Security A Growing Concern For Business

In 2014 we saw numerous security breaches around the world. We saw the security compromised in such big names as Sony, Target, Goodwill Industries, Home Depot, JP Morgan and Michaels. For 2015, most security analysts are predicting an even greater increase in the number of security breaches and cyber-attacks.

In the 2015 Cyber Threat Defense Report 7 out of 10 companies surveyed reported a data breach in 2014, which is up 9 percent from 2013. 22 percent say that their networks were breached six or more times and more than half of the respondents say they expect a successful cyber-attack within the next 12 months.

What’s The Biggest Threat?

Amongst the top threats noted, phishing and spear-phishing are at the top of concerns about security breaches. Phishing is the method where a hacker will send emails to several email addresses (usually at random) appearing to come from a reputable and recognizable establishment (such as a bank). The receiver will open the email, believing it to be a legitimate email and perhaps click on a link or download a file, which will then be used to target the computer for malware or to trick the user into entering personal details.

Spear-phishing is the same thing as phishing, except that the emails target certain companies or individuals within that company. Usually, a spear-phishing email will appear to come from someone that company does business with or even from a higher-up executive within the company itself. Spear-phishing is effective because most of the time the email seems to be from trusted sources, and employees never think twice about opening them.

Why Are Phishing And Spear-Phishing So Popular?

The reason phishing and spear-phishing are so popular is because they work. While it’s very hard to get someone within a company to download and install an unknown program, it’s very easy to get someone to open an email, especially when the email is from a trusted source. Many people are under the assumption that if you don’t click on anything, then there is no way to get infected, but that’s not necessarily true. Often a phishing email will be sent with a script that automatically runs when the email is opened, requiring you to do nothing but open the email to get infected. Of course most email programs have built in options to prevent this from happening, but often it requires the end user to turn off certain features to protect themselves.

How Can I Prevent Spear-Phishing From Compromising Our Security?

Most email programs, including the web-based variety have very complex spam filters that “catch” these malicious emails before they get to your inbox. One of the ways they do this is by checking the actual email address with the displayed email address. Anybody with a basic knowledge of email headers can easily mask the email address to make it appear to come from somewhere else. Spam blockers will see this mask and flag the email as spam. If an email appears to come from someone important or trusted, but ends up in your spam folder, the user should be extremely cautious about opening it, and double check with the source (not by opening and replying to the email) before clicking on it.

Of course, it goes without saying that having a good antivirus program installed on all computers in your company is vital to securing your company’s data, but as you can see, this is often not adequate to ensure complete protection from possible attacks. The best method your company can use is educating the end users of the potential dangers and having a policy in place for dealing with emails with attachments or links. One such policy might be to always forward any email containing an attachment to the IT security administrator (or equivalent) and to never open any email in your spam folder without first checking with the sender of the email and/or the company’s IT security.

While it is true that security is a growing concern in 2015, it may not be necessary to increase your security budget by much to combat this threat. Simply being aware of how the malware gets into your system and what to watch for in order to minimize infestations may be adequate to survive this era of increased security breaches. Education and information is paramount to protecting your company from unauthorized breaches of security and the more you have in place, the less likely you will fall victim to an attack.