Cybersecurity Archives

The Breach: Part 2

by John Hensberger | Oct 4, 2021 | Breach Response, Cyber Insurance, Cybersecurity

In “The Breach – Part I,” Black Bottle IT shares a true story of cybercrime that took place with a manufacturing client and how it unfolded.

“The Breach” continues…

What Do We Do Know?

Immediately following, we start to take action to contain the incident. We immediately block the traffic in/out from the bad actor IP addresses. We look at some simple log data and verify that the Company has been transmitting data to these IP addresses — for as long as we have logged data over 30 days.

In the meantime, I’m getting SOS calls from the CEO, wanting an update from the FBI meeting and wanting to know, “How bad is this?” Since I don’t know the extent of the incident, I don’t have much, other than we think we’ve contained it. He asked good questions: “Don’t we have a firewall, AV, and a 3rd party that is supposed to help us with these things?” All of which the answer is yes. This then follows by the inevitable, “How could this happen?” Someone once told me that when you have bad news, the sooner it’s delivered, the better. So my message to the CEO was, we think we’ve contained it; now we need to figure out what the damage is, which is something that I need to figure out now.

The Response

So, let’s recap:

the FBI informs us that we have been “cyber-attacked” but offers no more information.
We think we’ve stopped it.
Our CEO is asking us questions about whether the company can survive this. And we have no good answers.

It was a pretty bad 24 hours. So, the real challenge for us was, what do we do next? First, we mobilized our third-party MSP to help. They scheduled time over that weekend to visit our location, install some advanced security tools, and “clean” every machine in the building. We didn’t know what had caused the breach, but this seemed like a good place to start.

Next, I got on the phone and started calling companies for advice/help. Most of these calls went something like this: “Yes, we’d love to help you; you need to determine what data was lost. So, you can buy blocks of time for 50K each. When do you want us to start?” Our Company was small, so spending money in chunks of 50K would also very quickly lead to the company’s financial demise. So, after calling and listening to multiple solutions, I had some options. In the background, Company stakeholders are asking me, “How bad is it?” “Are we out of business?”

Ah-Ha. We Have Insurance for That

At some point during the first 48 hours, the CFO had inquired to our insurance agent about having cyber coverage. It turns out we had coverage. She launched a call to our service representative, who then told us, we would receive a call within 72 hours with instructions. I was in the mindset that the company might not survive 72 hours. I didn’t wait around and continued searching to find some resource to help; that made sense. Then, I received a call from the insurance customer service rep. She told me that if I checked the policy, I would find instructions for utilizing the “Data Breach” services that our company was entitled to as part of our coverage. I thanked her, started reading, and found that we indeed had access to a “Data Breach Coach” or a list of them. I picked the first name and called them.

Continue to Part 3

About the Author:

This blog was written by John Hensberger, Managing Partner of Black Bottle IT. Earlier in his career, John was also part of a company that experienced a cybersecurity breach. That experience fueled his passion for assisting other companies with their cybersecurity needs to mitigate their risk. As Technology Executive and Cybersecurity Advisor, John was recognized as the Pittsburgh CIO of the Year, 2014. Connect with John here.

Employees Are The Largest Attack Vector

by blackbottledev | Aug 30, 2021 | Cybersecurity, Risk Management

By now, our inboxes, LinkedIn feeds, and websites of cybersecurity companies have all tried to tell you that Company employees are the most significant attack vector and pose the most considerable cybersecurity risk to all businesses. Those same companies advise firms to subscribe to some online training for “all your problems will be solved.” This advice, unfortunately, is not valid.

Since the early days of the westward expansion, fast-talking elixir salespeople have been peddling the magic potion that cures what ales you. As with most things, complicated problems demand a complex solution. This could not be more true when evaluating cybersecurity risks and putting together a strategy to lower those risks.

It’s true; cybersecurity awareness training does affect reducing employee-related cyber attacks. However, it’s only a piece of a larger strategy to improving a companies security posture.

Black Bottle IT advises clients to address six critical areas to tangibly lower cybersecurity risk.

