"How are bad guys trying to get to your information? Ninety to 95 percent of it is through employees," said David DeArmond, owner of Strix Louisiana, a business productivity and IT services firm. "If the employee is educated, if the employee knows what a phishing scheme looks like … then you can avoid most of those attacks."
DeArmond was one of two panelists at Louisiana Technology Park's Tech Park Academy. Brandon Reeves, CEO of EtherMon LLC, an IT cybersecurity services firm, was the other.
DeArmond noted that the Democratic National Committee was hacked after a staffer responded to an email requesting the credentials for a Gmail account. Businesses can protect themselves by securing their networks with some sort of firewall, monitoring information flowing into and out of the network; installing anti-virus software on computers and smartphones; and backing up data.
DeArmond said the typical system backs up data every 30 minutes, so if there is a ransomware attack — malicious software that blocks a user's access to data until a payment is made — a business loses very little of its data.
"If somebody's targeting you specifically, there's no doubt they're going to get in," he said.
Bad guys are looking for the path of least resistance. Businesses need to put up as much resistance as possible, so the cybercriminals look elsewhere, he said.
On the plus side, a specific small business is not likely to be targeted. Reeves said large health systems, which have multiple internet access points and reams of valuable data, the government and financial services firms are the most likely targets.
However, small businesses as a group are a huge target, DeArmond said. They don't have controls in place or spend much on security, so they don't offer much in the way of resistance.
Reeves said part of his firm's work involves penetrating customers' cyber defenses. Right now, EtherMon has a 97 percent success rate in gaining administrative access. "That means that we can control their systems from our office, our couch, Starbucks or anywhere else and theoretically lock them out," he said.
Reeves said people's desire to help, especially in the South, can leave a company's IT network vulnerable.
Shortly after the Sandy Hook shooting, EtherMon infiltrated a hospital's suite for chief executives, even though security had been amped up there. An EtherMon employee posed as a FedEx worker delivering a package to a hospital senior executive. A maintenance worker unlocked the executive's door and walked away, Reeves said.
Reeves said it's important that businesses be aware of the security risks of the software tools they use.
For example, Google indexes all user data. By typing "password + file type XLS", it's possible to see a list of every password Google has found in spreadsheets, he said. Google is helping people with "free" services, but Google gets the right to users' data.
©2017 The Advocate, Baton Rouge, La. Distributed by Tribune Content Agency, LLC.
