Cyber Incident · cybersecurity · Distaster Recovery · Hacking · Incident Response

Life was so simple, then Equifax, SEC, Whole Foods, Deloitte all hacked!

I have been getting calls and emails for the last few weeks about all the hacks and cyber events.  The central question is always, “what do I do to protect myself?”  It’s actually an impossible question to answer.  Why?  We do not have control of our own identities and assets.  They are managed and may even be owned by 3rd parties.  How can this be true?

The Credit Reporting Agencies (CRAs) own and or sell our credit identity information as a business.  Who owns your identity from a credit reporting perspective?  Perhaps it is not you.  But, let’s ask the question, how did I lose control of my credit identity to a 3rd party?  The information in your credit report comes directly from companies that have extended you credit in the past or from those with which you have open accounts. Credit card companies, banks, credit unions, retailers, and auto and mortgage lenders all report the details of your credit activity to the credit reporting agencies (CRAs).  The CRAs also receive information from debt collectors, and they purchase public records, such as bankruptcies, tax liens, and judgments, from public record providers.  Now, we know how our credit identity was assembled, but, what obligation do the CRAs have, to protect this information?

The Federal Trade Commission (FTC) has published a Safeguards Rule for protecting consumer information.  Institutions under FTC jurisdiction must have measures in place to keep customer information secure.  The CRAs fall under the FTC jurisdiction by definition. The safeguards are designed to be flexible for implementation by each organization vs prescriptive in nature.  The references for implementation processes to protect consumer information reference:

The recent testimony and prepared statement from Equifax point to a failure in process and implementation of a standard software patching process.  The other fact from the prepared testimony that was alarming was the lack of monitoring and process of a known vulnerability then the awareness (and lack of action), several months later, of a vulnerability through network traffic monitoring.  The vulnerability identified led the forensics team back to the original software that had an identified vulnerability that was not patched.  The contradiction and or lack of monitoring tools usage is a key message.  Monitoring of critical systems, identified vulnerabilities and changes of behavior of the network traffic are critical controls of a cybersecurity program.  In addition to training and process management, a cyber event can be prevented and/or observed in real-time based the network behaviors.

Back to the original question… “What do I do to protect myself?”  Here are some helpful tactics that are just good cyber hygiene.

    1. Change your passwords to be unique, do not repeat the same password
    2. Use complex passwords or a password generator
    3. Set up identity service monitoring through reputable sources
    4. Set up monitoring and alerts of banking accounts for money movement
    5. Option to shut down all credit application services
    6. Run device anti-virus/anti-malware products on all owned devices
    7. Make sure you have a firewall and the settings are not set to “default”
    8. Make sure all connected devices are protected and not set to default, segment if possible
    9. Learn about phishing and ransomware best practices
    10. Don’t surf unknown web sites
    11. If it looks suspicious or you are questioning its authenticity- investigate vs act


Cyber Incident · Disaster Recovery · Incident Response · Malware · Ransomeware

Corporate Cyber Incident Response Plan – Do You Even Have One?


Corporate Cyber Incident Response Plan – Do You Even Have One?

I was messaging with a very good friend and colleague this week and we started chatting about incident response plans. We noted that most people have a plan in place at home; he raised examples around personal security elements such as home alarms, dogs, door locks and cameras. The comment that resonated with me most was, you know what to do when you come home and your home has been burglarized. Call the police, insurance company, etc. He went on to pose the question, what about when your company is electronically burglarized? For most organizations, that question is met with silence.

While burglary in the workplace takes on many forms, we will focus on burglary in the form of cyberattacks. The attacker is “stealing” information from your company for monetary purposes. Yes, the cyberattack is intended to take something from you: data, money or both. Cyberattackers work systematically and operationally efficiently to pick either high-value targets or high-probability targets to extort what they are targeting—data, intellectual property, personal identifiable information or cash extortion from a ransomware event. It’s a business and the value to the attacker is what they take for future gains or currency to potentially give you back what they have access to or control of. The results of this are highly distracting, expensive and potentially severely impactful to the business.

Circling back to the concept of corporate cyber incident response, what is your answer? Is the first step to call the authorities and FBI? Is it to pay the ransom? Is it time to deploy your Disaster Recovery (DR) policy? Do you even have a DR plan? Have you identified your critical data?

What exactly is the FBI’s role in cyber? The FBI’s role is to hunt down the “bad guys” and prosecute them, plain and simple. Their role is not to recover your assets, cash or data. Should you call the FBI if you are burglarized (cyberattacked)? Absolutely! We want to shut down as many cyber criminals as possible. Should you pay the ransom? Well, that depends—do you have a data recovery plan implemented that remains unscathed by the encryption tactics used by the attacker? If yes, why would you pay? Sometimes organizations need to make a time vs. money decision, as the time to recover may exceed the threshold a company can accept for their business. Law enforcement suggest not paying the ransom, but your business objectives need to drive your decision.

Many organizations talk about the topic of incident response, but very few have a realistic plan. Some suggestions that can help include: building a plan that includes recovery steps, using realistic scenarios and identifying leaders within your company who will drive those decisions.  Have a true plan of action that is executable. Do a few tests of the plan “dry run” a few scenarios.  Be prepared, be ready, be diligent—the odds prove that this will happen to your company at some point. The small and medium business market is the largest potential target, while also the least prepared. Start today!