In 2008, a study linked poor dental hygiene to an increased risk of heart disease — the leading cause of death for both men and women in the U.S. The study revealed that people with poor dental hygiene and those who don't brush their teeth often end up with bleeding gums, which provide an entry to the bloodstream for up to 700 different types of bacteria found in our mouths.
You might be thinking to yourself, “Why does this cybersecurity company’s blog begin with a study about dental hygiene?” Well, the answer is simple. Much like dental hygiene goes a long way toward protecting us from the increased risk of a heart attack, cyber hygiene is vitally important to protect organizations of all sizes from the dangerous and costly impact of a data breach.
That notion was underscored at Boulder Startup Week’s “You’re Not Too Small to Be Hacked.” Panelists Tom Kellermann, chief cybersecurity officer for Carbon Black Inc., Richard Melick, senior technical product marketing manager at Automox, and moderator Matt Stephenson, senior security technologist at Blackberry, offered an audience of founders, entrepreneurs, developers and other individuals interested in cybersecurity the information they need to protect their brand and implement data security from the start.
No Organization is Too Small to be Hacked
Unfortunately, far too many organizations fail to take security hygiene as serious as they need to because they feel they are too small to get hacked. However, businesses of every size — that operate in any industry — are a target, and the impact of a data breach on a startup company or small business can be devastating. Just consider the facts that, according to the Ponemon Institute, about 50% of malware attacks happen to SMBs, and of those businesses that suffered a breach, 60% go out of business within six months, per the National Cybersecurity Alliance. Why? Because if it’s valuable to you, it’s worth value to bad actors.
From sales reports to HR documents and data for coding, if someone steals that because the door was left open and someone walks out the front door with it, what value does your brand have? Worse yet, if they take it and change the design specs, change the integrity of the data so now you have a reputation of faulty product, program or app, you’re in even worse shape.
In the early stages, it’s natural to focus on growth and revenue instead of security, but every organization should start thinking about security hygiene now. Many companies don’t think about cybersecurity until it becomes a problem, and if you’re not updating a machine every day when an alert comes down, you’re putting your entire infrastructure at risk. Take island hopping and The Shadow Brokers as dangerous examples of how organizations of any size can suffer a breach.
Island Hopping
This hacking technique targets an organization’s information supply chain to jump into their system. A prime example of island hopping is the 2013 Target breach. Affecting 40 million customers and costing Target upwards of $300 million to contain the breach, pay legal fees, court settlements, etc., the hack began in Fazio Mechanical Services’ servers — not Target’s.
Fazio Mechanical, an HVAC provider that also has done refrigeration and HVAC projects for specific Trader Joe’s, Whole Foods and BJ’s Wholesale Club locations in Pennsylvania, Maryland, Ohio, Virginia and West Virginia, experienced an attack shortly before the Target breach. During the initial attack, hackers stole login credentials from Fazio Mechanical and used those to access Target’s networks.
The Shadow Brokers (and groups like them)
A hacker group who first appeared in the summer of 2016, The Shadow Brokers published several leaks containing hacking tools from the National Security Agency (NSA), including a number of zero-day attacks as well as exploits that rendered firewalls and virus detection obsolete. The Shadow Brokers, and groups like them, sell and distribute these weapons on the dark web. Due to the sophistication of some of these exploits and vulnerabilities, cybersecurity efforts simply can’t keep pace.
Compounding the issue, these hacker groups operate like legitimate organizations to steal your data. They occasionally offer a subscription service for bad actors to take advantage of the myriad weapons they’ve made available, tech and customer support to ensure the weapons are working properly, translation services, you name it. The intent is to create a free-fire zone so that defenders are overwhelmed because threat actors have such advanced capabilities.
So what can sole proprietors, startups, SMBs and other organizations that feel they’re too small to be hacked do to ensure their sensitive data remains protected?
Cyber Hygiene
Cyber hygiene is one of the best ways to remain safe from known cyberattacks. Not about intelligence but rather diligence, here at Automox, cyber hygiene means applying operating system and software patches in a timely manner, staying on top of third-party software deployment, and understanding the management and configuration of endpoints under your control.
But remember that cyber hygiene is a journey, not a destination. After all, if you don’t have a strong approach to security, everything else you do is susceptible. Beyond cyber hygiene, even if you don’t have staff or the bandwidth to do effective cybersecurity, there are a lot of things you can do to try to remain safe.
- Leverage automation.
- Knowledge sharing/collaboration.
- Employ strong antivirus and endpoint protection tools that can focus on the bigger threats at hand.
- Focus on behavioral or entity anomalies to detect and suppress them in real time.
- Invest in alert triage to alert you like neighborhood watch.
- Ensure your security system integrates with the tools you use now as well as other vendors in the future.
Given that startups want to be loud in creating their own brand, know that your brand will likely be misused if the opportunity arises, so cybersecurity is vitally important. Remember, resiliency, business continuity and your desire to maintain uptime, not undermine operations is important, but it’s not more important than your data being stolen, destroyed, or used against you or your customers.
About Automox
Facing growing threats and a rapidly expanding attack surface, understaffed and alert-fatigued organizations need more efficient ways to eliminate their exposure to vulnerabilities. Automox is a modern cyber hygiene platform that closes the aperture of attack by more than 80% with just half the effort of traditional solutions.
Cloud-native and globally available, Automox enforces OS & third-party patch management, security configurations, and custom scripting across Windows, Mac, and Linux from a single intuitive console. IT and SecOps can quickly gain control and share visibility of on-prem, remote and virtual endpoints without the need to deploy costly infrastructure.
Experience modern, cloud-native patch management today with a 15-day free trial of Automox and start recapturing more than half the time you're currently spending on managing your attack surface. Automox dramatically reduces corporate risk while raising operational efficiency to deliver best-in-class security outcomes, faster and with fewer resources.
