RACHEL – RESTAURANT OWNER

Rachel did not like to update her software because she felt like she had to relearn the location of everything. Due to this, she was running an outdated POS system. As a result of an outdated POS system, Rachel’s system ended up getting compromised.

It is vital to do system updates because it patches vulnerability points that developers have found in the past. If you are running an outdated version it only makes it easier for cybercriminals to access your system.

The first step: Identifying what data needed protection on the POS system.

What Rachel needed to protect was any information that cybercriminals can use to commit identity theft or fraud.

• Credit card numbers
• Names and Last Names
• Pin numbers
• Phone numbers

The second step: Multi-layer solution

These points help Rachel improve her security against network level-hacking, physical tapering, employee mistakes

• Set updates to automatic for all software and systems
• Deployed Security Software and have it set to automatically update
• Limited internal access to the physical PoS device
• Locked down systems at the end of the workday
• System times out after a time of inactivity
• Routinely deleted cardholder data in case of a system breach
• Physically inspect device incase of tampering
• Secure Wi-Fi connection

MATT – DOCTOR’S OFFICE

Matt did not believe that it was important to educate his employees on proper cyber security measures. He did not want to allocate the resources because he thought it was inefficient. One of Matt’s employees did not have the proper training to identify suspicious emails and fell victim to a phishing attack that compromised the system and network.

It is very important to educate employees on the latest cyber security measures because cyber attackers will try a multitude of methods to penetrate your system. If employees are not educated, the risk of being penetrated increases.

The first step: Increase employee awareness

There is increasingly sophisticated social engineering schemes that are developed in new ways to acquire sensitive data from businesses.  Identifying what data cybercriminals are trying to get through these schemes is the first step to safeguarding valuable data.  Some information cyber criminals try to get through social engineering tactics include:

• Logins and passwords
• Customer information
• Financial account information
• Employee and Customer identification information

Additionally, make sure to understand the level of employees’ current security knowledge

The second step: Test the employees

Matt was able to train his employees with our free Social Engineering Toolkit.

The toolkit provided Matt with some of the following:

• Certification of Completion from his employees.
• Training Materials such as videos and quizzes.
• Knowledge about  social engineering tactics used today

Results Included:

Increase employee knowledge about common social engineering schemes. Once employees are properly educated, they are made part of the solution by emphasizing their role in protecting the company’s information and asking for ideas to mitigate risk of a breach.

The third step: Use of Security Measures

Even with employees properly educated on common cyber security threats, it is important to set other security measures in place. Have employees protect their computers with a firewall, spam filters, anti-virus and anti-spyware software.

DAVID – MANUFACTURER

There are a lot of ways that attackers can get access to your system that doesn’t always involve complicated hacking skills. See social engineering toolkit

David was a victim of an attack through a USB Drive whose source was unknown. Although he may not have been the one to do it, the attacker wins as soon as the thumb drive gets plugged into a system computer. It took David a long time to realize that his business had been hacked because there are tools that attackers use to disguise the fact that they have compromised your operating system (e.g. rootkit).

The first step: Identify what data and software is at risk

Even before an actual attack happens, it is important to identify all sensitive information and who has access to it. David needs to protect any information that cybercriminals can use to commit identity theft or fraud.

• Logins and passwords
• Customer information
• Financial account information
• Employee and Customer identification information

The second step: Protection

• Set updates to automatic for all software and systems
• Have a Security Software in place and have it set automatically update
• External Media Devices should all be scanned before plugging in
• Limit and control Physical Access to system devices
• Physically inspect devices in case of tampering
• Set up a different network from primary network for guest to use.

The third step: Educating all employees

Educate all the employees on how to identify different forms of penetration. It is vital to enforce security policies and to have a plan in place. Signs to look out for:

• Know when computers are acting “unusual”
• Other connected devices in the network behaving strangely
• Browsers are misbehaving
• Anti-Virus protection
• Employees cannot access programs using their usual password.
• People in email address list get fake emails from employees

ANGIE – GYM OWNER

One of Angie’s employees clicked an ad from an unknown source and unknowingly gave access to an attacker. It took Angie a lot time to address this issue because she was unsure of the root cause of the problem. See toolkit to help identify cyber attacks.

After educating herself more on the situation, she realized that it was a flooding attack, but she didn’t know how the attacker accessed the network. This is a very common attack that affects both small and large scale companies. Upon learning that the root of the problem was the ad that her employee clicked, she decided to get her employees the proper training. See toolkit to help identify social engineering and phishing attacks.

The first step: Identify what data and software is at risk

Even before an actual attack happens, it is important to identify all sensitive information and who has access to it. Kathy needs to protect any information that cybercriminals can use to commit identity theft or fraud.

• Logins and passwords
• Customer information
• Financial account information
• Employee and Customer identification information

The second step: Protection

• Set updates to automatic for all software and systems
• Have a Security Software in place
• Set up a pop-up blocker
• Deploy an antivirus program and firewall into the network to help in restricting the bandwidth usage to authenticated users only
• Limit and control Physical Access to system devices
• Physically inspect devices in case of tampering

The third step: Educate Employees

Ensure that employees are not clicking any ads that randomly pop up in the screen. Ensure employees are caught up with the latest tips on safe cyber security practices through the tools and quizzes provided by Cybersafe.

• Visit the CyberSafe toolkit in order to learn how to identify possible attacks
• Create a customized plan with the CyberSafe planner to be prepared for threats
• Explore third party services that offer guidance and protection against these types of attacks
• Protect yourself against monetary damages with cyber risk insurance