PCs still running Windows 7 will soon be more at risk of ransomware

PCs still running when Windows 7 reaches end of life on the 14th of January will be significantly more at risk of ransomware, Veritas Technologies has warned. According to experts, 26% of PCs are expected to still be running the Microsoft software after support for patches and bug fixes end.

The vulnerability to ransomware of PCs running unsupported software was demonstrated by WannaCry. Despite supported PCs being pushed patches for the cryptoworm, Europol estimated that 200,000 devices in 150 countries, running older, unsupported, software became infected by WannaCry. Although just $130,000 was paid in ransoms, the impact to business is understood to have run into the billions of dollars due to lost productivity and lost data.

Microsoft ended mainstream support of Windows 7 in 2015, giving users five years to ready themselves for the software to reach end of life.

Businesses running Windows 7 should prepare themselves in order to avoid the impact that vulnerability to ransomware could have on their organizations. Here are five tips that could help navigate this challenge:

Educate employees – The biggest risk is to data that employees save to unprotected locations. Ensure that users are following best practices for where to save data so that it can be secured and consider running a simulation. Saving valued data to centralized servers, data centers or to the cloud can help reduce risk.

Evaluate risk by understanding your data – For enterprises, insight software solutions can help to identify where key data lives and ensure that it complies with company policies and industry regulations. This is critical not only to identify the challenges but also to prioritize the recovery process.

Consider a software upgrade – This isn’t going to be practical for large enterprises in the time available, but it could well be part of a longer-term strategy. For SMEs, the most sensible solution might be simply to upgrade to an operating system that has ongoing support.

Run patches whilst you can – According to the Ponemon Institute, 60% of respondents who experienced data breaches did so despite a patch to prevent breaches being available to them. Businesses should at least make sure that they are as up-to-date as they can be whilst they can. Users will also be able to buy “ESUs” from Microsoft to access patches during their migration to newer software.

Ensure that data is backed up – Ransomware relies on the idea that paying a ransom is going to be the only/cheapest way to regain access to your data, yet research shows that less than half of those that pay up are actually able to recover their data from cyber criminals. Veritas advocates the “3-2-1 rule”, where data owners have three copies of their data, two of which are on different storage media and one is air gapped in an offsite location. With an air-gapped data backup solution, businesses have the much safer, and more reliable option, of simply restoring their data.

WannaCry was a clear example of the dangers that businesses can face when they are using software that has reached end of life. In January 2020, a quarter of all PCs are going to fall into this category so it’s vital that the organizations that rely on Windows 7 are aware of the risks and what they need to mitigate them.

This type of ransomware attack tends to have a disproportionate effect on organizations that can afford ransoms least – for example, we saw high-profile attacks on public sector bodies in 2017. So, it’s critical for those running Windows 7 to act now and put plans in place to ensure that they are able to protect themselves. Organizations need to understand their data and make sure that information is being stored in the right place where it can be protected and made available when needed.

10 Tips to Steer Clear from Daily Cybercrime

When it comes to cyber security tips, we are bothered about securing social media accounts or financial accounts. Cybercrime continues to evolve, surfacing new threats that are more complex every year. Being cautious while tending to financial transactions won’t ensure that you are cyber safe. There are many digital devices that you use, different websites that you visit, and various e-commerce sites that you use for online transactions.

As a victim of identity theft, you are prone to various financial and non-financial attacks. However, when you hear about the range of cybercrimes, you might find that the best option is to avoid the internet altogether. But that’s too drastic, isn’t it?

Instead, a solution would be to become cyber aware and learn the basic precautions to protect yourself and your data. These precautionary measures also include learning how to respond when identifying others involved in criminal activities online.

What is cybercrime 

Cybercrime, in any form, is a crime that takes place online with the help of digital devices like computers, smartphones, tablets, etc. It varies from identity theft to security breaches or as a tool to commit an offense. Cybercriminals also steal data to sell in the dark market or to use it for things like cyber-stalking, harassment, child exploitation, or bullying. Terrorists also collaborate online to spread rumors or false allegations to create social disturbances.

How to protect yourself against cybercrime

1. Intensify your home network

It’s a good idea to secure your home, starting with the internet connection. The home network can be strengthened using a virtual private network with an encrypted password. A VPN encrypts the traffic until it reaches the destination, which gives less scope for criminals that intercept the connection to attain any data. It is also a good practice to use a VPN when using unprotected public wi-fi in areas like hotels, cafes, airports, etc.

2. Use a full-service internet security suite

Using an anti-virus is a good option to secure your device from viruses, worms, etc. But using a full-service internet security suite gives real-time protection from malware, including ransomware and viruses. An internet security suite will provide maximum protection to your online data.

