Tag Archives: cyber

Dyn DDos Attack Serves as a Cyber Security Wake-up Call

Posted on November 10, 2016 by Marijana Dabic

In late October, Dyn—a cloud-based internet performance management (IPM) company in the United States—had its server infrastructure compromised following distributed denial-of-service (DDos) attacks.

In essence, DDos attacks work by overwhelming targeted machines and servers with junk traffic, often causing website crashes. In this case, the attacks disrupted popular sites like Twitter, Spotify, Netflix and Amazon.

While DDos attacks are common, experts are concerned at their growing effectiveness, as Dyn is a large firm that services many Fortune 500 companies. It’s clear that cyber attacks are becoming more and more sophisticated, and hackers are no longer simply IT-student pranksters, but rather nation states and other large entities with malicious agendas.

Because of this fact, the looming threat of a cyber attack is more a matter of when than if, and businesses will need to turn to cyber liability insurance for the necessary protection. What’s more, as a reliance on cloud services becomes increasingly important for successful business operations, the value of a strong cyber liability insurance policy will only continue to grow.

A typical cyber liability policy can help protect you from costs associated with a data breach, copyright or trademark infringement, data loss due to hacking and business interruption.

For additional protection, it’s critical that you create a formal, documented risk management plan that addresses the scope, roles, responsibilities, compliance criteria and methodology for performing cyber risk assessments. This plan should include a description of all systems used at the organization based on their importance to the organization, and the data stored and processed within them.

Experts recommend that businesses review their cyber risk plans on an annual basis and update them whenever there are significant changes to their information systems or the facilities where systems are stored, or other conditions occur that may impact the organization.

The Risks of Allowing Employees to Use Tablets

Posted on June 23, 2016 by Marijana Dabic

Tablets and other such devices have become increasingly common in the average workplace. And, while these devices can be important for your employee’s daily work, they also represent a cyber risk if they are not properly managed.

The following are just a few of the major risks associated with having tablets in the workplace:

Mobile malware. Tablets are typically infected by malware via malicious apps and phishing scams. When this happens, a cyber criminal can gain unauthorized access to the device and associated network systems. In general, iOS tablets like iPads are safer from malware than Android tablets. However, mitigating the risk of malware typically comes down to the user. Workers should avoid downloading unfamiliar apps.
Loss of data. Following a security breach, data loss is inevitable. For tablets, this could mean that users are locked out of their devices altogether. To protect your business, employees should always back up their data, and ensure that no sensitive or proprietary information is stored on it.
Unsecured networks. Unsecured networks are a particular concern for tablets because they are easy to take on the go into areas with free and public Wi-Fi connections, like cafés and airports. These connections are not always secure and can be easily hacked by cyber criminals. To prevent this, employees should be reminded that no public Wi-Fi is safe. For further protection, offer a virtual private network (VPN) that your employees can utilize to safely use the internet off-site.
Theft. In addition to virtual threats from hacking and phishing scams, cyber criminals could just as easily steal the tablet itself. This could give them unlimited access to proprietary or personal information. To combat this, employees should never leave their devices unattended. Using a secure password can also help prevent theft of information.

Above all, employers should have a personal device policy in place that accounts for security threats. Employees should know what they can and cannot do with their devices and how to protect the sensitive information contained within. These policies should be extended to other personal devices with internet access, such as smartphones.

Managing Cyber Security During a Merger or Acquisition

Posted on September 22, 2015 by Marijana Dabic

During a merger or acquisition, insurance policies and finances need to be scrutinized and the future of employees addressed. Cyber security is often put on the back burner, which is unfortunate because this is a time when company data is at its most vulnerable.

Data transfers must proceed without a hitch, or else the companies risk damaging reputation, losing customers and hurting future sales. Additionally, legal responsibilities must be upheld before, during and after the data transfer process.

Use the following checklist to ensure you’ve covered all of your cyber security bases:

Identify all data assets that will need to be transferred.
Gather and merge all data standards, policies and processes from employees at both companies.
Identify potential risks that could occur during data transfer.
Prior to any data transfers, ensure data is backed up.
Run background checks on any employee who will be involved in the data transfer process.
Craft a business continuity plan to prepare for potential data loss or outages during the period when the transfer will be occurring.
Assign a high-level person the job of overseeing all data transfers. They will have the task of dividing and conquering by assigning one person to each data asset that needs to be transferred.
Legally transfer ownership of data assets as quickly and completely as reasonably possible.
Host training sessions on new data standards, policies and processes.
Update disaster recovery plans, business continuity plans and emergency plans to include newly acquired data assets.
Update the risk profiles for newly acquired assets.

Preparing for Data Transfer

Planning for data transfer should begin as early in the merger or acquisition process as possible. It is wise to assign one person the task of overseeing all data transfers so that there is little room for miscommunication or error. That person can then delegate smaller tasks, such as identifying data assets, identifying potential risks during transfer and making sure the data transfer is in compliance with federal or provincial law, but the person in charge should be aware of the current status of all tasks at all times. This person should also manage the implementation of the interim business continuity plan so that daily operations are disturbed as little as possible.

Keep in mind that if the acquired company has already completed portions of the data transfer or consolidation tasks, you should review the work to ensure accuracy.

Consider relocating IT employees from the acquired company early so that they can help with the data transfer and risk identification process, as they will be more familiar with their data and systems. Sufficient time should be mapped out to allow any older data to be converted for use in newer software and programs.

Finally, ensure that your system configuration records are up to date prior to any data transfers or consolidations. This will help isolate any issues that might occur and allow for an effective fix.

Good Practices for Data Transfer

Even if your company is completely prepared for the data transfer, it’s still possible that issues will arise during the process. Here are some good practices your company can utilize to minimize these risks:

Try to avoid using any kind of removable media to transfer data from one place to another. If the only method you can use is removable media, then take extreme care to be sure all records are encrypted, especially if they involve personal information.
If you have any data that isn’t getting transferred, you should dispose of it safely and completely to ensure it cannot be stolen.
Do not try to move all data at one time. Set small goals to complete every day or week to prevent an overload on your system or large, messy mistakes.
Consider halting some of your company’s cyber services until all data has been switched over in order to protect the services from being adversely affected by the transfer. Another option would be to run a similar service until data has been transferred.
Increase protective monitoring systems to prepare for the possibility of a disgruntled employee. Mergers and acquisitions are scary, uncertain times for employees, whose roles are often modified or eliminated to accommodate a new company structure. Update all clearances and access capabilities for employees based on new roles and duties.

Safe and secure data transfer during a merger or acquisition is of utmost importance. Communication is crucial during this time and basic duties and responsibilities should be quickly laid out and assigned to employees before, during and after the transition. Data transfer is not just about preventing and managing a compromise or interruption to services; you also need to keep your customers’ and stakeholders’ needs in mind, and take their concerns into consideration. Most importantly, ensure your new and existing clients know that you’re keeping their data safe.

Tag Archives: cyber

Dyn DDos Attack Serves as a Cyber Security Wake-up Call

The Risks of Allowing Employees to Use Tablets

Managing Cyber Security During a Merger or Acquisition

FOLLOW OUR BLOG

ABEX - AFFILIATED BROKERS EXCHANGE IS ON FACEBOOK.

CONNECT WITH US ON LINKEDIN