Has Your Company Data Been Compromised?

You might believe that your information assets are secure and your company’s security systems are keeping things safe, but how do you really know? While large scale financial services companies and other major corporations have the resources, highly trained technical staffs, and custom tools to monitor for and identify leaked data, most businesses do not. Companies with the resources are constantly scouring the internet, deep web and dark web for any indications that sensitive information has been exposed.

Now you might think, who wants my information or why would anyone target my company? It depends on an attacker’s motivation, or maybe its just a blind scan looking for vulnerable hosts by a potential hacker. If you become compromised perhaps access to your environment might be sold and your infrastructure used to email malware or house stolen data. Maybe your email credentials are compromised and someone is illicitly reading confidential communications. Whatever the outcome, certainly at a minimum, your business reputation is at risk.

Many companies that are compromised typically find out long after the initial occurrence, with time spans perhaps extending months into years. Typically breaches are not found by the company itself. Many times law enforcement or other 3rd party sources may advise a compromised organization of the unfortunate situation. 

There are organizations that take extensive proactive approaches to managing information security through the use of firewalls, intrusion detection systems and monitoring software, while also investing in various technical assessments, the approach does not take into account how to detect information that may have quietly been leaked to the internet in an isolated event or ongoing.

While building robust defensive measures have improved security for many corporations and helped protect many companies from network attacks it does not account for other sources of compromise such as theft of login credentials or compromise of a 3rd party service provider’s network connected to the company’s environment. In such instances data flows may likely be flagged as normal traffic and not detected by security management systems. In these instances companies may leak sensitive information over an extended period of time.

You may still believe that data breaches don’t apply to your company, but they do.  Unfortunately many employees may use the same email address, (name@yourcompany.com), and password for sites they access in their personal lives. A compromise of a third party site used for cooking recipes may lead to a credential compromise at your company, followed by a potential loss of sensitive company data. Maybe third party service providers that work with your company’s sensitive data may expose this information through a compromise of their own infrastructure, leading to your sensitive company information being for sale on the Internet. The point is if your information has been leaked to hacker websites, regardless of the manner in which this occurred, you really should care to know.

There are an emerging set of tools that gather information in realtime, not by directly scanning a company’s infrastructure but from querying public records and other illicit sources. These relatively new commercial offerings scan internet records, the deep web, and dark web to identify what is known that may be exploited or company data that may be for sale. This may include login credentials, proprietary data, compromised servers, client sensitive information, vulnerable hosts, or other assets. Employed ongoing, such tools can provide proactive alerting to enable a company to understand potential issues and develop realtime response strategies to protect the company and its reputation.

Network Management Solutions has been helping business navigate technology challenges since 1996. If you are concerned about what company data might be readily available on the dark web, please contact us for a free, confidential discussion. We can be reached at 908-232-0100 or on the web at www.nmscorp.com

Ransomeware Attacks Hit Home

Coronavirus (COVID-19) has proven to be challenging. For most of the US, this epidemic has been ongoing for near 9 months with a new wave overtaking the country once again. Businesses have shuttered, jobs have been lost, and financial insecurity has become an obstacle for many to deal with.  

As one of the ongoing complexities, COVID-19 has shuttered in-school learning for many US students. Several US school districts including Baltimore County, MD announced that online learning had been impacted for 115,000 students due to an apparent Ransomware attack. As parents struggle to maintain a somewhat normal learning experience for their children studying from home, lacking information security practices within the information infrastructures are paramount in these disruptions. 

So what is ransomeware and how does this impact a compromised organization? Ransomeware is malicious software designed to deny access to an organizations information assets, files and or services. The perpetrator having compromised the target organization demands a ransom payment prior to restoring access to the locked data. In the case of Baltimore County, it has been reported that access to online learning tools and grading systems have been disrupted. 

Cyber insurance policies are available to facilitate ransom payments should such an attack occur within an insured’s environment. Many organizations choose to pay the ransom through insurance or directly if not insured. The cost of ransom payments have risen with many payments now being 6 figures or larger. Other organizations that choose not to pay a ransom spend millions trying to restore systems.  Atlanta Georgia in the spring of 2018 chose not to pay a ransom of $52,000 and instead paid a reported $2.6M to recover. 

While an insurance policy payment may reduce the recovery cost of an outage it does not account for the lost time of a disruption and only encourages further ransomware attacks. Ransomware attacks accounted for 41% of policyholder claims, insurer Coalition stated in its 2020 “Cyber Insurance Claims Report,” released in September of 2020. In some instances insurance companies have denied claims with excessive damage as in the case of NotPetya.

According to a Dark Reading article Maryland State auditors found a variety of vulnerabilities that could have lead to the incident in Baltimore County. While there is not clarity yet in the Baltimore County incident, it should be noted that ransomeware attacks have been ongoing for many years and most propagate due to unpatched systems. Typically, exploited systems are Windows based. Impacted systems in the case of Baltimore County have been reported to be Windows based.

At what point do we demand that organizations who maintain our personal information and upon which we rely on make certain that vulnerabilities are minimized? Individuals that are placed in technical roles must be held accountable in some manner as well as their management teams should they choose not to appropriately address ongoing maintenance of the systems and applications for which they are responsible. 

The most formidable defense against most cyber attacks beyond a properly designed infrastructure, is to establish reliable ongoing patch management and update processes for the entire infrastructure. While some may have you believe that this is a complex endeavor and perhaps it is in a very large scale environment, once established the organization’s ability to withstand cyber attacks is significantly improved. Choosing not to establish the proper protocols either through in-house staff or consulting resources is a dire mistake.

