Company Cyber and Security Departments’ Budgets on the Rise

Even though the Corona virus pandemic has resulted in loss of business for many companies, most of them are increasing the budgets for their security departments. This is a direct result of the mounting attacks on businesses by hackers.

Many companies put their tech security departments on the wayside, choosing to instead focus on things that would directly make the company money. However, with preventative costs showing more value than recovery costs, it’s a no-brainer that companies are investing more in information security.

One way that department heads are convincing executives to invest is by showing them directly how the higher security will impact their bottom line. One of the easiest ways to show is by using ransomware as an example of how the company could either pay to secure their information or face paying off a hacker to get their information back. It’s a simple decision to make. However, there are still quite a few companies where they cannot see the value in increased informational security. These issues can only be prevented if the informational security team manages to convince the board that it’s a good idea.

vCISO

Hiring a traditional CISO can be very costly and your organization misses out on many key advantages a virtual CISO has to offer. Click below to learn more about our partner’s annual contract to manage all aspects of your Information Security Program at a fraction of the cost.

Here’s How Much Your Stuff is Going to Cost to Get Back

Dear Organization,

It was so kind of you to leave your systems so vulnerable. It was very easy for me to grab a few things I thought I wanted. Turns out I don’t really need them, so I’ll be glad to give them back. For a price.

Your Domain

It’s tied to your website and email. It’s on all of your marketing material that you spent quite a bit on. It seems to be a critical part of your brand and reputation. No one suspects anything right now, but rest assured I have full control of your domain. The website and email will be routed to a location of my choosing if you don’t pay up. It’s going to take a lot of time and money to recover from this if you don’t. These domains do have value to me, but you should know by now that I’m lazy. I want the biggest payout for the least amount of work.

Domain renewal: Around $18 Per Year
To get it back: $1,000 – $10,000+
Domain names are typically tied to both email and website. When an attacker gets control of it they can begin to compromise every online account associated with any email address tied to that domain. They can exploit your customers and vendors too. Domains that have been well established are worth a lot of money to the right people too.

Your Phone Numbers

I’ll admit this was a bit trickier. I don’t always get my target’s phone numbers, but when I do they are mine in every way. It’s a process. I’ve got to port the numbers out which has some safeguards in place and takes time. I always give it a try because organizations are very willing to pay me for my trouble.

Phone Contract: Around $35 Per Month Per Line
To get it back: $500 – $5,000 per line
Phone number have been ported for massive profits. For some organizations it would be very difficult to change their phone numbers after a successful attack like this. Your daily operations are going to come to a halt, and again, the cyber criminal has a way to easily exploit customer and vendors.

Your Data

I’m sure you’ve noticed by now that all of your files are misbehaving and look a bit different. Don’t panic, that’s just the ransomware I installed on a unsecured workstation somewhere in your building. This particular version of ransomware is a pet project I’ve been working on named Spike. Spike has likely spread throughout your network and infected every computer. Your files are technically fine. Spike, like most ransomware, just encrypts your files leaving the data intact. It’s that helpless feeling when you’ve locked your keys in your car. The car is still good, you just can’t access it. Don’t bother calling a locksmith though unless you have an infinite amount of time and resources. Encrypted files, not diamonds, are forever.

Data Cost: Usually Priceless. You’ll have to consider all of the time and resources associated with building your company’s data.
To get it back: The current value of 1 Bitcoin and beyond
Have we mentioned criminals are lazy? In some case the hackers deploy automated malware that infects company data. The ransomware that encrypts your files may have preset demands. In other cases the hackers are more directly involved in the deployment of the ransomware on your devices. In either case, paying up may not get you your data back.

Your Personal Files

I also stumbled on those sexy photos and that secret video no one is supposed to see. I’m actually NOT going to give those back. However, for a small fee, I will promise not to release them to the public potentially ruining your career and your personal life.

New Camera: $250
To get it back: $$$$
Blackmail is another serious crime hackers will commit in order to exploit you and your company for cash. We’ve heard horror stories of individuals being trapped in blackmail schemes for years.

How Much?

I’m a realistic cyber criminal. I’m not going to pull a Dr. Evil on you and ask for 1 million dollars. I’m going to evaluate your organization and make some very reasonable offers. After all, I need to get paid for your valuables. Thanks again for all of your hard work building up your organization and making your domain name, phone numbers, data, and personal files worth so much. I’ll be in touch.

Regards,
The Cyber Criminal


If you can imagine this scenario, it may seem like an absolute nightmare. Trust us, it is. It happens time and time again. In whole, or in part. Cyber and information security play a huge role in stopping these kind of incidents. Your organization needs to consider having strong policies and procedures in place along with some solid endpoint security. Together, these will help put cyber criminals out of business.

