For business owners and IT department heads, there’s no worse email headline than one that begins with the words “cyber attack.” A few years ago, I started noticing more and more disturbing trends related to the cybersecurity industry, and it’s changed how I’ve looked at the internet, protections, and our business.
I want to share some of my cybersecurity insights for disaster preparedness as these are particularly relevant to business owners and IT department heads. Our goal at LifeSecure is to protect lives, including your personal data.
Cyber Security Statistics
Data breaches are expensive, and 2023 brought the highest average cost on record at $4.45 billion. Worst off, 74% of all data breaches result from human error. A simple email, a wrongly downloaded file, or even regular internet usage may cause serious financial and personal harm.
In 2022 alone, there were over 1.1 million reports of identity theft, and as a result, global spending to prevent cybercrime is expected to exceed $1.75 trillion by 2025.
And these are just the financial costs; the emotional and time investment is just as significant. Losing control of your information, like passwords, email accounts, and even social security numbers, is emotionally draining. You never know what else might be taken from you or spread online.
When your data is breached and essential information is released online, it can be painstaking to identify which credit card accounts are being created in your name, fight against different services being opened in your name, and the constant worry of always knowing your personal information is out there for the world to see.
Remember, 43% of all cyber-attacks target small businesses. Cyber attacks are costly, but investing in your business’s security now might save a lot of money in the long run that you’d have to shell out in case of a breach.
Cyber-attacks also are affecting local infrastructure. In 2021, an attack hit Colonial Pipeline, causing gas shortages and disrupting airline operations. Hospitals, power grids, and other essential services have also suffered from online cyber-security issues.
Emergency preparedness goes beyond natural disasters; it’s about protecting as many lives as possible, no matter the type of danger.
What are Cyber Attacks?
For those unfamiliar with how cyber attacks work in a business setting, cyber attacks often occur on a business’s IT systems, targeting sensitive business information, financial information, and personal employee information (like social security numbers).
These attacks exploit software, hardware, or human behavior vulnerabilities to achieve various objectives, from stealing sensitive information and financial assets to causing operational disruptions or spreading malware through critical infrastructure and services.
As technology advances, so do the techniques employed by cybercriminals, necessitating continuous efforts in cybersecurity to protect digital assets and maintain the integrity of online systems.
What Types of Cyber Attacks are There?
One of the most popular types of cyber-attack comes through malware.
Malware
In this attack, malware compromises a business’s servers, giving hackers access to important documents and system information. The perpetrators then encrypt the business’s files, necessitating the ransom payout to the hackers to re-secure the information.
Phishing Attacks
Phishing attacks involve deceptive tactics to trick individuals into disclosing sensitive information, such as usernames, passwords, or financial details.
Cybercriminals often use fraudulent emails, messages, or websites that mimic trusted entities, exploiting human trust to gain unauthorized access.
Denial of Service (DoS) and Distributed Denial of Service (DDoS) Attacks
Denial of Service attacks aim to disrupt the normal functioning of a network or website by overwhelming it with an excessive volume of traffic.
Distributed Denial of Service attacks involve multiple sources coordinating to flood the target, rendering it inaccessible to legitimate users.
Zero-Day Exploits
Zero-day exploits target software vulnerabilities unknown to the software vendor or the public.
Cyber attackers capitalize on these unpatched vulnerabilities to infiltrate systems before security measures are implemented, making them particularly potent and challenging to defend against.
*A note about infrastructure and cybersecurity:
Another alarming threat with cybersecurity is a hacker’s ability to access the nation’s power grid. One area and topic of concern is power outages that a cyber attack may cause. Though the government has close regulations to protect the nation’s energy grids, it is always best to prepare.
Which Industries are at the Highest Risk for Cyber Attacks?
Manufacturing, finance, and insurance are the top industries targeted online. This is partly because personal data is stored on these systems. Another potential reason is that if a cyber-attack shuts down crucial manufacturing production, the company may be more likely to pay a ransom to re-obtain access to its systems.
Other highly targeted industries include education, energy, and retail.
How Do I Protect My Employees from a Cyber Attack?
When you begin thinking about your business’s cyber attack preparedness, you should first adopt the mindset that it’s not about if your business will be threatened, it’s about when it will be threatened.
