Four simple mistakes that roll out the red carpet for cyber criminals

Since the start of the pandemic millions have been working remotely, and many are unknowingly putting their company's data in harm's way. A lack of firewalls, inadequate technical infrastructure and decentralised IT systems can quickly lead to significant data breaches, identity fraud and a number of other dangers. Paula Januszkiewicz, founder of cybersecurity agency CQURE said that companies failing to secure remote workers' systems, are “creating a hacker’s paradise”. Speaking at the Gulf Information Security Expo and Conference (Gisec) in Dubai, she said phishing is the main mode of transportation for ransomware. Today, online criminals can make an average of "$90,000 per month from ransomware campaigns", making it a lucrative, albeit illegal, career. Since the Covid-19 outbreak, Ms Januszkiewicz said the US Federal Bureau of Investigation has reported a “300 per cent increase in reported cyber crimes”, as more people connected online for work and pleasure during global lockdowns. Some of the sure signs you have been hacked include getting a ransomware message, a fake antivirus message or friends receiving social media invitations from you that you didn’t send. Here, The National has put together a list of the most common threats - plus potential solutions - to avoid getting hacked. A firewall monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic depending on the threat level. With cyber attacks on the rise since the start of last year, proper firewall configuration is more important than ever. Disabling a firewall can leave a business or individual vulnerable to attacks. It could result in viruses infecting interconnected devices, allowing cyber criminals to carry out malicious activity remotely. Ms Januszkiewicz said that when working from home, configuring a firewall is a great way to only allow certain processes to communicate with the internet. This is one of the most common mistakes made by people trying to secure their online accounts, and it ultimately makes them more prone to cyber attacks. Devising and remembering complex passwords for every account and website is almost impossible for an individual, so many re-use the same password for several accounts. To add to this, they often make them simple so they can be remembered with ease, which is a recipe for data breaches, account takeovers and other forms of attack. While trying to improve the cybersecurity status for a large company in the US, Ms Januszkiewicz said 29 of the employees had the same password, which consisted of the company name and the year it was founded. She said passwords were “almost always re-used” and there was almost always “some variant of the company name with a number, whether it be a year or month”. Regularly changing your password is a must when trying to keep ahead of cyber criminals, and where possible, make it complicated and different from other accounts you hold. While companies often secure their remote workers' laptops, they frequently overlook how home wi-fi networks may pose a risk to company data security. For instance, while many people know to update their smartphone or antivirus software, updates to home router software are often missed. Similarly, many people do not have a firewall to guard their home network. While working remotely you should periodically update your router's software when updates are available. This ensures that any existing security gaps are quickly patched before a hacker can plan an attack. Additionally, check to see if your router has any encryption features that can be enabled. Network segmentation is one way in which employees can protect their systems while working from home. The practice involves splitting a computer network into subnetworks to boost performance and improve security. Having network segmentation in place allows greater control over who has access to what in a company, and allows rules to be set to limit traffic. If one sub-network is breached when working from home, you can alert your IT department and they can be proactive in protecting other sub-networks from attack. Checking your employer has implemented good network segmentation is one way to prevent hackers from doing too much damage. 1. Start immediately – Once you realise your data or system has been breached, you must start negotiating immediately. The more time you take to respond to a demand, the more agitated they will get 2. Inform the authorities – as soon as you are aware of the breach, you need to secure a lead negotiator who is not attached to the organisation 3. Have an end goal – always remember that the target of a negotiation is to reach a solution 4. Be respectful – if you negotiate with cyber criminals, you must never tell them that what they are doing is wrong, despite the fact that it is illegal. This could potentially sever ties with the attacker and ruin the negotiation outcome. It is important in this situation that you establish a relationship with the person on the other end of the phone or email. 5. Proof of life – the riskiest element of negotiation is liaising with the wrong person. Ask them to show you that they can restore a system, but be respectful. To do this, ask your internal technology experts to send them homework. If they prove they have legitimate access to restore the system, you can continue your negotiation Tips by Matthias Schranner , founder and chief executive of Schranner Negotiation Institute

Four simple mistakes that roll out the red carpet for cyber criminals

Working from home is making life easy for hackers, but you can protect your systems to stop them stealing your data