On Tuesday, July 16, 2019, Jeff Myers, Technology Solutions Manager and Certified Ethical Hacker at High Touch, participated in a cybersecurity roundtable discussion at the Wichita Business Journal (WBJ) with other Wichita-area cybersecurity experts. Additional participants included:
- Dustin Baty. Director of Operations, Netability
- Brian Johnson. Senior Vice President – Technology Services, Allen, Gibbs and Houlik, L.C. (AGH)
- James Pruitt. Managing Partner, Ribbit IT Solutions
- Dr. Sergio Salinas Monroy. Assistant Professor –Electrical Engineering and Computer Science, Wichita State University
The panel’s business experience and knowledge in the cybersecurity arena ranged from hands-on cybersecurity systems engineering to consulting, education, and business process development. Throughout the discussion, the panelists traded experiences concerning the different mindsets, processes, threats, and challenges associated with cybersecurity.
About Jeff Myers
As Technology Solutions Manager for High Touch Technologies’ IT Solutions division, Jeff and his team provide technology services and support for businesses throughout the Midwest. Jeff and his team of engineers and technicians focus on providing technology support from the customer’s perspective. By working alongside clients as partners, Jeff’s IT Solutions team builds long-lasting business relationships through the lens of technology.
Professionally, Jeff has over 16 years of experience as a Systems Engineer for High Touch and the State of Kansas. Numerous awards and certifications, including the III Award from the Secretary of Corrections, the EC-Council Ethical Hacker certification, and industry-standard certifications from Microsoft, CompTIA, and Mitel, underscore Jeff’s technology and leadership expertise. Jeff holds a bachelor’s degree in business administration from Baker University.
Cybersecurity Mindset in Business
To kick off the conversation, the panel discussed the cybersecurity mindsets they’ve experienced while working with client businesses. Together, the group came to a consensus that there’s not enough strategic focus on cybersecurity. Businesses need to prioritize cybersecurity akin to financial strategies and goals.
As mentioned by James Pruitt, Managing Partner at Ribbit Business Solutions, any sized business in any industry can be a target. Hackers can find useful information on any network, given the opportunity. All hackers need to do is start clicking though a network or lurk around until sensitive information becomes available.
Developing a cybersecurity mindset in business is something that needs to start at the ownership or leadership level. Business owners don’t necessarily need to know how the technology works, but they need to have a cybersecurity framework and process in place, according to AGH’s Senior Vice President of Technology Services, Brian Johnson. By understanding the cybersecurity process, business owners can better support the efforts of technology professionals. Let business leaders lead the business, and let IT experts solve cybersecurity challenges.
Furthermore, leaders need to consider their IT risks as financial risks. When you understand where the risks are, you can contact the right cybersecurity provider to keep your business safe. Oftentimes, business leaders set bad examples by not embracing the cybersecurity mindset fully. At the most basic level, cybersecurity risk starts with password management and extends to advanced threat protection and attack remediation planning. When business leaders embrace cybersecurity, they set the tone for the rest of the organization. By implementing and practicing good cybersecurity policies, business leaders can underscore the importance of a cybersecurity mindset in business.
Understanding Cybersecurity Processes
The cybersecurity business process begins with strategic planning. To be effective, a cybersecurity plan incorporates people, processes, and technology.
Cybersecurity solutions only work when everyone in the organization abides by best practices. Jeff Myers, Technology Solutions Manager at High Touch, discussed that during the planning process, it’s important to bring in an IT professional if cybersecurity is a topic of discussion. “Many businesses don’t realize that you need to layer technologies,” states Myers. “Off-the-shelf cybersecurity solutions aren’t robust enough for most organizations. Anyone can get a hold of tools to hack these systems. After watching a few free YouTube videos, they’ll hack your off-the-shelf system.”
Strategic planning
During the cybersecurity planning process, businesses need to discuss their internal strategy as well as their external strategy. In the past, businesses have underestimated the effects third parties can have on their cybersecurity. WSU Assistant Professor Dr. Sergio Salinas Monroy pointed out Target’s 2013 cyberattack as an example. Hackers stole network credentials from Target’s HVAC subcontractor and broke into Target’s payment system network.
When engineering a cybersecurity process for your business, you must hold all users, internal and external, accountable for their actions. Without that responsibility, cybersecurity processes fall apart.
Multilayered cybersecurity strategy
Once a strategic plan is in place and all major company stakeholders are on board, you can begin constructing the cybersecurity infrastructure. Myers discussed how High Touch layers cybersecurity technologies to engineer a comprehensive solution.
High Touch recommends a multilayered cybersecurity solution, which consists of the following:
- Firewalls. Prevent incoming security threats with automatic remediation, sandboxing, anti-virus, intrusion prevention, content filtering, and advanced threat detection.
- Endpoint Protection. Protect workstations and servers with anti-virus solutions, drive encryption, and device management.
- Email Security. Automatically scan email for spam, unlawful interception, phishing, malicious attachments. Encrypt outbound emails containing sensitive data.
- User Education. Teach users about safe IT practices, such as internet, email, and peripheral device usage; password management; and data control.
- Image and File Backup. Ensure your company’s data is protected by employing a secure monitored backup solution with on-premise and off-site recovery solution strategies.
Building an end user cybersecurity strategy
After businesses create a cybersecurity framework and implement technology, they need to develop plans for user education and remediation.
