How to Protect from Cyber-Attacks to Business

As you might have heard in the media, several governmental institutions, healthcare institutions, universities and companies were victims of a targeted cyber-attack during the last months. The last attacks were clearly targeting to all type of Industries. It’s especially important to understand how prevent cyber-attacks on Businesses. What are the cyber-attacks prevention plan to be followed in the interest of the organization? You also need to understand what are the ways to protect yourself from cybercrime as well. Cyber threats are increasing day by day and Cyber Security is key topic today how to protect yourself from Cyber Threats.

All attacks were performed with a malware type called “Ransomware”. Once infected, the Ransomware spreads across the internal company network and encrypts all files which are accessible by the user who received the malware infection. Computer Security specially working from Home need to be taken care seriously.

You need to get training from your IT Department (Information Security) how to protect your computer also from cyber attacks. Need to understand what the cyber-attacks is and its prevention in the organization.

Many cyber security companies are providing online and offline trainings that can be enrolled personally or by organization to aware all the employees in the company on priority. Many cyber security websites are available providing awareness and knowledge on the topic.

Every employee is responsible for avoiding to becomes a victim of a cyber-attack. Recent surveys conducted by Small Business Authority and Security Partners all over the global. National Cybersecurity Alliance suggested that many small businesses are still operating under a false sense of cyber security.

What is Cyber Attack?

A cyber attack is launched by cybercriminals, an assault using one or more computers against a single or multiple computers or networks of computers. A cyber attack can maliciously disable computers, use a breached computer or steal data, as a launch point for other attacks.

What are the Common types of Cyber-Attacks?

1. Malware

Malware term used to describe malicious software, like spyware, viruses, ransomware, and worms. Through a vulnerability, Malware breaches a network, typically when a user clicks a dangerous link or email attachment that then installs risky software. Once inside the system, malware can do the following things:

• Blocks access to key components of the network (ransomware)
• Installs additional harmful software or malware
• By transmitting data, covertly obtains information from the hard drive (spyware)
• Renders the system inoperable and Disrupts certain components

2. Phishing

Phishing is an increasingly common cyberthreat. Phishing is the practice of sending fraudulent communications that appear to come from a reputable source like usually through email. The goal of phishing is to steal sensitive and important data like credit card and login information or to install malware on the victim’s machine or computers.

3. Man-in-the-middle (MitM)

Man-in-the-middle (MitM) attacks, is also known as eavesdropping attacks, occur when attackers insert themselves into a two-party transaction. Once the attackers interrupt the traffic, they can filter and steal data. Two common points of entry for MitM attacks are:

1. On unsecure public Wi-Fi, attackers can insert themselves between the network and a visitor’s device. Without knowing, the visitor passes all information through the attackers.

2. Once malware has breached a device, an attacker can install software to process all the victim’s information.

4. A Denial-of-Service

A denial-of-service attack floods servers and systems, or networks with traffic to exhaust resources and bandwidth. As a result, the system is unable to fulfill legitimate requests. Attackers can also use multiple compromised devices to launch this attack. This is known as a distributed-denial-of-service (DDoS) attack.

5. SQL Injection

A Structured Query Language (SQL) injection occurs when an attacker inserts malicious code into a server that uses SQL and forces the server to reveal information, it normally would not. An attacker could carry out a SQL injection simply by submitting malicious code into a vulnerable website search box.

6. DNS Tunneling

Over port 53, DNS tunneling utilizes the DNS protocol to communicate non-DNS traffic. Over DNS, it sends HTTP and other protocol traffic. Various, legitimate reasons to utilize DNS tunneling. However, to use DNS Tunneling VPN services, there are also malicious reasons. As a DNS, they can be used to disguise outbound traffic, concealing data that is typically shared through an internet connection. For malicious use, from a compromised system to the attacker’s infrastructure, DNS requests are manipulated to exfiltrate data. To a compromised system, it can also be used for command and control callbacks from the attacker’s infrastructure.

7. Zero-Day Exploit

A zero-day exploit, before a patch or solution is implemented, hits after a network vulnerability is announced. Attackers target the disclosed vulnerability during this window of time. Zero-day vulnerability threat detection requires constant awareness.

Cyber Attacks Key Elements that is essentials to be Protected

• Do not use any USB medium (Memory Stick, HDD, etc.) to copy files to or from any organization computers. Exceptions might be necessary. In this case, please always contact to IT Teams describing the need and the IT team will support you and gives you right advice following the benefit of the organization.
• If your organization implement proxy in your Internet Network, never disable the Proxy of your computer. here should not be any exceptions.
• Do not use any other cloud file transfer services except the Official solutions to share the files outside in your organization. If your suppliers or customers ask you to use other services, please inform them that you cannot use it for security reasons and create a folder for sharing using your internal solution.
• Never click any link in emails or open attachments which you do not expect or are suspicious to you. Please pay special attention to emails and in any doubt use the Report Phishing options in your organization. The IT security team then takes care and inform you if the email is okay or not.
• Do not provide any contact details about you or your colleagues in the external Out of Office Message in Outlook – especially no email addresses or telephone numbers.
• Always follows your Information Security guidelines and get regular trainings on Information Security and own your responsibility to support your organization
• Always make sure, all your software’s and applications are up to date following your organization policies
• Avoid any identity theft, may be someone can use your personal information like your Aadhaar, PAN, OTP related information.
• Now a says Social Media in increasing in daily use and so many things needs to be taken care. You need to make sure you always take care your social media settings seriously so that you avoid security threats and attacks while using Social Media.
• Many times, it’s possible you are working from Home, you need to strengthen your Internet following the standard guidelines like strong encrypted passwords, organization VPN on public internet.
• At home network, you need to take care and aware to your children how to be secure and what are the guidelines, they must follow, always try to use penetrable control measures.

Key Elements while on Business Travel

• Do not use publicly available USB loading docks. Use your own power plug.
• Do not work on confidential files in public like trains, planes, etc. You do not know who can see your screen. Install a privacy filter on your laptop display in case you travel frequently.
• Do not carry any files on USB storage devices with you. They are unprotected.
• Do not carry any confidential printed information with you during travel. Try to reduce printed information as much as possible.
• In case of loss or theft of a device, immediately contact to your IT Team or create ticket and inform your local IT contacts.

In case that you suspect or are target of any malware or cyber-attack, immediately contact to your IT Team, or open a Service Desk ticket and inform your local IT contact person. They will support you and take the appropriate measures.

Conclusion

Cyber-crime is a real threat. To protect your company best, count on your support to identify and therefore avert damage for our company. This is the reason protect in information security your company data and around data protection your personal data.

Cybercrime and Cyber Attacks are an ongoing threat in 2020. You might think that the only form of Cyber Attacks and cybercrime, are the only worry about is hackers stealing your financial and personal information. But it may not be so simple. There are far more security concerns than simply basic financial and personal ones. Cybercrime and cyber-attacks continue to evolve, with new threats surfacing every year. You should always follow the Information Security Policies in the organization.

Have you been or do you fear being hacked? Did you accidentally violate any of the Information security? Do you fear that unauthorized persons could have accessed confidential information? Have printouts with sensitive data been stolen? Contact to your Information Security Team. Always cybersecurity best practices should be followed recommended by the organization.

So, I recommend following above guidelines to protect and prevent from Cybercrime and Cyber-Attacks. What is your feedback or what you want to add more?