October is National Cyber Security Awareness Month. With so much being in the news with The Home Depot, Target, and the plethora of continued phishing and email scams - we wanted to bring a few vulnerabilities to light to remind everyone of cyber security best practices. Now keep in mind, cyber crimes are wide and varied, so covering all of them would be a monumental task. We just want to take the time to highlight three in order to get you moving toward a more secure posture. First up, The Debt Elimination Scam:
Debt Elimination
The “Its Too Good To Be True” Scheme
The Bad Actor: Seemingly legitimate websites that promote a virtually unknown but "legal" way to eliminate your mortgage loan or credit card debt.
The Pitch: For only about $2K, these "trained professionals" will eliminate your debt on your behalf. You don't have to lift a finger!
The Hook: In order for these honest folk to act on your behalf, you will need to give them all the particulars of your debt plus sign a power of attorney document authorizing them to enter into financial transactions on your behalf.
The Sinker: Once you have given them this information, you are only seconds away from them stealing your identity and racking up additional debt.
What You Can Do:
- Only deal with businesses that you verify:
- Do your research, make sure they have a physical address
- Do they have a telephone number that you can call
- Go online to the Better Business Bureau in your area:
- Check their rating with the BBB
- Check how long they have been in business
- Do they have any outstanding issues with customers
- Do not deal with anyone outside the U.S.
- Do not deal with companies with only a P.O. Box
- If it sounds too good to be true, it probably is.
To learn more about online or email scams, please visit: http://www.fbi.gov/scams-safety/fraud/internet_fraud
Malware
Death by Web or Email
The Definition: Short for malicious software, it is used to either take down a computer, gain access by an unwanted party, or scrape data without your knowledge.
The Bad Actor: This can be anyone with ill intent. You can have anyone from your run-of-the-mill hacker, to corporate spy, to governmental intruder.
How They Gain Access: Normally this is done in two ways, email or web surfing. For emails, they commonly want you to download a picture or click a link - because either of those actions can contain a secret action of downloading the malware. Similarly, websites are constructed with links that will download malware with only one click.
What Do They Want: They may want to take down your computer with a virus, hold your data for ransom, steal your data, or spy on you.
What Can You Do:
- Install anti-virus and anti-malware software and keep it up to data
- Regularly scan your computer for malicious software
- Immediately send all emails that you do not trust to the spam folder
- Immediately surf away from websites that you think are suspicious or spammy
For this one, look no further than good ol' Wikipedia for more info: http://en.wikipedia.org/wiki/Malware
Thumbsucking
Keep it Secret, Keep it Safe
The Definition: I know, this seems like a problem for toddlers, but this is a real issue for businesses as well. Thumbsucking is when someone uses a USB portable drive or "thumb drive" to download data without the data owner's consent.
The Bad Actor: This can be anyone from a corrupt office worker to an unwanted visitor to the business.
How They Gain Access: Since most USB ports are on the inside of firewalls and passwords, gaining access is only one connection away.
What Do They Want: They want your sensitive data. Anything that could be sold in the criminal underground or to a rival business is up for grabs.
What Can You Do:
- Encrypt all sensitive data
- Use proper key management for your encryption
- Set clear policies for which devices are allowed in critical areas of the business
- Have strict permissions as to who can access the data:
- Protect via password
- Use two factor authentication
To learn more about the threats of thumbsucking, head on over to: http://www.csoonline.com/article/2119244/identity-theft-prevention/the-thumb-sucking-threat.html
What Should You Be Thinking Right Now
The threat landscape is changing. As the honest business and consumer becomes more tech savvy, so does the criminal. To paraphrase the oft-used quote, "eternal vigilance is the price of online freedom." More productivity and possibilities come with more risk. So follow these rules:
When is comes to online offers: If it is too good to be true, then probably it is.
When it comes to malware: Trust your gut, if it smells fishy, throw it back in the sea, quickly.
When it comes to data theft: Encrypt, encrypt, encrypt.
A special thanks to our friends at SingleHop for helping raising awareness about NCSAM.
