Anthem. How many big ones are coming?

Another Breach and you are probably affected!

Today it was announced that Anthem was breached. 80 Million people affected and you may have been one of them. So now what? Do you sit around an worry if your info will ever be used against you? Do you feel angry and wonder why someone would do this and why it was not prevented? Do you just move on with your life and ignore it?  I know what I am going to do.

I am going to do the same thing I have been doing which is closely watch my bank account and my credit report. To me that is the best defense against all of this short of going back to the days of keeping money in the freezer or something like that (might raise a few eyebrows too) 

The feeling is helpless so what can we do? Our data goes into the hands of so many companies on a daily basis. This is why I find it interesting when clients talk to me about going to the cloud and if it is safe or not. I tell people that I would much rather take my chances with the likes of Google who invests millions of dollars to protect data. 

Today is another example of how truly difficult it is to protect data. All over the place there are companies struggling with understaffed and frankly under educated (about Info Security) technical staff just trying to keep up with daily operations facing more and more pressure. The shortage of Info Sec (Information Security) professionals is seen as one of the largest skills shortages for IT for the 4th year running. Not enough people are getting into it and the good ones all work for large companies for the most part so how will we catch up?

I have been involved heavily on the security side now for the past few years and I have seen this trend from trying to prevent things like virus outbreaks and attacks to now struggling just to detect them. I recently had a case where it took 4 different virus scanners before I found anything wrong on a client's network. 4. That is scary. The way things can be concealed is alarming.

Early reports on the Anthem breach state that the company knew something was going on since December 10, 2014. So it was detected but they probably did not know exactly what they were dealing with until they finally found that proof. A company that size can not just "think" something is going on and then take a precaution like shutting down systems. They have to first figure out the what, how to stop it and then the why. It isn't easy in a little company and I know it is really hard in a big company.

So what can we do about it besides get mad at these big companies we think should have the resources to prevent this? First, get real because it is not preventable in our current culture. Today's breach sounds as thought it was some sort of sophisticated malware that got on to the system probably by someone inside.  I am not saying it is hopeless but the good guys seem to be chasing the bad guys and the bad guys keep getting further ahead. What this last breach does to the (Info Sec) industry is too hard to tell. Will HIPPA laws get tighter? Will PCI-DSS become mandatory and actually be checked? I don't know but I can tell you something will be triggered from this one and the future breaches we will be having I am sure. Only one thing is for sure. It will be a long 2015 from the looks of it!

Can Your Business Survive a Cyber Attack?

CAN YOUR BUSINESS SURVIVE A CYBER ATTACK?

It's a Wednesday afternoon and business is as usual. Suddenly one computer user says they can not get anywhere and their cursor is spinning. Then another, and another and soon you have an entire office at a stand still. They can not click on anything and they can do anything. You call your IT group saying you have a problem and within a few hours they are on site. The whole network is down and there is no sign as to why. After troubleshooting and hours of diagnosis the verdict is in. You were attacked! It is called a Distributed Denial of Service attack which crippled your network. A crew works overnight to figure out where it coming from and put an end to it. You just spent thousands of dollars and wasted hours of time.

Is this something your business can afford? I saw this scenario play out with a client of mine (they had a different IT group at the time but were looking for some help from me). The figure was around $3000 per hour  and that included off hours because they sold product online. They were down a total of 16 hours. They lost untold customers in a very competitive market. It took them over a week to recover inventory services and get back to where they were full strength. It was estimated in the $100,000 range in loss. It took them months to recover financially and almost didn't make it back.

The reason why this happened or was done was never discovered like many other cases. Many times the business worries about the why afterward instead of during. They just want their business back. More and more these kind of attacks are being done for extortion or as one business vs another. 

Most small businesses I run into have a very inexpensive router so things like logging all of the activity is not set up and many of the inexpensive routers are fairly easy to compromise. Higher end equipment will tell you what is going on when and can detect problems when they happen instead of finding out when users can not get to the Internet or network.

Cyber attacks continue to mount. It is not just the Home Depots of the world getting hit. I have seen industry numbers as high as 75% of small businesses being affected by attacks. Major attacks cause somewhere in the range of 60% of businesses failing.

Bottom line is no matter what size the business it is time to shore up your security efforts. Yes it is more capital you need to invest in equipment but you also need to invest time in training employees on safe practices. I know this is costly but so is losing your business!!

Protecting kids against predators

I spend a fair amount of time on LinkedIN these days. Yesterday I saw a post on there from someone locally trying to put together a security and safety expo. This is for the community to learn more about security and safety in a wide range of topics. Many of the local law enforcement agencies will be there. Anyway I sent her a message saying I would be happy to have a booth there. As it turns out law enforcement has been asking for someone to talk about Cyber Security.. BINGO...

I am a parent myself and even with all of my background I have struggled keeping track of where my teenage kids are going on the internet. My kids are probably more tech savvy than the average kids. I plan on adding a section on my web site with basic information for parents and resources that they can get online to learn how to protect kids and themselves. The reason I bring this up is as I was doing some research on the Internet last night I found that literally no one is leading the charge to help protect kids (and help parents). Frankly it amazed me.

When my daughter was in 8th grade we went on a trip to a water park. We stayed overnight and she was online somewhat at the time. I had my laptop with me and she asked to use it. I found out after seeing a look on her face that there was someone talking to her online. This person was posing as a 14 year old boy from a local city. As I looked through the chats etc I saw where this was going and it was obvious it was not a 14 year old boy. I reported this person to ICE and I only found that after searching the internet (where to report it). I did receive a response that they were investigating and then never hear back from them.

The feelings I had about that incident brought anger, fear and terror to me thinking if my daughter would have ever somehow met up with person. How much of this goes on daily? How would parents find out?

Well, that is why I am now dedicating some time to educating anyone who will listen on how to look for the signs, protect their kids and themselves. In everything that is going on in our world this seems to be a subject that comes up but few are doing anything about it. Government agencies are trying but it takes others to help them with this.

I can not imagine what would have happened if I did not do something about that day and I do not want to think about it. There are parents who do have to think of it because it happens to their child. Time to educate.

Think your safe? Look at these stats for data breaches!

I ran across this today and it is truly amazing who and what have been breached. To me this is scary. So what is the answer?  We have to use the internet these days but it is like having to use a path full of mines.

Worlds largest data breaches