Security Awareness Training – Online training, monthly newsletters, in-person training. These are all great ways to educate employees on the day-to-day threats. Education material needs to be delivered with more regularity, we recommend monthly.
Email Security – Email is the most common way employees get duped into giving credentials or cutting a check to the wrong payee. Email security alone just isn’t enough. A phishing AI engine that learns employee email habits can effectively flag and stop the excellent attackers from posing as an executive and social engineering an incident.
Security Operation Center — Having suspicious activity analyzed in almost real-time to detect unauthorized network access is critical to stopping/limiting a cyberattack before any real sensitive data is stolen. Some companies may have cyber tools to alert, but having the expertise to analyze alerts, determine if the threat is credible, and quickly determine the next steps is crucial to respond to an actual attack.
Ransomware Protection — Stopping a ransomware attack before it encrypts meaningful amounts of data is the best peace of mind a company could ask for. Bad actors will attack, employees will click on threatening emails, and ransomware will try to encrypt critical data.
Solid Back-Up Strategy – In the unfortunate event of ransomware attacks, having off-site, isolated back-ups is the only way to restore business operations and prevent a costly crypto payment from resuming operations.
Incident Response Planning — Knowing the who, what, where, when a cyber-attack is suspected saves valuable time when a cyber threat is supposed. Performing annual “fire drills” to simulate actions taken during a cyber attack will ensure a quick response and could potentially limit the damage during an actual incident.

Ok, so there are seven recommendations, but this one is outside our expertise. We’ve seen enough offer this advice:

7. Cyber Insurance — having a good cyber insurance policy can further reduce the financial risk of a cyber attack. Most companies with some kind of cyber insurance have no idea if the coverage is correct for their level of risk. Look to FifthWall Solutions for more information about access to the right insurance policy for your size of business and industry.

About the Author:

This blog was written by John Hensberger, Managing Partner of Black Bottle IT. Earlier in his career, John was also part of a company that experienced a cybersecurity breach. That experience fueled his passion for assisting other companies with their cybersecurity needs to mitigate their risk. As Technology Executive and Cybersecurity Advisor, John was recognized as the Pittsburgh CIO of the Year, 2014. Connect with John here.

Investing in Cyber Security is Risk Management

by blackbottledev | Aug 23, 2021 | Cybersecurity, Risk Management

When talking to IT leadership, one of the most common things we hear is how difficult it can be to justify the investment in cyber security to the stakeholders of the Company.

Let’s face it, Companies invest in technology and expect to see an ROI from operational efficiencies, increase market share, or launching of new products or services. Most experienced IT leaders understand this; hence, it’s hard to justify the effort to vet potential vendors and/or new technology, craft a proposal to justify the need, only to have the Company’s stakeholders look up and say — “Where’s the ROI on this investment?”.

Is there a Tangible ROI in Cybersecurity?

It’s true; there isn’t a tangible ROI that can be easily calculated. How to put a return on recovering from a fictitious – “it can’t happen to us” data breach scenario. Besides, having anti-virus/malware and a solid backup strategy is enough to protect us from a nasty virus or ransomware attack, right? And in the event there is an incident, the Company probably has done its fiduciary responsibility and secured a cyber insurance policy, in the unlikely event an employee would click on a bad email and allow bad actors access to the network and sensitive data. So, where’s the risk? Insurance will cover the financial burden.

The hard truth is, all IT Leaders know their Companies need better cyber security tools. But most of the time, it’s never part of their budgets, or it’s the first line item that gets trimmed during financial planning. And that is leaving lots and lots of companies exposed to lots and lots of risk.

Here are some statistics to show just some of the exposure Companies are facing:

43% of data breaches involved small businesses.
24% of data breaches are caused by human error
29.6% of companies will experience a data breach in the next two years.
The United States has the average cost of a data breach at $8.19 million
The average size of a data breach is 25,575 records
The average time to identify a security breach is 279 days
780,000 records are lost to hacking each day

So really, the conversation around cybersecurity is a risk management issue.

Can your company accept the risk of no liability or workers comp insurance?

A cyber insurance professional put it in these terms to me — “Just because you have Workers Comp insurance doesn’t mean you stop putting down salt on icy steps and sidewalks.” The same could be said for investing in cybersecurity solutions. Just because you have a cyber policy or some cyber security tools in place doesn’t mean you stop investing in new tools to lower your risk of a cyber attack.