3. Update your software

Cybercriminals often use existing flaws or exploits in the software to gain access to the system. It is, therefore, critical to update your software regularly, especially operating systems and internet security software. By patching the flaws and exploits, you are less likely to fall victim to a cyberattack.

4. Use strong password strings

Don’t use similar passwords for every website and change your passwords regularly. The passwords should be alphanumeric, along with special characters. Use strings instead of word(s) as it makes the password complex. A password management application can be used to keep your passwords secure yet accessible.

5. Manage your social media settings

An academic study performed by Dr. Mike McGuire, Senior Lecturer in Criminology at the University of Surrey, showed that social media-enabled cybercrime contributes around $3.25 billion towards the global revenue annually. Social media is increasingly becoming a source for phishing attacks as criminals are obtaining relevant information required to crack email or bank accounts. For example, revealing your mother’s maiden name may expose the answer to the most common security question of a bank account.

6. Be prepared to handle identity theft on travel

Cybercriminals are everywhere, and they always have an eye on you. When traveling, avoid sharing your traveling plans on social media. When staying outside, use a VPN over the hotel’s unsafe wi-fi network.

7. Protect yourself from identity theft

Identity theft is performed by obtaining personal information to go undercover or for economic gain. It is important to guard your personal data and avoid being tricked by attackers. When data is shared online, it should be protected in-transit and after it reaches the destination too. Identity theft can happen anywhere and only by being assertive and alert can you protect your data.

8. Educate your children about safe internet practices

It is important to educate your children about safely using the internet. Children are easy targets for cyberbullying, and they should be taught about the acceptable ways to use the internet. They should be taught to reach out to you in case of any kind of online harassment, stalking, etc.

9. Monitor your child’s internet activity

While you talk to your children about internet safety, also teach them about identity theft. You should be careful while sharing your child’s information online and also teach your children to recognize the signs of identity theft. Monitor your child’s browsing history to understand the websites they are visiting and whether they have shared any personal information which may be used by cyber thieves.

10. Be aware of major security breaches

Stay updated with the major security breaches so that you are in the know of many ways attackers trap users and compromise their personal information. If you have an account on the websites that are breached, find the information that is compromised and change your password immediately.

What if you are a victim?

When you realized that you are a victim of a cybercrime, you should:

• Immediately inform the police and the respective authorized vendors, like credit card vendors, in the case of credit card fraud.
• Report the minor of the frauds to the Federal Trade Commission to help them bringing awareness among people and save others.
• Change your login credentials and also verify signup details of related website accounts.

Remember, staying alert is the best key to avoid further loss!

Fighting cybercrime is an obligation to combat rising cyberattacks. Following simple security measures and reporting the smallest of the cybercrimes to relevant authority should be the foremost measure.

People are the weakest link

People are the most vulnerable layer of network security for most businesses. Employees at nearly all levels play important roles in protecting companies’ critical assets. That’s why responsible businesses train and test their employees, and then repeat the process with updated instructional material.

Threats change. So to be effective, training must be constantly updated too. It’s not enough to do it once. It’s such an ever-evolving threat vector. Continuing to refresh is critical. Once good, human safeguards are in place, a company can put more attention on the mechanical means of protecting a network.

Protecting a company’s electronic assets can be especially challenging for small and midsized companies because they often lack the security staff and other resources larger enterprises can afford.

Viewing potential targets from the perspective of a hacker might help smaller businesses devise or improve their strategy for protecting a network from outside threats. Over time I have identified general areas cyber thieves are likely to examine in attempts to penetrate a company’s security.

Below, you’ll find five possible vulnerabilities cyber thieves commonly exploit. Businesses should keep these targets and solutions in mind while formulating or reviewing a protective strategy.

1. Outdated software. Apply patches and updates promptly. The fact that software is reported as outdated is an indicator of potential problems.
2. Open ports. Install a firewall if there isn’t one in place already and have it programmed to close ports that are open unnecessarily. Open ports can be pathways for intruders.
3. Social engineering. This is a key area in which the need for continuous employee training comes into play. Beware of phishing, for example. Phishing is when hackers use email or some other means of communication to try to acquire sensitive information or infiltrate a network.
4. Compromised credentials. Data breaches at many organizations have provided hackers access to all sorts of potentially useful information, including personal information, user names and passwords. A lot of that type of information is available on the dark web. Data breaches have increased the need for computer users to use unique and strong passwords for every account they have. In addition, they should change passwords often. Using an online password-management service can help users remember their passwords and stay organized.
5. System exposure. Be careful what parts of your network are accessible to the public. The public might not need access to a company’s customer relationship management strategy, for example. Limit employees’ network access to only what they need to do their jobs.

It is important for companies to have a layered approach to providing security. Viewing security strategy as a series of rings encircling mission-critical assets might help. The rings start at the outer perimeter and include layers of network, endpoint, application and data security. Precautions should be implemented at every layer, not just sprinkled about here and there.

