Key steps to boosting your tribal cyber security
In today’s connected world, cyber threats are on the rise. Cyber criminals are becoming more and more sophisticated in their attacks, employing everything from impersonation fraud, misleading emails, malicious links, ransomware and more. Technology is only going to become more sophisticated with each passing year, making the subject of tribal cyber security more relevant than ever before.
Related: How retailers can fight holiday cybercrime
This year, the Department of Homeland Security is drawing particular emphasis to cyber security through the phrase: “Own IT. Secure IT. Protect IT.” This link provides valuable resources useful in starting the conversation about cyber security at your tribal enterprise. Don’t fall victim to a costly or damaging cybercrime that might otherwise have been prevented.
Own IT.
Step one involves understanding the nature of your “cyber profile” including the resources you use, the size of your cyber footprint, and level of potential risk you are exposed to. These risks will differ depending on your industry, the services you provide and the technology you use. Protecting against cyber threats starts with a comprehensive understanding of exactly what you have at risk and what you can do to prevent loss.
Secure IT.
Step two is about securing your information and assets once you’ve determined what they are. This could take the form of stronger minimum password requirements, mandatory password cycles, multi-factor authentication and more.
Protect IT.
Lastly, take whatever additional steps are necessary to protect your data. Invest in appropriate protective software, regularly check privacy and security settings in all your applications and ensure all your employees receive phishing and cyber security training. One of the greatest exposures many organizations face is employees that accidentally grant access or information to cyber criminals by falling for a scam.
Related: Cyber security: The threat from within
Types of threats
The following are some of the major threats organizations face today:
- Ransomware: Maliciously installed malware that holds data hostage until a ransom is paid for its release.
- Vendors: Utilizing vendors and business partners in cyber operations can expose an organization to additional risk, especially if their current cyber security measures are not adequate.
- Negligent Employees: Workers that allow access to systems or critical information by not remaining compliant with preventative protocols.
- Hacking: An attempt to attack and breach a system’s defenses in order to obtain the stored data.
- Hacktivists: Hackers that alter an organization’s website or communications to promote their cause.
- Social Engineering: Employees that have been tricked into providing data to cyber criminals by falling for elaborate phishing attempts and other online scams.
General best practices for tribal cyber security
Ideally, everyone who uses technology to complete their tasks should undergo rigorous tribal cyber security training and be well-versed in current best practices. Barring this though, any tribe or tribal enterprise that utilizes technology as part of their operations should at least cover the topic of cyber security with employees annually. This can be covered in the form of required onboarding training, annual compliance or as the topic of a monthly safety meeting. Here are some talking points and checklists to get started:
What is a data breach?
A data breach involves unwanted access to information that is considered to be beyond “already public knowledge.” When working on data breach prevention, start by determining what types of data your organization retains, where it’s stored and how you long you retain that information
How does a data breach occur?
- Theft of personal data on hard copy (paper files)
- Laptop thefts
- Electronic hacking
- Data copied to portable media
- Insiders (employee) theft
- Outside data theft by crime rings
- Loss or accidental release of personal information
- Lost equipment, files, or disks
- Exposure on a non-secure website
- Account or social security numbers inadvertently printed on mailings
- Files dumped and not shredded
How can data breach be prevented?
- Require access to personal information to be restricted by job position.
- Have a chief information and/or chief security officer (or equivalent) on staff and perform regular back-ups of data.
- Develop an information security and privacy policy.
- Provide regular security training and information to all people who have access to personally identifying information, whether in paper or electronic format.
- Install anti-virus and encryption software on all computers and maintain via a central source.
- Maintain regularly updated computer security measures, e.g., firewalls, secured wireless connectivity, virus protection, and so on.
- Issue all users unique IDs and passwords when connecting to or accessing your internal network. Change passwords regularly (no more than 90 days between changes.)
- Keep hard copy files containing personal information in a separate and secure area, such as locked file drawers or offices.
- Establish and post document retention and destruction policies.
- Keep payments for fees, donations or bills in a secured location with limited access, e.g. a locked drawer, office, or safe.
Related: How to protect your tribal business from cyber threats, part 1 and part 2
How do I defend against a cyber attack?
- Never click on a link you do not recognize – inform your IT staff member if you are unsure.
- Never reply to unsolicited emails.
- Consider an email suspicious if it contains a generic salutation such as “dear customer.”
- Consider an email suspicious if it tries to create a sense of urgency or warns of dire consequences that will occur if no action is taken.
- Never open attachments you were not expecting. If you get a suspicious or unexpected email from a trusted source, such as a friend or a company you actually do business with, call them and confirm they sent it before opening any attachments. Their email account or their computer may have been compromised and sending emails without their knowledge.
- Never insert a flash drive into your device until it has been validated by IT.
- When in doubt regarding any credibility issue, contact your local IT representative. It’s always better to be safe than sorry.
Don’t wait to increase your tribal cyber security measures to protect your tribe or tribal enterprise from costly data breach incidents. For additional resources, be sure to check out the National Cybersecurity Awareness Month (NCSAM) Toolkit. If you have any questions or would like to know more, please contact your Arrowhead Tribal risk manager, Mark Sherwood, at msherwood@chooseclear.com.