Does your business have a cyberattack remediation protocol in place? One simple attack can destroy a company’s reputation, so businesses choose to forgo making an announcement unless there’s a widespread customer impact on a dangerous scale. As indicated by Johnson, unless you can 100% determine the extent of the cyberattack, including data, entry points, and affected parties, you should contact a professional to assist with the remediation process. Cybersecurity consultants can also help you develop an in-house plan for educating employees on cybersecurity best practices.
Common Cybersecurity Threats
Throughout the discussion, members of the panel shared their first-hand experiences with cyberattacks. In sharing their experiences, the experts identified common cybersecurity threats.
Password management
Despite continuous warnings since the beginning of the internet, password theft continues to be one of the most prevalent forms of attack. In Myers’ experience, business leaders are easy password theft targets. Oftentimes, they’re too preoccupied with tasks to incorporate complex, comprehensive passwords. Their accounts, however, are bountiful targets for hackers. The roundtable provided some basic tips, such as not writing down passwords or storing passwords in a spreadsheet, creating unique passwords, and not using phrases or names easily discoverable through social media as passwords or security answers.
In addition, the group explained the benefits of multifactor authentication and password managers. These security technologies used to be cutting-edge, but they’ve become the new industry standard. With multifactor authentication, you log in to an application using a username and password. Upon successfully providing your credentials, the application sends a secret code to a secondary device, like a cell phone. When you provide this code to the application, it grants you access. Password manager applications, often secured by multifactor authentication, help you create and remember unique, secure passwords.
Ransomware
With ransomware, hackers prevent system access or kidnap data until you pay a ransom fee to regain control. Ransomware continues to plague the business community. After a hacker has gained entry, they can lurk undetected for years on your device, application, and network.
The panel warned of companies that advertise quick fixes for ransomware attacks. Remediation companies exist that work alongside hackers to launch their own ransomware attacks. After the attacker issues the ransom, they contact businesses to seemingly negotiate a fee, and then keep a percentage for themselves. While you have your access or data back, you’ve been robbed, your vulnerabilities are exposed, and you’re an easy target for future cyberattacks.
Disgruntled employees
Unsurprisingly, disgruntled and former employees have been responsible for executing cyberattacks on their employers. With that in mind, it’s important to include human resources in your cybersecurity process. The software and knowledge required to become a hacker is inexpensive and easily accessible online. With insider knowledge, an ex-employee can quickly execute a cyberattack upon termination.
During the discussion, Myers encouraged companies to contact their IT departments or providers during the employee off-boarding process. Cyberattacks are expensive. Depending on the skills of the employee and the terms of separation of employment, two weeks of pay will most likely cost less than data recovery and cybersecurity remediation. In addition, your IT team can properly revoke access upon termination when human resources is involved in the cybersecurity process.
Industry-specific threats
Dr. Salinas discussed industry-specific cybersecurity threats that exist, specifically in the manufacturing space. Consequently, in this arena, cyberattacks often translate to physical security attacks.
The manufacturing industry employs machinery rooted in a sophisticated technology infrastructure. When an attacker infiltrates the network of a manufacturing company, their actions usually have physical consequences. Hackers can shut down production of a manufacturing operation, which depending on the size, can cause millions in revenue loss.
Additionally, the manufacturing industry is an attractive target for data and lucrative files, like blueprints and operating procedures. Unfortunately, many manufacturing companies forego cybersecurity for physical security. It’s important to protect all aspects of your business when engineering a security solution.
Challenges in Cybersecurity
The cybersecurity landscape is constantly changing. There’s a never-ending battle between discovering cybersecurity vulnerabilities and repairing them. During the discussion, the roundtable underscored the following challenges:
- Complicated Threats. Smarter cyberattacks lead to improved cybersecurity, which in turn leads to even smarter cyberattacks, and so on. Cybersecurity professionals must continuously educate themselves on the expanding cybersecurity landscape.
- Credibility. No business wants to report that they had a cyberattack. Unless a large, national, or global brand is affected, you normally don’t hear about cyberattacks. Businesses are scared to report cyberattacks because of the potential business impact. This makes it difficult for cybersecurity professionals to track outbreaks or document security flaws.
- Remediation. Most of the time, it’s easier to notice that you’ve been attacked than it is to determine the extent of the cyberattack. If any tiny piece of the cyberattack goes undetected, hackers can find a way back in. Many businesses don’t ask for help until it’s too late. Remediation after the attack is just as important as discovering the attack in the first place.
- Hiring. Towards the end of the roundtable, the group discussed the challenges of hiring cybersecurity professionals in Wichita. There aren’t enough cybersecurity-focused professionals to meet the current demand. As Dustin Baty of Netability pointed out, diversity in the cybersecurity workforce is even scarcer.
- Ease of Use. With basic computer knowledge and a few inexpensive tools, anyone can learn how to hack after watching a few YouTube videos or spending a few hours on Reddit. On the other hand, cybersecurity training takes extended commitment—you need formal training and experience to enter the field professionally.
- Sophisticated Crime Network. Cybercrime has grown into a multimillion-dollar enterprise. The value of data continues to increase, as does the intelligence behind cyberattacks.
Expand Your Cybersecurity Knowledge
Building a cybersecurity solution for your business may seem intimidating, but it doesn’t have to be. High Touch provides the tools, services, and knowledge you need to keep your business safe.