between your smartphone and laptop or tablet so that you are always surfing on an encrypted connection. Unlike most hot-spot transmissions, your mobile phone communications are encrypted and will give you Internet access from anywhere you can make a call.
  • Never use a debit card online – If your card information is compromised, funds can be withdrawn from your bank account without your knowledge. Federal law states that your bank can take up to 2 weeks to investigate fraudulent activity before returning the funds to your account, which means you have nothing to spend in the meantime.  In fact, if you don’t report the missing funds quickly, you could potentially lose all the money on deposit with your bank.
  • Monitor Your Accounts – While you are doing a lot of shopping – online and in the store – it is good to keep an eye on your bank and credit card accounts. Match your receipts up to your statement to make sure that they are correct and there are no fraudulent charges. Keep an eye out for small charges, sometimes that is how crooks test to make sure they have a good card. For convenience, set up credit card account alerts that automatically email or text you every time you make a purchase. It makes detecting fraud a snap.
  • Consider using a virtual or single-use credit card – Some card issuers offer virtual credit cards or single-use card numbers that can be used online. Virtual credit cards use a randomly generated substitute account number in place of your actual credit card number.
  • Never “recycle” a password – Most online shopping sites encourage you to establish a user name and password. Password-protected sites are becoming more vulnerable because people regularly use the same user names and passwords on multiple websites. But do you really want an online retailer to know the password to your online bank account?  If you are using the same password across many sites and your password for one site is breached, everything else is at risk. If you do decide to create a user name and password, make sure it is adequately strong. To assist the creation and safe storage of different passwords, use a password protection software like 1Password.
  • Protect your passwords and personal data – Do not share your passwords with anyone and never provide your social security number, birth date or mother’s maiden name in an email.
  • Only Shop on Trusted Websites – Don’t just let the search engine pick the site for you, make sure you are using a trusted and well-known website. Type in the direct web address for the stores you are familiar with, and don’t shop on price alone.
  • Look for Signs They are Protecting Your Data – On the Web page where you enter your credit card or other personal information, look for an “s” after http in the Web address of that page and a secured padlock (as shown below). Encryption is a security measure that scrambles data as it travels through the Internet. 
  • Make sure all of your security software is up-to-date before you shop online – That includes anti-virus software, anti-spyware and firewalls.

Take a break on Black Friday. Who knows, maybe you’ll start to think of it as White Friday.

Cyber-Bullying and Social Networking Identity Theft

With the meteoric rise in cyber-bullying, parents are desperate to find a way to shield their children. Unfortunately, most parents are far behind their child’s proficiency with technology. Many don’t text, aren’t on Facebook, and are oblivious to the many ways in which kids can taunt each other with technological ease. Although children may be quick and nimble with technology, they lack the maturity to understand its consequences.

A recent article in the New York Times on Digital Bullying (read the MSN version here) addressed these very issues and gave true and heart-wrenching accounts of how parents were left helpless at the hands of their children’s online bullies. “I’m not seeing signs that parents are getting more savvy with technology,” said Russell A. Sabella, former president of the American School Counselor Association. “They’re not taking the time and effort to educate themselves, and as a result, they’ve made it another responsibility for schools.”

Kids have a great deal of anonymity on the internet if they want it, and can easily impersonate another child or steal their identity. This modified form of identity theft (character theft, I tend to call it), allows the bully to hide behind his or her computer with no real consequences for what they are saying. A scathing remark made in passing by one child can haunt another child for the rest of their lives.

In a recent case, a young boy was taunted at school by classmates that claimed he was in turn bullying them on Facebook. He quickly became socially withdrawn until his mother looked on Facebook to see that someone with his name and picture was in fact taunting other students online. Except, of course, that it wasn’t him. Some fellow classmates had stolen his Social Networking Identity and set up a false Facebook account as if they were him. The bullies then berated other kids, attracting negative attention to the victim. The victim’s mother found out that it’s not so easy to stop this cycle.

For one thing, Facebook doesn’t make it easy to reclaim one’s identity. In the previous case, the mother had to contact police, who went through a process to subpoena both Facebook and the internet service provide to uncover the bullies’ identities. Only then were they able to shut down the account, but the damage to the victims reputation had already been done.

Some parents prefer to resolve the issue privately, by contacting the bully’s family. Although psychologists do not recommend that approach with schoolyard bullying, with cyber-bullying, a parent’s proof of cruel online exchanges can change that difficult conversation. So what do you say?

Approaching another parent can be awkward. Most parents see their children’s actions as a direct reflection of their ability to raise their child. This means they can easily become defensive and almost submissive of the actions. As quoted in the Times article, experts recommend you follow a script like:

“I need to show you what your son typed to my daughter online. He may have meant it as a joke. But my daughter was really devastated. A lot of kids type things online that they would never dream of saying in person. And it can all be easily misinterpreted.”

In most situations, the reporting parents should be willing to acknowledge that their child may have played a role in the dispute. To ease tension, suggests Dr. Englander, an expert on aggression reduction, offer the cyber-bully’s parent a face-saving explanation (like that it was probably meant as a joke). If they are willing to accept what happened, they are more likely to take action.

Parents need to be mindful that their children might be victims of cyber-bullying, and they need to be just as aware that their kids might be the cyber-bullies. Here are some steps to get you started down the right track with your kids:

  • Have short, frequent coversations over dinner about what it means to be cyber bullied
  • Establish a no-tolerance stance on your child bullying anyone, in person or on line
  • Friend your child and if possible, your child’s friends to keep tabs on the dialogue taking place. Let them know that you are interested and observant by communicating with them using social networking. If you are more fond of the stick approach, post a sticky note on your monitor (like another parent in the article did) that says “Don’t Forget That Mom Sees Everything You Do Online.”
  • Be open and honest with your child. Communicate the real issues of cyber-bullying and how in some cases this leads to very negative consequences, like suicide
  • Encourage your children to talk with you if they have any concerns about their online life
  • For more answers and background on keeping yourself and your kids safe, take a look at the Facebook Safety Survival Guide below.

Facebook Safety Survival Guide
Includes the Parents’ Guide to Online Safety

This Survival Guide is an evolving document that I started writing for my young daughters and my employees, and is an attempt to give you a snapshot of some of the safety and privacy issues as they exist right now.

Social networking, texting, instant messaging, video messaging, blogging – these are all amazing tools that our kids and employees use natively, as part of their everyday lives. In fact, they probably understand social networking better than most adults and executives. But they don’t necessarily have the life experiences to recognize the risks.

I’d like to make their online vigilance and discretion just as native, so that they learn to protect the personal information they put on the web before it becomes a problem. Social networking is immensely powerful and is here for the long run, but we must learn to harness and control it.