RACHEL – RESTAURANT OWNER

Rachel did not like to update her POS system because she didn’t like the visual changes that came included in the update. Due to this, she was comfortable running an older POS system which resulted in her system being compromised.

It is vital to keep your system up to date because it patches vulnerable holes that have been found in the past. Running an outdated POS makes it easy for intruders to get access into your system and potentially extracting confidential information.

The first step: Identify important information stored in a POS system.

What Rachel needed to protect was any information that cybercriminals can use to commit identity theft or fraud.

• Credit card numbers
• Banking information
• Names and last names
• Pin numbers
• Phone numbers

The second step: Multi-layer solution

These points helped Rachel protect her business against network breaches, physical tampering, and employee mistakes.

• Set updates to automatic for all software and systems
• Deployed Security Software and have it set to automatically update
• Limited internal access to the physical PoS device
• Locked down systems at the end of the workday
• System times out after a time of inactivity
• Routinely deleted cardholder data in case of a system breach
• Physically inspect the device in case of tampering
• Make sure there are no public/visible ports making it easy for an external device to be plugged in.
• Secure Wi-Fi connection

MATT – DOCTOR’S OFFICE

Matt did not believe that it was important to educate his employees on proper cybersecurity measures. He did not want to allocate the resources because he thought it was inefficient. One of Matt’s employees did not have the proper training to identify suspicious emails and fell victim to a phishing attack that compromised the system and network.

It is very important to educate employees on the latest cybersecurity measures because cyber attackers will try a multitude of methods to infiltrate your system. If employees are not educated, they are essentially placing the whole business at risk. Phishing programs are practically invisible so you won’t know anything is happening until it’s too late.

The first step: Increase employee awareness

There are increasingly sophisticated phishing schemes that are constantly adapting with the purpose to acquire confidential data from businesses. Identifying what information intruders are targeting is the first step to safeguarding confidential data. Some examples of targeted information from phishing include:

• Logins and passwords
• IP address
• Customer information
• Financial account information
• Employee and Customer identification information

Additionally, make sure to understand the level of employees’ current security knowledge

The second step: Test the employees

Matt was able to train his employees with our Phishing Toolkit.

The toolkit provided Matt with some of the following:

• Certification of Completion from his employees.
• Training Materials such as videos and quizzes.
• Knowledge about  phishing tactics used today

Results Included:

Employees will be able to differentiate between real and phishing schemes. Once properly educated, they are made part of the solution by emphasizing their role in protecting the company’s information to other employees and promote questions/ideas to mitigate possible future breaches.

The third step: Use of Security Measures

Even with employees properly educated on cybersecurity threats, it is still important to have other security in place to prevent any data leaks. Have employees protect their computers with antivirus, antimalware, and antispyware to minimize any risk of data leaks. Make sure employee computers are up to date on the latest version of Windows/MacOS to prevent commonly used phishing programs from being installed on your computer.

DAVID – MANUFACTURER

There are a lot of ways that attackers can get access to your system that doesn’t always involve complicated hacking skills. See Phishing Toolkit.

David was a victim of an attack through a USB Drive whose source was unknown. Although he may not have been the one to do it, the battle is already lost. David didn’t realize that his business had been compromised because there are tools that attackers use to disguise their programs.

The first step: Identify what data and software is at risk

Even before an actual attack happens, it is important to identify all sensitive information and who has access to it. David needs to protect any information that cybercriminals can use to commit identity theft or fraud.

• Logins and passwords
• Customer information
• Financial account information
• Employee and Customer identification information

The second step: Protection

• Set updates to automatic for all software and systems
• Have a Security Software in place and have it set to automatic update
• External Media Devices should all be scanned before plugging in
• Limit and control Physical Access to system devices
• Physically inspect devices in case of tampering
• Set up a different network from the primary network for guest to use

The third step: Educating all employees

Educate all the employees on how to identify different forms of breaches. It is vital to enforce security policies and to have a plan in place. Signs to look out for:

• Know when computers are acting “unusual”
• Sign in alerts from a different location
• Other connected devices in the network behaving strangely
• Browsers are misbehaving
• Anti-Virus protection
• Employees cannot access programs using their usual password.
• People in email address list get fake emails from employees

ANGIE – GYM OWNER

One of Angie’s employees accidentally clicked an ad from an unknown source and unknowingly gave out her IP address. It took Angie a lot of time to address this issue because she was unsure of the root cause of the problem. See Phishing Toolkit to help identify cyberattacks.

After further research, she realized that it was a flooding attack, but she was unsure how the intruder found access to her network. This is a very common attack that affects both small and large-scale companies by overloading the network. Upon learning that the root of the problem was the ad that her employee clicked, she decided to get her employees’ proper training.

The first step: Identify what data and software is at risk

Before an attack happens, it is important to identify all sensitive information and limit access to it. Angie needs to secure her network and disconnect her computers from the network.

• Logins and passwords
• IP address
• Customer information
• Financial account information
• Employee and Customer identification information

The second step: Protection

• Call Internet Service Provider [ISP] and have them change the IP address of the network
• Deploy an antivirus program and firewall into the network to help in restricting the bandwidth usage to authenticated users only
• Limit and control physical access to system devices
• Set up a pop-up blocker
• Set updates to automatic for all software and systems
• Physically inspect devices in case of tampering

The third step: Educate Employees

Ensure that employees don’t accidentally click any ads that randomly pop up on the screen. Ensure employees are caught up with the latest tips on safe internet practices. For more information, make sure to visit our tools and quizzes provided by CyberSafe. Click here for our Phishing Quiz.

• Visit the CyberSafe toolkit in order to learn how to identify possible attacks
• Create a customized plan with the CyberSafe planner to be prepared for threats
• Explore third-party services that offer guidance and protection against these types of attacks
• Protect yourself against monetary damages with cyber risk insurance