Network Management Solutions has been assisting organizations to properly design, implement, monitor and manage information technology infrastructure since 1996. We are available to assist your company in navigating the technical complexities associated with your business infrastructure. Call us today at 908-232-0100 for a free, confidential discussion on how we can assist your business and support your ongoing information security and technology goals.

Facing The Realities Of A Data Breach

Most small to mid-sized business don’t consider themselves to be a data breach target and therefore never develop an incident response plan.  Having to respond to a data breach in real time without a plan can be challenging at best.  Some would call it a nightmare.

Your obligations and approach can vary widely depending on your business and the type of information you maintain.  Has data been destroyed or deleted, have passwords and accounts been compromised, have financial accounts been accessed and funds diverted, or has a database containing credit card or other sensitive information been inappropriately accessed?  How do you know?  A plan helps you to sort out the questions and set a direction to meet your business obligations and move systematically towards recovery.

How did you become aware?  Did an external source notify you such as your bank or law enforcement?  Do you believe that the incident was triggered by an internal or external event, was it intentional?  Often errors by internal staff can create an exposure of sensitive information that is then utilized by an outside source or it can be a calculated collaborative effort between the two.  An external hack may be the result of a targeted effort or weakness that is exploited through non-solicited emails, or a web or application interface.  Regardless of what has happened and how it happened still requires action.

So what are the steps to recovery and whom do you notify? A general approach might be as follows:

Build A Team: Form a team that will be tasked with specific events addressing legal, information security, management, public relations and other concerns.

Discuss Events and Develop Approach: Identifying timelines and events leading up to the incident can be key in establishing a direction and approach for remediating and investigating the breach.

Discuss Legal and Public Relations Requirements: Understanding your business obligations is critical as this will determine what steps you must take to address any legal or regulatory concerns.  Effective public relations will help preserve your business name.

Engage Appropriate Resources: This may include your financial institution, law enforcement, incident response resources, legal counsel, among others.

Commence Data Collection and Analysis:  Collection of computer data, log records and other digital forensic evidence is key to any investigation.  Professionals are required to ensure proper protocol and preservation of evidence. Many untrained computer personnel destroy evidence or miss the breach source so the compromise continues.

Address Legal and Regulatory Requirements: Based on your analysis you may be legally obligated to notify regulatory bodies and affected entities.  Timely response is of great importance. Your business partners may need to be engaged.

Notify Affected Parties: Those affected by the breach may need to be notified by law and the protocol may vary state to state.  This includes individuals that may have had credit card information, or personal and private information exposed.  Others such as business partners may need to know to ensure that they too are not affected.

Assuming that law enforcement will investigate is highly unlikely.  Unless your compromise a matter of national concern or has a multi million-dollar impact or you can pinpoint insiders there is little aw enforcement will do.  You will need to manage the investigation largely on your own.

Maintaining a robust information security program will greatly reduce the likelihood and severity of a data breach.  Having an incident response plan will provide the roadmap to address a data breach in a timely and concise manner protecting both your business and its reputation.

Please contact Network Management Solutions for more information.  We can be reached at 908-232-0100 or info@nmscorp.com.  Our website can be reached at www.nmscorp.com.

A Critical Need for Strong Information Security Practices

Who is responsible for your information security practices and why?  If you are the business owner, CEO, or other key executive have you discussed with the individual or organization what your information security goals are?  I am not talking about a technical discussion but rather a discussion in business terms.  Are there defined security standards to which the organization adheres?  Is information security become part of the business culture?

Too many business leaders don’t find a discussion necessary and assume that their input is not necessary or the conversation too painful to manage.  Having spent a career dealing with information technology and security personnel I can relate.  However when your input is not part of the conversation don’t assume that anything is secure.  Don’t believe what your “expert” tells you unless its been verified.

Now perhaps you are a large organization and as the CEO you are too busy to deal with the techies.  Your CIO or CISO are boring and you believe you’d be more productive painting your dog’s nails.  Well there is a long list of CEO’s and board members that might wish they were more involved.  The Target Corp and Neiman Marcus are more of the same.

Hackers are sophisticated and operate in ways most organizations don’t understand.  Their probing, testing and theft happens over long periods of time.  It’s not like a theft at a storefront or bank.  Hackers rely on being stealth and their activities can last months or even years.  They are operating within your company walls from far off places on the other side of the world and your security operations staff has no idea this is occurring.

Most organizations find out about their compromise from law enforcement as they investigate criminal activity on a global scale.  However it’s still your problem. Unless your hack is a matter of national security the amount of cooperation you receive from the FBI or USSS will be negligible and may be non-existent.  Its not that they don’t want to help but these agencies are focused on national security and money supply and their resources are stretched.

So you’re a small business and you believe that you are off the grid, out of the loop.  Well that is not the case.  Depending on how events are tracked and who is reporting statics show that about one-third of all attacks involve small business

and sometimes these “attacks” come from inside the organization.  That may be shocking to a small business owner but small business is easy prey.  As a small business owner you should be asking all the right questions since your banking accounts, operation, customer information and reputation are at risk.

Often the hacker can penetrate a small organization because the architecture is flawed, devices are not properly maintained, patches are not applied, and no one is being held accountable.  As a small business owner you must be involved and must be asking the right questions.

Network Management Solutions has been helping companies address business driven technology issues since 1996.  We are currently serving a variety of customers within New Jersey, New York, and the surrounding metro areas of New York and Philadelphia.

Please contact NMS to schedule a free one-hour no obligation consultation to discuss your concerns.  We will provide expert advice in simple business terms on how to best address your issues through NMS or another provider.  NMS can be reached by phone or email at 908-232-0100 or info@nmscorp.com.  More information on Network Management Solutions can be found at www.nmscorp.com.