Why You Should Consider Cyber Insurance Coverage

We have all heard it’s not a matter of if your organization will face a data breach, but when. Why? People. Many people with bad intentions across the globe are looking for ways to get rich quick by defrauding organizations. Meanwhile, an organization’s most valuable assets, its people, fall prey to these bad actors.

 

Information and Related Costs at Risk

 

What are these bad actors interested in? Almost everything. A recent study of insurance claims for incidents indicates the following data was at risk

 

●     Payment Card Industry (PCI) - 14%

●     Protected Health Information (PHI) - 15%

●     Critical files - 15%

●     Personally Identifiable Information (PII) - 26%

●     All others - 30%

 

As reflected, personal information such as social security numbers, birth dates, bank account information, credit card information and addresses tend to be highly sought after. Identity theft of individuals and businesses is the goal for the bad actors.

 

The average breach cost was $604,000. These costs were spent on crisis services ($307,000), legal defense ($106,000) and legal settlements ($224,000). Crisis services consisted of forensics, credit monitoring, notifications, legal guidance/breach coaches, and other related expenses.

 

A sample data breach calculator is available online through eRiskHub for you to perform your own calculation of a potential breach to your company’s data.

 

Industries at Risk

 

Small businesses and large businesses are all at risk. These bad actors see the value in attacking small companies with thousands of dollars available just as much as penetrating a large businesses with millions of dollars. The insurance claims study identified businesses with revenue under $50 million to be the targets 49% of the time. Companies with less than $2 billion in revenue accounted for 85% of the insurance claims.

 

The following industries reported the most incidents for insurance claim purposes:

 

●     Professional services - 20%

●     Healthcare - 17%

●     Financial services - 12%

●     All others - 12%

●     Retail - 10%

●     Education - 7%

●     Nonprofit - 6%

●     Technology - 6%

●     Manufacturing - 4%

●     Hospitality - 3%

●     Public entities - 3%

 

Data Breach Mitigation Tools

 

These criminals have stepped up their phishing, spoofing and social engineering game making it more difficult to detect fraud from reality. Through nefarious business email addresses posing as business owners to ransomware, these bad actors are working hard to deceive others. External threats are trying to penetrate your organization on a daily basis. Their plan? Compromise your people and your computer networks. Knowing this, you should be considering how to mitigate your cyber risks.

 

Many organizations of various sizes have been considering the following mitigation tools over the past several years:

 

●     Improved, secure hardware and software

●     Network security vulnerability and penetration testing

●     Pre-breach consultation

●     Incident response plan assessments

●     Cybersecurity awareness training for employees

●     Cyber crime insurance coverage

 

Proactive cybersecurity assessments are important in identify weaknesses and opportunities to strengthen your organization’s weakest links. In addition, it’s helpful for organizations to have a formal incident response plan in place should an incident occur. Why? Because when an incident occurs, you don’t want to have a third party come in blind. Being responsive to an incident is critical and clearly documented plans help skip the information technology background needed.

 

Doing something with mitigating cyber liability risks is better than doing nothing. In a perfect world, your organization would implement and execute proactive and reactive cybersecurity plans. However, resource limitations are a factor and organizations must consider insurance products to offset accepted risks.

 

Cyber Coverage Insurance

 

Odds are, if you have cyber coverage insurance, you may not know what is and isn’t covered. For example, do you have cyber liability business interruption coverage? In a 2018 survey of cyber insurance market trends, businesses are most interested in purchasing cyber business interruption insurance. Business interruption insurance covers the loss of income as a result of a disaster such as a data breach. It is important to note that not all cyber insurances include coverage for related business interruption.

 

The same can be said for extra expense coverage. This is commercial property insurance coverage allows for covering additional expenses incurred above and beyond normal operating expenses. This type of coverage is critical when an incident occurs as your organization will incur additional investigative, legal and crisis management expenses.

 

Other cyber specific coverages can include:

 

●     Funds transfer/social engineering

●     Cyber extortion/ransomware

●     Regulatory fines/penalties

●     System failure coverage

●     Data restoration

●     Reputational harm

●     Cyber-related bodily injury and/or property damage

●     Internet media liability

 

You will also want to ensure your errors and omissions insurance covers data breaches to protect you from third party lawsuits.

 

In addition to what your cyber insurance may or may not cover, you will want to have discussions with your insurance contact regarding:

 

●     Potential reduction in the premiums you pay for cyber insurance by having pre-breach consultations performed to assess your cybersecurity posture;

●     Listing your preferred third party of choice to be your incident response provider should an incident occur; and

●     Listing your preferred attorney with specialized cyber law knowledge.