What’s Next?

Our mission at Black Bottle IT is to help companies prepare, respond and remediate cyber incidents. We advise clients to invest in cybersecurity tools and services, and there is NO ROI. Still, your risk exposure will significantly be reduced, allowing the Company and its employees to continue serving their customers to the best of their ability.

About the Author:

This blog was written by John Hensberger, Managing Partner of Black Bottle IT. Earlier in his career, John was also part of a company that experienced a cybersecurity breach. That experience fueled his passion for assisting other companies with their cybersecurity needs to mitigate their risk. As a Technology Executive and Cybersecurity Advisor, John was recognized as the Pittsburgh CIO of the Year, 2014. Connect with John here.

5 Tips to Keep Technology at Schools Secure

by blackbottledev | Jul 26, 2021 | Cybersecurity

Did you know that the average business manages 162.9 TB of data? Because there’s so much sensitive information on an organization’s server, it’s essential to safeguard your server and applications.

Managed security services are the perfect way to ensure that malware stays out of your system. Here, we’re going to talk about what these solutions do and why they’re essential. Read on to begin protecting your business!

What Are Managed Security Services?

Managed security services are IT solutions that protect businesses from security threats. You subscribe to a package from a managed IT security services provider. In turn, this provider develops a unique plan based on your business’s individual situation to secure your digital data.

This process generally means implementing specialized software that integrates seamlessly with your data storage system. It also means building a security expert network that can respond to potential breaches in real-time. Experts, not just tools, make the difference in response time, reporting, and moving your business forward risk-free.

Because these security services are typically fully managed, you don’t need to worry about maintenance and upkeep. Managed security providers handle modifications and upgrades for you. They also implement the latest virus/spam blocking, intrusion detection, firewall, and VPN systems to keep you safe in an ever-changing digital world.

Why Are They Important?

First and foremost, you need high-quality security solutions to protect your business financially. A security breach costs a company an average of almost $9 million. If you’re an SMB, it’s unlikely that you have that kind of money.

Sensitive data theft also can cause untold problems for your employees and clients. You likely have employee SSNs stored somewhere within your system. Customer financial information is also often saved to a server.

When a company experience a data breach, they lose the trust of employees and clients. Not only that, but they will likely have severe concerns about identity theft and future financial problems. This problem isn’t something you want to be responsible for because it leaves you open to lawsuits, shutdown time, and customer loss.

Real-Time Network Security Monitoring: The Basics

Now that you understand the importance of data monitoring, you must choose the appropriate solutions. Real-time network monitoring is ideal for companies of all sizes.

Traditional monitoring uses analytics tools that only look into at-rest data. Since digital information is changing by the second, this becomes quickly outdated. Users won’t be able to notice new threats until it’s too late.

However, real-time network monitoring solutions like Black Bottle IT offers are different. They showcase only current data so that you can see what’s going on in your data system by the second. You, therefore, will get more relevant information and discover what needs to be done to safeguard your data in real-time.

Streamline Your Security Operations Today

Now that you know why managed services for security are the right choice for your organization, it’s time to get started. Schedule a free consultation to learn more about our managed security services.

Our experts are happy to discuss the best ways to keep your specific digital information secure by meeting your unique needs. We also will help you come up with a payment plan that works for you. Since we’re committed to helping your business succeed with secure and safe information, we look forward to hearing from you soon.

How Do Managed Security Services Work?

by blackbottledev | Jun 21, 2021 | Cybersecurity

Did you know that the average business manages 162.9 TB of data? Because there’s so much sensitive information on an organization’s server, it’s essential to safeguard your server and applications.

Managed security services are the perfect way to ensure that malware stays out of your system. Here, we’re going to talk about what these solutions do and why they’re essential. Read on to begin protecting your business!

What Are Managed Security Services?

Managed security services are IT solutions that protect businesses from security threats. You subscribe to a package from a managed IT security services provider. In turn, this provider develops a unique plan based on your business’s individual situation to secure your digital data.

