What every CEO and CIO should know about cybersecurity

The problem with cybersecurity is it is not sexy.

In most cases it is down right boring.

Although not sexy and down right boring it is still something that every CEO, manager, owner and board member has to focus on.

With all of the automated attack vectors available to the cyber criminals, we can no longer say we are not a target. We cannot say we have nothing worth stealing.

The more and more reliant business has on the digital world the greater the chance that a cyber event will cripple the organisation.

What are the main things that every management type needs to focus on when it comes to prevention of a cyber event.

Here are a few!

The cost of a cyber event.

The cost of a cyber even can range from lost time and functionality within the organisation to more money than the organisation can find to pay for the breach.

Cryptovirus is an example of lost time and functionality. If you do not have a functioning and tested backup of the data, you have to rebuild the offending device but you will also have to also replicate all of the data.

A full blown breach by a dedicated black hat hacker can steal everything and then use your system as a platform to target your clients, suppliers and staff. When that happens you realize that you are NOT too small to be a target

How they get into your system

The go to weapon of most cyber attacks is social engineering. Two parts of a very effective attack strategy. The technology to effect change, follow a link to an infected website, click on an ad in social media or open an attachment in an email, combined with getting you to trust them where you let them in.

Either way they are now in.

Risk and problems just compounded.

Simple ransomware for instance, the initial encryption of data is only one of the stages of the attack. What about stage 2,3 and 4.

Wannacry showed us that a combination of 2 attack vectors allowed a single infection to traverse a whole network. One computer is a problem for any organisation. All of the computers is a nightmare.

The protection challenges

In most situations managers, owners, executive and board members do not understand the digital realm. Risk management of data (a critical component in today’s business world) is often overlooked and considered an ICT problem.

Its not! Today’s digital security challenge is everyone’s issue and the sooner it gets noticed as a business risk and treated as such the faster we will see a reduction in attacks.

From the largest organisations to smallest single entities, we all keep critical data in places that are easily accessed, relatively unprotected and mobile.

What are you doing to manage the expected cyber events that could cripple your organization?

There is no single, simple fix. If there was everyone would be safe.

It is a complex issue and one needs to dedicate some time, money and expertise to understanding the issues and risk associated with a cyber event.

Come to one of my intensive workshops it will open your eyes on your business requirement to be safe as an organistion.

Roger Smith is funny, scary, on point and is focused on one thing – increasing everyone’s awareness and understanding of the problems and issues associated with the digital world.
He was Runner up in the 2017 worldwide Cybersecurity Educator of the Year award and has been nominated for the 2018 Cybersecurity Educator of the Year award.  
He is a highly respected expert in the fields of cybercrime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity) on Cybercime, Cybersecurity and the hacking techniques used by the digital criminal.   
He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger, going to number one on Amazon.   
He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI.   He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.

Cyber event – Why does it take so long for answers?

Have you ever thought to yourself – that hack – Cyber Event –  happened 6 weeks ago why do we not yet know what happened?

The problem with today’s cyber events is actually how complicated and complex that hack or breach was to achieve.

Like every criminal they like to cover their tracks and there are a huge variety of ways to do that in the digital world.

How many out there have fudged on our profiles – old photos (missing the gray hair), wrong birthdays, wrong year of birth.

So the first problem – who just hacked my system?

Everything can be fake.

If you, an honest law abiding citizen, can lie on your profile why then can’t the bad guys.

We only lie about our profile out of vanity, they do it because they are legitimately trying to hide.

This is the first hurdle when it comes to identification.

Little or no information.

In addition they use what we call handles – think old radio speak “over and out rubber ducky”.

Today’s handles are a little more complex, or they convey some level of anonymity.

The calling card of a cyber event

The calling card of a cyber event

The second problem – what system did they use to hack my system?

The internet is full of systems, information and attack weapons that are easy to use, have large quantities of how to’s, help and videos.

That is just the internet.

If you want to know more get onto a chat room on the dark web and see what happens.

In addition to this there are also a vast range of ‘Proxies’.

These are devices and systems that have either been hacked and the owner has not discovered it or have been put together in other countries and locations specifically used as a way to hide the next attack.

The third problem – what has actually been stolen?

Everything today is data.

If I steal money from your credit card or bank account it is noticeable in the real world. I can see that someone has removed money from my possession, in some way. Stealing money from you then comes down to making you trust the transaction.

If I can steal $20 from you with an illegal pay wave transaction will you notice it?

But data is different. When i steal data from you, the information stays in the same place.

I am stealing a COPY of that information.

What I now do with that information will not have an impact on the original copy of the information.

If I have removed that data, how do you know that I have done that?

Each one of these steps can take hours, weeks, months or years to unravel. In that time the general public, industry, regulators, government and press are screaming and carrying on. To find out what happened.

Roger Smith is funny, scary, on point and is focused on one thing – increasing everyone’s awareness and understanding of the problems and issues associated with the digital world.
He was Runner up in the 2017 worldwide Cybersecurity Educator of the Year award and has been nominated for the 2018 Cybersecurity Educator of the Year award.  
He is a highly respected expert in the fields of cybercrime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity) on Cybercime, Cybersecurity and the hacking techniques used by the digital criminal.   
He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger, going to number one on Amazon.   
He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI.   He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.