Breach statistics continue to climb and that’s a group none of us want to be in.  “The numbers are sobering and suggest that 2017 is well on its way to becoming the worst year on record for data breaches and software vulnerabilities.”  Call MEI Security for all your cyber security consulting needs, we can help.

Running a small business can be hard enough, but cyber crime makes it even harder. According to multiple sources, once a business suffers a cyber attack there is a 60% chance that they will be closed, out of business within a year. [CS] [FC] [GM] This is a tough number to hear, especially given that small businesses have fewer resources available for I.T. Security.

Furthermore, 71% of small business report that they have been attacked, and back in 2015 the average cost of each attach was $20,753. [FC] How will it cost your business? How much should you spend to prevent attacks or to be able to survive a successful attack?

You don’t have to spend tens of thousands, and you don’t need to hire MEI Security (although we are happy to help). You can find options for lowering your risk. We sponsor free meetings, on the second Thursday of the month. Ours are in Stoughton, MA, but you may be able to find some in your area. We also have a list of resources that include free options for small to medium sized companies. Whatever your budget, there are steps you can take to protect yourself from cyber criminals. We urge you not to wait until after an attack. For 60% of small businesses that was too late for survival.

—————————————-

References:

[CS] DJ Jordan, Joel Hannahs, “Collins Subcommittee Examines Small Business Cyber-Security Challenges With New Technologies”, 2013-03-21, http://smallbusiness.house.gov/news/documentsingle.aspx?DocumentID=325034

[FC] , “60% Of Small Businesses Will Close Within Six Months Of A Cyber Attack… Will Your Company Survive?”, 2015-10-22, http://www.financialcomputer.com/2015/10/60-of-small-businesses-will-close-within-six-months-of-a-cyber-attack-will-your-company-survive/

[GM] Gary Miller, “60% of small companies that suffer a cyber attack are out of business within six months.”, 2016-10-23, http://www.denverpost.com/2016/10/23/small-companies-cyber-attack-out-of-business/

Request to run insecure scripts illustrates security problems.

In an article on www.cnbc.com Aneri Pattani appears to be saying that the cyber security industry has failed.  Aneri refers to breach-after-breach and points to the fact that simple, old-school expoits & attack methods continue to work against newly deployed software.  While the facts are true, I believe that Aneri has missed the point completely.  I suggest that the failure is not in the industry as much as in the people who choose not to take the advice of security professionals.  There are two components here.  First, Cyber Security professionals may need to improve how they educate people on the subject of risk.  Second, those in control of businesses must take ownership when things fail if the failure happened after they elected not to enact recommended security measures.  Blaming the Security industry for breaches is inaccurate and distracts from the real cause of security issues.

Regarding educating people on risk, let’s take one example. Aneria says “The best way to fight this cyberwar is to get back to basics, like knowing how many computers a company has and gaining control over them in seconds.”  This is true.  The industry has been saying this for years.  Take, for example, the SANS Top 20 Critical Security Controls, now the CIS security controls.  Number one on the list.  “CSC 1: Inventory of Authorized and Unauthorized Devices”  That would correspond to “knowing how many computers a company has”.  This simple step is the number one thing that companies can do, and yet many, many companies don’t do so.  (There’s a poster too, which I recommend.)

Regarding how companies encourage bad behavior while ignoring the security industry’s recommendations, let’s consider the very web page accusing the industry of failure.  The industry has said for years  that running lots of scripts on a web page increases risk.  Each time a user opens up their browser to run more scripts they have exposed themselves to more code from unknown sources.  For this reason many people, like myself, use script blockers as part of keeping our browsers secure from attack.  When I tried to read the comments on the cnbc.com article I specifically allowed scripts to run for the current page.  I did this three times.  Each time allowing more and more scripts to run.  In the end I was still not able to view the comments, and the page still wanted to run more scripts.  (Yes. I know that MEI Security’s web page asks for some scripts to run, but it does function with scripting disabled.)

In conclusion, the article proclaiming that the security industry has failed shows by it’s very nature that businesses continue to ignore the advice of the security industry, and they push for users to bring more risk into their own environments.  If you refuse to secure yourself then you’ve decided to take that risk.  When you are breached don’t blame the folks who told you not to take the risk in the first place.

Hush

Speaking as a cyber security professional, there are two “secrets” about the FBI v Apple case that seem obvious but don’t appear to have much visibility in the news.  (1) If you want to break into an encrypted device you hire people who do that for a living not the manufacturer, and (2) if a back-door is built into any system it will be used by those who don’t care about obeying the law.

There are many specialties in cyber security.  Picking three for illustration, there are companies that unshred documents – see our upcoming post on how to use a shredder properly.  There are companies that specialize in breaking into online sites.  And there are companies that break into mobile devices.  If you need documents rescued from the shredding bin you call a deshredding company, not the shredder manufacturer.  If you want to see how vulnerable your web site is to attacks then you hire a company that does that all day every day, never hire the company that built the web site – especially if you built it yourself!  And if you need to break into a mobile device, in this case an iPhone, then you hire a company that breaks into these devices all the time.  You do not go to the manufacturer.  (Of course, if your goals is swaying public opinion instead of breaking into the phone then perhaps you make a federal case of it.)   SECRET #1: If you need to break into something you hire a specialist who does that for a living.

Knowing that a back-door exists completely changes how you try to break into something.  As long as a secured container is thought to be secured, the attacks against it are typically frontal assault / brute force attacks or coercion / candy-for-your-password attacks.  The moment that a back door is known to exist the known “attack surface”  changes, as do the methods of attack expected to succeed.  If a back door were to be built into a class of mobile devices (e.g. all iphones) then that back door would become the area of focus for getting into the phones.  Instead of breaking into a single phone, one successful exploit gets an attacker into all phones (of a certain version etc.)  The idea that the special back door will only be used when appropriate (e.g. with a warrant) is just silly.  Once the back door has been built, the security of the system is broken, and government funded (possibly not the U.S. government) and criminally funded attackers will get the key.  Yes.  I said “will get” not “might get”.  If it exists they will obtain it, and they don’t care about warrants or other legal issues.  What started as a Law Enforcement Only back door will then be use to steal private information for use by other governments and criminals around the world.  How would a foreign intelligence agency use “private” text messages and emails against a government employee having money trouble or family issues?  How useful would it be for a burglar to know the precise location of every member of your family at all times? Breaking the security of the iphone – or of any ecosystem – is a serious loss for all good people.  The notion that law enforcement or apple can keep the secret key a secret is immaterial. The very existence of a back door makes it a very valuable targe. SECRET #2: Once a back-door key exists the back-door becomes the attack point, and attackers will get in, no warrant required.

The very notion of asking a manufacturer to break into their own device indicates that the goal is not the data on that one device, and if the manufacturer provides that access then it opens up all devices to those who (unlike law enforcement) don’t care about the rule of law, freedom, or personal privacy.