This process generally means implementing specialized software that integrates seamlessly with your data storage system. It also means building a security expert network that can respond to potential breaches in real-time. Experts, not just tools, make the difference in response time, reporting, and moving your business forward risk-free.

Because these security services are typically fully managed, you don’t need to worry about maintenance and upkeep. Managed security providers handle modifications and upgrades for you. They also implement the latest virus/spam blocking, intrusion detection, firewall, and VPN systems to keep you safe in an ever-changing digital world.

Why Are They Important?

First and foremost, you need high-quality security solutions to protect your business financially. A security breach costs a company an average of almost $9 million. If you’re an SMB, it’s unlikely that you have that kind of money.

Sensitive data theft also can cause untold problems for your employees and clients. You likely have employee SSNs stored somewhere within your system. Customer financial information is also often saved to a server.

When a company experience a data breach, they lose the trust of employees and clients. Not only that, but they will likely have severe concerns about identity theft and future financial problems. This problem isn’t something you want to be responsible for because it leaves you open to lawsuits, shutdown time, and customer loss.

Real-Time Network Security Monitoring: The Basics

Now that you understand the importance of data monitoring, you must choose the appropriate solutions. Real-time network monitoring is ideal for companies of all sizes.

Traditional monitoring uses analytics tools that only look into at-rest data. Since digital information is changing by the second, this becomes quickly outdated. Users won’t be able to notice new threats until it’s too late.

However, real-time network monitoring solutions like Black Bottle IT offers are different. They showcase only current data so that you can see what’s going on in your data system by the second. You, therefore, will get more relevant information and discover what needs to be done to safeguard your data in real-time.

Streamline Your Security Operations Today

Now that you know why managed services for security are the right choice for your organization, it’s time to get started. Schedule a free consultation to learn more about our managed security services.

Our experts are happy to discuss the best ways to keep your specific digital information secure by meeting your unique needs. We also will help you come up with a payment plan that works for you. Since we’re committed to helping your business succeed with secure and safe information, we look forward to hearing from you soon.

When Firewall Security Expires

by blackbottledev | May 31, 2021 | Cybersecurity

Prioritizing the security of your company’s network is an essential practice when it comes to remaining as productive as possible. Unfortunately, failure to do so could easily result in a large number of legal complications.

When it comes to firewall security, you may be surprised to learn this type of protection can expire. Let’s take a deeper look at what you need to know.

When Does Firewall Security Expire?

As time goes on, cybercriminals develop more advanced tools to procure sensitive data. As a result, the firewall protection you implement can quickly become outdated if you aren’t regularly updating it.

To clarify, even a firewall defense that uses relatively contemporary safeguards can become highly inefficient as hackers begin to use new types of malware.

In fact, a firewall that looks notably strong on paper may not accomplish its task appropriately.

However, to answer the above question, firewall security can be considered expired when it no longer receives regular patches, updates, and other similar services.

What Are the Risks?

As you might assume, the most significant risk of having your firewall security expire comes from failing to protect sensitive information adequately.

Depending on the industry you work in, this often includes data that should never fall into the wrong hands (such as medical patient info).

Additionally, you run the risk of hackers procuring trade secrets that they can then sell to other companies within your industry. In many scenarios, a situation like this is complicated to recover from for any business.

What Should I Look For in a Provider?

The ideal provider to work with implements a renewal policy. In practice, this will allow you to continually renew your firewall service automatically so that you can ensure you are always protected.

This firewall service often includes frequent threat detection updates and new firmware implementation.

Additionally, the provider you work with should also have some form of continual customer support for your firewall service. This level of customer support means that you should be able to quickly get in touch with your service provider with questions or concerns.

While it isn’t always practical to assume that your provider will offer 24/7 customer service, many provide round-the-clock service 365 days a year.

You should also take a look at their past reviews. You’ll gain insight into whether or not you can expect to receive the level of service you are looking for for your business.

Maintaining Proper Firewall Security Is Crucial

You must take the necessary steps to maintain firewall security properly. From here, you’ll have no issue ensuring that your firewall security is as protective as possible over the sensitive data in your organization.

Want to learn more about what Black Bottle IT has to offer your business? Feel free to reach out to us today and see how we can help.