ROBERTSDALE, (Ala) – Many companies are trying to protect their workers during the pandemic by having them work from home.But this could make them targets for cyber criminals.
American businesses probably never have been as exposed as they are right now, according to security experts.Instead of working behind secure firewalls, many employees are virtually naked when it comes to criminals who steal with computers instead of guns.
The numbers tell part of the story.The SANS Institute reports that cyberattacks on businesses were up 30 percent in the month of March, alone.Phillip Long, a cyber security consultant with offices in Robertsdale and Mobile, told FOX10 News it likely is much higher than that because these crimes often go unreported.How cyber criminals are staying busy during this pandemic If you’re one of the people moving back to your office after working at home, beware that cr…
“So bad guys know that people are home from work, and a lot of people just set up their office to basically use what we call RDP, or remote desktop protocol,” he said.
“And, it’s easy.It works.But it’s very unsecure.”
It is a topic that has received a great deal of attention recently.On Wednesday, the Mobile Area Chamber of Commerce hosted a tele-conference for its members on tips for protecting their data in a work-from-home era.
Long, who has been in business almost 20 years, said he advises companies to focus on shoring up four areas of vulnerability that account for about 80 percent of cyber assaults on businesses: Insecure passwords.Out-of-date software.Improperly configured firewalls.
Guarding against these vulnerabilities is doubly important with so many people not working from the office, Long said.
One weak link can give criminals access to something far more valuable that cash – information.
“If you stole money, you know you have whatever that money can do for you for the time,” he said.
“But if you steal data, there are so many avenues and so many things you can do with a person’s data.It’s like an oil well versus a tank of oil.”
Long said criminals can gather Social Security numbers and other sensitive information and sell it on the black market.Or, they can blackmail the target.That’s what happened last year when Pensacola got hit by a cyberattack , he said.
Long said no business is immune, particularly at a time when so many people are working outside of their offices and regular network security systems.
He said sophisticated cyber criminals can scan millions of blocks of Internet Protocol addresses, searching for holes that will allow them inside networks.
And once inside, Long said, they can do great damage.Often, he added, it can be months before businesses even realize they have been hit.He said criminals can poke around for months and plant bugs that can be activated later.He compared it to using different components to build a bomb.
“That’s really what they’re doing, is they’re dropping some files on a machine that will later run an executable.They’ll go out and download another file from the internet,” he said.
“And again, all the pieces apart from one another are benign, but once they’re built into a … a program, then they steal data group files, send files back to the bad guy servers so they can steal this stuff.”
Long said criminals can use publicly available information form sources like Facebook, LinkedIn and even a company’s own press releases to find out when the CEO is out of town.
Then, Long said, they can impersonate the CEO in an email to another company executive to trick him into wiring money for a hot deal that has to be acted on fast.
Long said cyber criminals can come from anywhere, but he pointed to Eastern Europe as a particular hotspot.Countries like Ukraine have the right of mix of weak legal enforcement, poor legitimate economic prospects and highly educated populations with the know-how to exploit vulnerabilities in the United States.PAUL J.RICHARDS/AFP/Getty Images
And, Long added, it does not take a great deal of training for cyber criminals to do great damage.
He said a seventh-grader under the right tutelage could learn enough in about two months.
“The web is dark.There’s almost a zero percent chance of getting caught,” he said.“And if you’ve got a way to be able to move that money from crypto currency to fiat money, man, you’re golden.”
Long said he has no statistics locally, but he added he sees the increase in attacks in his job, helping businesses design security systems and clean up after they have been hacked.
Long said the Gulf Coast area seems to have a more relaxed attitude when it comes to cyber security.But he added that laid-back attitude could make them inviting targets now more than ever.
“Our area needs attention bad.… It is very much a lax environment in comparison to even Birmingham or Atlanta,” he said.
“You know, in Birmingham or Atlanta, they say, they call you and say, “Hey, I need to find somebody to help me manage my security.’ Down here, they say, ‘I need somebody to keep my computers working.’” More Coverage .