Cyber threats are so commonplace that you must assume the worst will happen to ensure you’re completely prepared. From there, we recommend you follow a three-step approach to preparedness:
1. Strategic Planning
The first part of any cybersecurity approach should always be strategic planning with IT security management and senior-level organizational leadership.
They’ll be responsible for determining the scale and priorities of a protection program’s immediate and long-term goals.
As they do this, they should consider the budget allocated for cybersecurity, what systems, data, and operations should be protected, and how much inconvenience or operational disruption is acceptable to ensure protection.
2. Operational
The second step of the preparedness process is the operational level.
This part of your cybersecurity planning process should take a few weeks to a few months at most. The goal of the operational level is to identify current and emerging threats, including their motivations, methods, and campaigns.
This will help your business create a plan for resource allocation and system implementation for your protective needs.
During this step, consider the following: What would make the business a desirable target; if the business or company currently has the right personnel employed to ensure protection; how current incident response procedures can be improved; how can current employees be better educated on scams like phishing; and if third-party vendors with access to company data have adequately vetted for cybersecurity protections.
It is important to take all the steps to prevent such an attack, but it is also important to be prepared to have a plan to handle the situation if the worst occurs.
Have a plan to work with your employees to maintain and control the situation.
Make sure to have a list of all the emergency contacts you need to inform about the attack (banks, lawyers, etc.).
Keep necessary emergency supplies on hand, such as emergency power and lights.
Reliable and consistent power will be essential in surviving a disaster. Being able to safely and consistently charge a phone during an emergency or use a laptop or radio, will enable you to communicate important information and receive important emergency updates.
3. Tactical
These are the day-to-day monitoring and investigative tasks that occur on the ground in the IT department of a business.
The department and the IT systems employ the cybersecurity strategies set by the strategic and operational prongs of the business’s protection plan.
On the tactical side, threats from both outside and inside a business are mitigated (and yes, unfortunately, the latter does happen — intentionally and unintentionally).
Data, information, analysis, and report compilation happen on the tactical side, as well, which are all critical for a C-suite’s evaluation of the cybersecurity plan’s effectiveness.
For companies and businesses with the resources, it’s always a wise decision to hire a third-party cybersecurity expert to help carry out the tactical approach and help fine-tune the strategic planning and operational steps. An outsider will better be able to provide risk mitigation services like:
- Continuous network attack monitoring
- Offline and off-site backups
- Business recovery implementation
- Collect intelligence on emerging security threats
- Vulnerability Scans
- Incident response and forensics
Protecting Your Employees During a Cyber Attack-Related Power Outage
There are a lot of hazards that can come with power outages that you need to take the time to prepare for.
Be aware of any health conditions your employees may have.
Know if they fall into a group that needs the power to help manage that condition.
For example, an employee with diabetes will need access to a source that will refrigerate their insulin.
Make sure you are prepared to control exposure to extreme temperatures.
For example, in the winter the heat will turn off with any power outage.
Exposure to cold temperatures could lead to serious health problems, especially if anyone is in any type of weakened state.
We suggest keeping a stock of cold weather preparedness kits and emergency thermal blankets.
Without refrigeration, food can spoil rather quickly.
Be cautious of the risks of food poisoning. Depending on the severity of the power outage, the street lights could be out, and your workers may need to stay put before they can travel home safely.
Without power, water plants cannot operate. Most have backup generators, but it is better to be safe than sorry. Have a supply of filtered water to avoid exposure to contaminated water.
Be prepared to take care of any injuries.
During a power outage, medical systems are strained, phone lines could be down, cell phones could have low batteries, etc. Awaiting medical systems could delay treatment during this time. We recommend having an emergency kit handy and ready to go during an emergency.
Don’t Let Cyber Attacks Ruin Your Business
All it takes is one online attack to ruin your business financially, emotionally, and physically. Use best practices when using the internet and educate your team on how to avoid phishing scams. Also, don’t hesitate to purchase emergency kits in the event of a long-term emergency.
LifeSecure is here to help if you have questions about cyber-attacks, emergency preparedness, and disaster aid kits.
