Anti-virus programs aren’t enough
Author : Matt Yarranton
17 March 2020

Today, many business owners install an antivirus program as their single line of defence and call it a day. However, there are many ways to get into a network that circumvents anti-virus.

Hackers are creating malware faster than anti-virus programs can recognise them (about 100,000 new threats are released daily), and professional cybercriminals test their creations against all commercially available platforms before releasing them.

Even if you had a perfect anti-virus program that could detect and stop every single threat, there are many attacks that circumvent anti-virus programs entirely. For example, if a hacker can convince a user to reveal their password using social engineering and install a legitimate remote access tool via a waterholing attack, anti-virus is not going to save you when they remote into your business and get to work.

There are several vulnerabilities a hacker can target: the physical layer, the human layer, the network layer, and the mobile layer. You need a defence plan that will allow you to quickly notice and respond to breaches at each level.  Network and mobile layer protections are well known, but you may not be familiar with the layers and how to protect them.

Physical Layer

The physical layer refers to the computers and devices that you have in your office. It is exploited surprisingly often. However, it is the easiest to defend.

Here are a few examples:keyboard in chains

  • In 2015, 60% of California businesses reported a stolen smartphone and 43% reported losing a tablet with sensitive information.
  • The breaches perpetrated by Chelsea Manning and Edward Snowden occurred because they were able to access devices with sensitive information.
  • As an experiment, Comptia left 200 USB devices in front of various public spaces across the country to see if people would pick a strange device and insert it into their work or personal computers. 17% of consumers fell for it.

For the physical layer:

Keep all computers and devices under the supervision of an employee or secured at all times.
Only let authorised employees use your devices.
Do not plug in any unknown USB devices.
Destroy obsolete hard drives before throwing them out.
In short, taking responsibility for data security involves a lot more than just a software program.

Human Layer

Humans are the weakest link for cybersecurity. A hacker only needs to find one poorly informed, curious or careless employee and they potentially have the keys to your businesses IT.  Some of the techniques employed by the hacker are social engineering, phishing and waterholing and all are designed to trick a user into doing something they shouldn’t.   Some examples of famous security breaches that were results of the human layer are:

  • In 2011 the security company RSA was hacked which was just the starting point that led to the attack against the ultimate target, Lockheed Martin.  The attack started with an Excel document, sent to a small group of RSA employees, via email, which contained a malicious code which opened a backdoor for the hackers.
  • Sony was famously hacked in 2014. Thousands of files, including business agreements, financial documents and employees’ information, were stolen. They were targeted by a spear-phishing attack which looked like emails from Apple.
  • In 2016 the Democratic National Committee was hacked which famously led to emails being published on Wikileaks.   The hackers used spear-phishing with an email, that looked just like it had been sent by Google, requesting that the user reset their password due to malicious activity.  This tricked the user into entering their password, giving the hackers access to their email accounts.

Protection for the human layer comes down to training and education.  Following the training, you need to keep users on their toes and there are services available that will send users fake phishing emails and report who clicked on things they shouldn’t have.  Don’t get hacked because of PEBKAC. Educate and empower your users to be your first line of defence!

Learn more about how Blisstech Solutions cyber-security services can help. Contact us at 01299 382 321 or [email protected].

More Content

How To Secure Your Business When Remote Working

The global COVID-19 crisis means that more people are remote working than ever before.  Businesses rushed to enable their employees to work from anywhere very quickly, which may include access to sensitive company data.  In the rush to stay operational during the...

Why is my computer so slow!?

“Why is my computer so slow?” is a question heard time and time again and is one of the most common computer complaints. There are a variety of reasons that your computer can appear to be running slowly. I say ‘appear’ as it may not actually be your computer that is causing the problem. Read on to find out possible reasons for this problem.

VIDEO: How to Follow Sites in SharePoint

Hello, Happy New Year and welcome to today's Tuesday Two Minute Tech Tip which is about how to find the data you want to access in SharePoint and OneDrive. If you are working with files in Teams and on SharePoint sites, you might wonder why you do not see the sites...

Donated Laptops for Lockdown Learning

A Digital Divide It is a shocking fact that 9% of children in the UK, between 1.1 and 1.8 million, do not have a computer, laptop or mobile device in their home, according to research carried out by Ofcom. This pandemic is shining a stark light on the gap in provision...

Two simple steps to protect your business data

Data is the lifeblood of most modern businesses.  From important proposals and presentations to a simple one-line email that is proof of something happening that you might need months later.  However, many small businesses are not taking the necessary steps and...

6 ways to make your small business look professional

When you start out in business, one of the hardest things to do is find new clients.  Most customers will not buy from you unless they trust you, and trust usually comes from reputation.  But how do you gain people's trust if you are new and don't have much of a...

Cyber Essentials: A Guide to CE and its Benefits

Many people have heard of Cyber Essentials (CE), but do you actually know what it is and what benefits it can bring to your business? This article will discuss what cyber essentials is and how it can help your business and the role that a Cyber Essentials assessor...

VIDEO: The Power of Microsoft To Do

Hello everyone and welcome to a new Tuesday Two Minute Tech Tip.    👉 Do you want to get more organised?    👉 Do you wish you could see all of the things that you need to remember all in one place?    👉 Do you need a tool...

Global State of Ransomware Report 2020

Datto have released their annual Global State of the Channel Ransomware Report for 2020. They have interviewed more than 1000 managed service providers (MSPs) around the world. The report gives details on the state of ransomware from the perspective of the...

Microsoft Remove Delay Windows 10 Updates in version 2004

We recently wrote an article on how to delay Windows 10 updates so that you can wait until issues are resolved before you install new updates.  However, in the Windows 10 2004 update, Microsoft has removed the ability to delay Feature Updates for up to 365 days in the...
Share This