Cybersecurity has become a buzzword in the tech sphere over the past few years. Companies and organizations are beginning to fully understand the dangers of ignoring cybersecurity protocols and leaving valuable data open to breaches and hackers. With this rise in risk, C2IT brought Wendy, a cybersecurity expert, onto our team at the end of 2022. I sat down with Wendy and asked her some questions to learn what I could from this cyber ninja.
1. We are hearing a lot these days about the importance of cybersecurity, but I’m not sure everybody knows exactly what that entails. How would you define cybersecurity to someone who’s wanting to learn more about it?
I would define cybersecurity as the implementation of safeguards being put in place to keep computers and networks safe from attacks. Three key principles of cybersecurity form the acronym CIA – which stands for Confidentiality, Integrity, and Availability. Those 3 words are the key to cybersecurity. CONFIDENTIALITY means keeping data secret and only allowing the right people to have access to that info. An example would be a finance team keeping personal data to themselves. INTEGRITY would be keeping the information in tact and knowing that the information is valid and unchanged. AVAILABILITY means the ability for people within an organization to access the information. An example of lack of availability would be a ransomware attack. This would be an easy to understand summary of cybersecurity.
2. I know you have had a great career in cybersecurity, what are some unique certifications or skills that you bring to our team?
My whole family worked with computers. Family members worked for the state of Maryland, USPS, accounting firms. Because of my family connections, I took some classes at a local community college so I could speak the language of the rest of my family. Through these classes, I found out that I was actually interested in this subject matter. I’ve always had an innate curiosity and I consider myself a problem solver, which is a good fit for cybersecurity. I do have one thing I’m particularly proud of – I participated in SANS CyberStart Go Competition and won 1st place in the 2018 competition.
3. What would you say are the most prominent forms of cyber attack that you have seen?
The three most prominent attacks are phishing, spoofing, and malware. Phishing is usually email-based, offering you something with a sense of urgency in an attempt to steal sensitive information. Spoofing is taking on the identity of someone that you probably trust with the intent to install malware. Malware is another type of threat where once the software is installed, can alter or delete data on your computer without your consent, often making your computer unusable.
4. What are some of the biggest mistakes you see organizations make that might leave them vulnerable to a cyber attack?
Lack of education or denial of cybersecurity, until it goes away, are common mistakes. Many small and medium businesses read about attacks on larger firms but do not think hackers will be interested in their business. When in fact, almost half of data breaches involve small or medium-sized enterprises.
Many companies also make the mistake of not putting rudimentary forms of security in place and just assuming it won’t happen to them. Companies can make small adjustments like locking the door to the server, putting up cameras, and properly storing paper files.
One of the best things a company can do is to have cybersecurity insurance, just in case something bad happens. This will help with notifying customers about a data breach, restoring and recovering compromised data, and repairing damaged computer systems.
5. What is the most unique or interesting thing you have learned about recently in the area of cyber security?
ChatGPT is fascinating in that it’s a new frontier in cybersecurity and it’s a tool in the hands of hackers. ChatGPT has helped hackers’ word emails and phishing attacks to be more difficult to detect. ChatGPT’s ability to converse so seamlessly with users without spelling and grammatical mistakes makes it seem like there could be a real person on the other side of the chat window. From a hacker’s perspective, ChatGPT is a game changer.
6. What would you say to a business owner who feels like they are not the target for a cyber threat? Do small businesses need cybersecurity?
As a small business, you’re a target because hackers know that you’ve probably not invested a lot of time and money into guarding your data. While you may not be a high dollar target, you may be an easy target.” Hackers often look for easy, smaller payouts that may be a good payday for them, but may be detrimental or catastrophic to the small business. And that doesn’t even touch the loss of revenue, loss of functionality, loss of reputation, and potential fines from being out of compliance.
7. What steps would you encourage an organization to make to lessen their risk?
Cybersecurity is best done from a layered approach. Some minimal steps would be installing antivirus, educating your employees against phishing attacks, a firewall that can help limit access to your network, a VPN that would offer a more robust layer of security, Password Management and regular password changes. All of these are simple ways an organization can lessen their risk.
8. How can teaming up with an IT partner help an organization when it comes to cyber security?
An IT Partner can do a risk assessment and find your vulnerabilities and how big of a risk you’re at for an attack. This risk assessment can advise you of areas of risk and how to remediate that so you can be less vulnerable to breaches and attacks. Based on an assessment, your IT Partner can help lay out a plan to decrease your risk and tighten up your defenses. Your IT Partner can also help by monitoring networks and endpoints to keep tabs on activities that might be suspicious.
9. What do businesses who have suffered a breach do?
Most businesses don’t realize they are breached until it’s too late. Often, they don’t know until they are notified by the hacker for a ransom. The first step would be to call the police, then contact your 3rd party IT Company to see if there’s anything that can be done to restore or salvage any of your data. In the state of Indiana, you will need to inform affected consumers and The Attorney General’s office upon discovery of the breach. Failure to do so can incur a civil penalty of up to $150,000 per deceptive act. The security breach reporting form can be submitted to the Indiana Attorney General’s Office by completing the printable Breach Notification Form and emailing it to DataBreach@atg.in.gov or to the address here:
Data Privacy & Identity Theft Unit – Data Breach
Attorney General of Indiana
Indiana Government Center South, 5th Floor
302 West Washington Street
Indianapolis, IN 46204