 

By further understanding your insurance coverage, possible premium reductions and having your incident team assembled, your organization will be positioned to immediately address an incident.

 

Businesses Purchasing Cyber Coverage Insurance

 

The 2018 survey of cyber insurance market trends identified small (less than $50 million in revenue) to medium size businesses ($50 million to $1 billion in revenue) were driving the growth of cyber insurance. The following industries represented the majority of the new purchasers of cyber insurance:

 

●     Healthcare - 42%

●     Manufacturing/Industrials - 40%

●     Financial Services/Insurance - 38%

●     Retail/Point of Sale - 24%

●     Government and Nonprofit - 18%

●     Energy/Utilities - 18%

●     Education - 16%

●     Other - 8%

 

Drivers for Purchasing Cyber Coverage Insurance

 

Motivation for purchasing cyber coverage insurance is like fashion, buyers make decisions based on what they see in the news. The 2018 survey found news of cyber-related losses being the number one drive of businesses purchasing cyber insurance. Other motivating factors included experiences of cyber-related losses and requirements by third parties such as a customer.

 

Holistic Approach to Mitigating Data Breaches

 

Your business produces and runs off data. It’s imperative that you keep this information secure. The goal of your organization should be to identify, implement, and execute methods to protect this data at all times. This strategy should include proactive, reactive and insurance to mitigate the inevitable.

 

Secure your home network

Several years ago, creating a cybersecure home was simple; most homes consisted of nothing more than a wireless network and several computers. Today, technology has become far more complex and is integrated into every part of our lives, from mobile devices and gaming consoles to your home thermostat and your refrigerator. Here are four simple steps for creating a cybersecure home.

Your Wireless Network

Almost every home network starts with a wireless (or Wi-Fi) network. This is what enables all your devices to connect to the Internet. Most home wireless networks are controlled by your Internet router or a separate, dedicated wireless access point. They both work the same way: by broadcasting wireless signals. The devices in your house can then connect via these signals. This means securing your wireless network is a key part of protecting your home. We recommend the following steps to secure it:

• Change the default administrator password to your Internet router or wireless access point. (Whichever one is controlling your wireless network.) The admin account is what allows you to configure the settings for your wireless network.
• Ensure that only people you trust can connect to your wireless network. Do this by enabling strong security. Currently, the best option is to use the security mechanism called WPA2. By enabling this, a password is required for people to connect to your home network, and once connected, their online activities are encrypted.
• Ensure the password used to connect to your wireless network is strong and that it is different from the admin password. Remember, you only need to enter the password once for each of your devices, as they store and remember the password.
• Many wireless networks support what is called a Guest Network. This allows visitors to connect to the Internet, but protects your home network, as they cannot connect to any of the other devices on your home network. If you add a guest network, be sure to enable WPA2 and a unique password for the network.

Not sure how to do these steps? Ask your Internet Service Provider or check their website, check the documentation that came with your Internet router or wireless access point, or refer to their respective website.

Your Devices

The next step is knowing what devices are connected to your wireless home network and making sure all of those devices are secure. This used to be simple when you had just a computer or two. However, almost anything can connect to your home network today, including your smartphones, TVs, gaming consoles, baby monitors, speakers, or perhaps even your car. Once you have identified all the devices on your home network, ensure that each one of them is secure. The best way to do this is ensure you have automatic updating enabled on them wherever possible. Cyber attackers are constantly finding new weaknesses in different devices and operating systems. By enabling automatic updates, your computer and devices are always running the most current software, which makes them much harder for anyone to hack into.

Passwords

The next step is to use a strong, unique password for each of your devices and online accounts. The key words here are strong and unique. Tired of complex passwords that are hard to remember and difficult to type? So are we. Use a passphrase instead. This is a type of password that uses a series of words that is easy to remember, such as “Where is my coffee?” or “sunshine-doughnuts-happy-lost”. The longer your passphrase is, the stronger. A unique password means using a different password for each device and online account. This way, if one password is compromised, all your other accounts and devices are still safe. Can’t remember all those strong, unique passwords? Don’t worry, neither can we. That is why we recommend you use a password manager, which is a special security program that securely stores all your passwords for you in an encrypted, virtual safe.

Finally, enable two-step verification whenever available, especially for your online accounts. Two-step verification is much stronger. It uses your password, but also adds a second step, such as a code sent to your smartphone or an app on your smartphone that generates the code for you. Two-step verification is probably the most important step you can take to protect yourself online, and it’s much easier than you think.

Backups

Sometimes, no matter how careful you are, you may be hacked. If that is the case, often the only way you can recover your personal information is to restore from backup. Make sure you are doing regular backups of any important information and verify that you can restore from them. Most mobile devices support automatic backups to the Cloud. For most computers, you may have to purchase some type of backup software or service, which are relatively low- priced and simple to use.