News articles of cyber attacks tend to make them sound very targeted. Readers are led to believe that a nasty group of evil-doers picked out a particular business or organization to inflict harm upon. In reality, this is very seldomly the case. Instead, most cyber-attacks use more of a shotgun approach. They cast a wide net in hopes of snagging their victims. They often do this by focusing on finding security weaknesses in popular software applications.
For instance, all of the previously mentioned “cyber attacks” are targeting very widely used technologies. Solar Winds is a very popular IT support management tool in use by thousands of organizations. VMWare is the most common networking tool for dividing physical servers into multiple “virtual” servers to reduce the need for expensive hardware. And, of course, Microsoft Exchange is the world’s most popular local email server. None of these incidents targeted specific businesses or even industries.
Misunderstanding causes harm to businesses.
When business leaders have the perception that cyber-actors are honing in on large targets like big corporations or government offices, they tend to let their guard down. Rather than taking precautions to prevent attacks, they can get comfortable thinking that they are not at risk. Conversely, understanding that cyber-attacks generally do not discriminate against their victims, can lead to a security-conscious mindset.
Consider the Microsoft Exchange “attack” for a moment. It is not targeting Microsoft, but instead, every business or organization that is still using locally-hosted Microsoft Exchange. Microsoft has been focusing its efforts on developing its modern business products for several years. Microsoft 365, for example, is a cloud-hosted suite of business applications available on a subscription basis. This model provides constant updates to the various applications as part of the subscription. End users do not have to worry about updates or security patches.
Finger-pointing won’t improve security either.
All too often when a cyber-attack has occurred, people are angry and want to blame someone. Perhaps a hacker gained control of a computer in a business network and used it to steal private information. Or maybe, a criminal tricked an executive in the business into providing their login credentials to their email account and redirected payments to an off-shore account. Who is at fault in cases like these?
If a particular software security hole is exploited by a hacker, is it the fault of that software company or of the business that did not regularly apply updates and patches that would have closed the security hole? How about that executive giving up their login information in a phishing scheme? Did they have current cybersecurity awareness training? Did they implement multi-factor authentication so even if their login information was stolen, a hacker still couldn’t get in? Or were they against these extra security measures because they required time and effort?
The point is, regardless of blame, there are many options for keeping a business network more secure from cyber-threats. Ignorance is no excuse, and even if it was, see how much good that will do you when your business gets ransomware. Instead, take steps to make your business network more secure.
Put systems in place to keep your software updated. Follow recommended guidelines like NIST CSF or GDPR for information and network security. Provide security awareness training for your staff like phishing and social engineering training and testing. Embrace new technology designed to enhance and improve security instead of hanging on to old, outdated and insecure technology.
If you don’t know where to start, find a IT Services provider to help you with all of these things. Embrace information security, before you or your business becomes a victim.