Cybersecurity 101: Protecting Yourself When an Attack Comes – Part 1 January 11, 2024 – Posted in: Cyber Security, IT Support – Tags: cybersecurity, cybersecurity 101, it support, ITServices, ITSupport
Our last Cybersecurity 101 article outlined the basics of protecting yourself from malicious actors. Whatever steps you take, you still need to assume that at some point someone who shouldn’t will get in. This article covers the steps and solutions that help protect you when an attack lands.
STOPPING MALWARE ON YOUR COMPUTERS
You must have an anti-virus solution on your computer. An anti-virus is a piece of software that scans your computer for malicious software and quarantines and removes any it finds. Many modern anti-virus solutions also include firewall capabilities for keeping people out, but the key after an attack is how quickly it responds and quarantines an offending file or program. Whether you pay for a commercial anti-virus solution or use the built in Microsoft defender every computer, laptop, surface, iPad or business phone should have an anti-virus in place.
Historically there has been an argument that Apple devices don’t need anti-virus because the majority of viruses are aimed at Microsoft PCs. That may (arguably) have been the case when malicious software was hard to produce and distribute, but the barrier to entry has come down. Whilst only around 1% of attacks are aimed at MAC OS’s that is 1% of millions of attacks – more than enough to warrant an anti-virus.
PROTECTING YOUR CUSTOMERS IF YOUR EMAILS ARE SPOOFED
There are two different ways someone could send emails pretending to be from you:
- By breaching one of your email accounts – in this case they log in and actually send the email from one of your emails.
- By spoofing one of your email accounts – in this case they will send the email from another address that may be similar to yours, and make cosmetic changes so it appears to be from you.
We’ve covered how to protect yourself from the first one – MFA. The second is harder to control. If a malicious actor pretends to be you and sends an email to your clients it is not your fault, but perception can be unfair and it can still damage your business’s reputation.
You are limited on what you can do to prevent people spoofing your emails, but there’s one thing you can ask your IT Company to look at.
When you send emails the process goes something like this:
You send an email from your device > Your mail server sends it over the internet > To the recipient’s mail server > Which passes it to your PC.
In order to make sure that emails being received actually come from where they claim to come from a conversation between the servers happens here.
>Email arrives with a recipient server>
did you send this”< >Your servers respond “only if it meets these criteria”
The way the server checks is using SPF and DKIM records, which together can be used to set a DMARC policy.
- The SPF record says I send from these servers/IP addresses.
- The DKIM record says I sign all my emails with this key.
- You can then set a DMARC policy that says to receiving servers: emails that say they come from my domain must be sent from these servers/IP addresses and have this signature key, otherwise they are not from me.
This will help your clients’ email servers differentiate a spoofed email from one that is actually from you.
MAKING SURE YOU KNOW IF YOU’VE BEEN BREACHED
Knowing when you have been breached isn’t always as easy as you might think. A 2023 study by IBM found that only 1 in 3 companies that discovered they had been breached did so internally. The average time to identify the breach was 182 days for companies that discovered it themselves and 200+ days for those told by a 3rd party.
Depending on what they are planning to do, once a malicious actor gains access to your systems they may start trying to change or copy files, lock up your servers, use your computer’s power as a springboard to attack someone else, send thousands of outbound emails, or wait. The hardest one to spot – and the most dangerous is the last option. If they choose to wait then they have the time and patience to look for something high value or really damaging. Whatever their plan the longer it takes to recognise the breach the more they can steal or damage.
There are some extremely powerful software solutions out there that monitor logs for unusual logins and behaviour of users, unusual usage on devices and suspect code patterns. These solutions offer the best possible protection by bringing together and comparing thousands of logs from different places and helping to spot the important ones. However, these solutions are also often expensive – both for the software and the staff to read and review the results.
For a smaller business that doesn’t process state secrets, there are less expensive options out there. Talk to your IT Company about alerts that can be set to email them if too many login attempts are made in a short period of time, or if someone logs in from an unexpected location. There are less expensive hardware monitoring solutions that can keep an eye on your servers and computers for unusual activity. A bonus of the monitoring is that it can help to spot hardware that is starting to struggle before it fails.
In our next Cybersecurity 101 article we will be outlining how to limit the damage an attacker can do once they get in, and getting your data back after an attack. If you have any concerns about cybersecurity, or would like to discuss any other IT Support needs you might have please give us a call on 01245 265100.