Policies & Procedures

Traditional solutions don’t fit their environment and they aren’t agile enough to keep up with the evolving landscape. This always leads to problems that can be traced back to poor implementation, or lack, of modern policies and procedures. Don’t make the same mistakes. Allow us to connect you with our partner today.

Your Old Computers – One Organization’s Trash, A Criminal’s Treasure

In most cases your organization’s old devices are a data gold mine. We’ve seen so many offices that have stacks of old laptops in their closets. No one really knows what’s on them or how many there are.

 “To know your enemy, you must become your enemy.” – Sun Tzu: The Art of War

When we perform our assessments, we embrace this tried and true tactic. In our minds, we become the cybercriminal and our goal is to exploit our targets for as much cash, or bitcoin, as possible. You can read why those two are now interchangeable here. When we see a bunch of old devices hidden away with a thin sheen of dust we hear that classic slot machine sound. We just hit the jackpot. There are plenty of skilled cybercriminals that don’t even have to steal them. Plenty of businesses giveaway/sell their computers. They turn up at local pawn shops or on Facebook Marketplace. With a small budget, a cybercriminal can build their empire by buying these devices and mining the data from them.

Types of Devices and the Data on Them

Desktops and Laptops

When it comes to digital forensics, desktops and laptops hold far more data than most users think. Web browsers like Google Chrome are a treasure trove of valuable data. Most browsers can keep you signed in for months. Cybercriminals will have instant access to any web sessions that are still active. Worst of all there won’t be any indication of a sign-in attempt. With Windows laptops and desktops, login passwords can be easily bypassed. With new tools available, they can even be decrypted, and this leads to even bigger security issues. Windows does a great job of removing your saved credentials in the event your login password is bypassed. If the password is decrypted, a cybercriminal can log in like normal. Now they can access all of your stored credentials. This could include credentials for: WiFi Networks, VPNs, Remote Desktop Connections, Shared Folders, Apps, and any website where the password has been saved. Don’t think you should be worried because you deleted all of the data before storing that old computer? Think again!

Moving files to the trash or recycle bin does NOT delete data. Emptying the trash or recycle bin does NOT delete data. Cybercriminals are counting on you being uneducated when it comes to information security. It can be very difficult to permanently delete data from your device. It always requires special software or techniques that physically destroy data media.

Copiers

A lot of people don’t realize that almost all large copiers and production printers have internal hard drives. These hard drives can hold every item you organization printed, faxed, copied, and/or scanned in the last year. Special care has to be taken before disposing of commercial copiers.

Mobile Devices, Servers, External Drives, and Even Broken Devices

By now you should be picking up on the fact that an organization’s devices can be exploited very easily. Mobile devices can be used to compromise security in many ways. It’s great that your software is in the cloud now, but where was it before? Servers, usually obsolete and retired, still have years of data that could lead to a huge data breach. All of those loose internal, external, and USB drives pose a significant risk. They are easy to pocket and hard to keep track of. Sure you could format them but that won’t keep your data safe. Data recovery is a lucrative business, and this has made it easier for criminals to get the tool they need. In fact, they don’t even need to steal your devices. They can pull the drives and emulate the hardware later to access all of your data. Don’t think your broken devices are safe either. In TV shows and movies, it requires a lab and fancy equipment to extract data from broken tech. Whether it’s broken, burnt, smashed, cracked, soaked, rusted, or fried, it’s extremely easy and cheap to get your data out of almost any device.

What to do?

The best way to mitigate these risks is to have strong policies and procedures along with data encryption. Your company has to have clear steps to follow when handling devices with data.  

Before any device leaves your control you must ensure that the data has been sufficiently destroyed and an audit trail to prove it. If need your organization needs some help in this department, our partner will assist you with establishing clear protocols for decommissioning old and obsolete hardware.

Policies & Procedures

Traditional solutions don’t fit their environment and they aren’t agile enough to keep up with the evolving landscape. This always leads to problems that can be traced back to poor implementation, or lack, of modern policies and procedures. Don’t make the same mistakes. Allow us to connect you with our partner today.

Having enforced encryption on all of your devices goes a long way. In the case of HIPAA compliance, nearly all lost or stolen devices that are encrypted don’t even have to be reported. If they are encrypted you could face massive fines for each device along with a data breach that could destroy your reputation. Device encryption can be performed in a variety of ways. Our partner’s solution uses an enterprise endpoint security software capable of full device encryption.

Endpoint Security

When it comes to protecting user devices we’ve got you covered. Our partner uses a full featured enterprise endpoint security that keeps your data safe.

We also recommend using a professional e-waste company to dispose of old tech. Feel free to contact us for free information regarding e-waste services in your area.


Subscribe to Our Newsletter

We send out new articles every week. They'll help keep you informed about important information security topics and news.