Proper Protection Requires Education
MSP security isn’t just the responsibility of a security group. Certainly, such an organization is integral in ensuring your business has the highest possible security, but a great deal of the onus lies on those working for and with your company. A security agency can facilitate a firewall. They can set up computers so that access privileges restrict downloads without authorization. They can install antivirus software and proactively monitor systems. But all that is useless when an employee opens the door for a hacker unaware.
For a fun and silly analogy, imagine a vampire. They can’t enter a house unless invited, right? So they don’t have to “hack” the firewall/fence, they don’t have to “hack” the dogs/antivirus; all they’ve got to do is “hack” the butler/employee opening the door to the MSP estate. If they come looking for some kind of insurance claims adjuster, they’re likely to be invited into the sitting room–and then they’ve taken the castle. With hackers, it’s much the same.
Three primary areas of intrusion which require education and protocol over traditional security solutions include:
- Ransomware (SMB Ports)
- Social Hacking
- Human Error
So ransomware is becoming more recognizable today, but hackers and other cyber criminals looking to hold systems hostage are increasingly clever. Before, you might get an email, a social media message, a download request for a media player, or something of the kind which required slight technological illiteracy to exploit. But it’s gotten more sophisticated. Hackers are making messages look system-legitimate, and tailoring them to individual businesses. Now an employee might get an email from an address that looks just like one for your network, except its one letter different. Instead of “MyBoss@YourBusiness.com”, it’s “MiBoss@YourBusiness.com”, or something of that ilk. The message is even labeled as you’d expect. An employee downloads it, and then suddenly everybody’s locked out of the system.
Even more insidious is the SMB port compromise, which requires no action on the part of employees. The Wanna Cry ransomware worm launched in May of 2017 exploited such ports by using NSA-derived backdoor access in Windows machines. Over 150 countries who didn’t get the patch update in time were compromised–so here an argument can be made for advancing on-site protocols for employees, which help them discern between false emails and real ones, as well as acquiring top-tier tech support to get proper patches in place.
MSP security can do little about social hacking. It works like this: a hacker gets access to system emails and sends messages between users until they can figure out who has access privileges. Then they use social interaction to derive information. They’ll deign to “rank”, asking for information as though they’re authorities internally in other departments. Tactics like this are very successful and require strict internal security protocols to avoid. Consider this YouTube video taken from 2016 DefCon as a perfect example of social hacking. A woman with no association to the account she’s hacking uses a baby’s cry and lies about motherhood to hoodwink an hourly-wage employee in customer service for a cell phone company. This is in many ways the most successful means of hacking, and the only real way around it is to educate employees regarding proper security protocols. It makes sense to contact an exterior agency who understands this kind of hacking to help define what those protocols should be.
This one can only be combated on the back end. I.E., you need to have a security net in place should employees make the kind of mistakes which essentially undermine operations. Professional solutions will need to have BDR (Backup and Data Recovery) in place, as well as the aforementioned continuous monitoring of systems. People are going to “fat-finger” keys at the wrong moment. They’re going to kick out power cords, spill coffee, drop devices, and zig when they should have zagged. That’s just human nature. You’ve got to expect this kind of thing and plan for it.
MSP security solutions through professional agencies can help you hope for the best, and plan for the worst. Between ransomware, social hacking, and human error, there are many threats. So be prepared with the right professional security agency.