Lane Report

COVER STORY
Prioritizing Cybersecurity
Growing sophistication of attacks requires
up-to-date, multipoint defenses and employee training
BY ROBIN ROENKER
DETAILS of cybersecurity
breaches across government,
education and
industry sectors made
headlines – repeatedly –
over the past year, with no signs of slowing
down. Yet despite the frequent
incidence, 66 percent of companies
report they are unprepared for a major
cybersecurity attack, according to a
national survey released in November
by the Ponemon Institute.
Last February, hackers breached the
U.S. Department of Justice’s database,
releasing personal information on 10,000
Department of Homeland security
employees and 20,000 FBI employees.
That same month, the IRS announced
that a 2015 breach compromised the
information of some 700,000 American
taxpayers, while the University of California-Berkeley
revealed a
records breach affecting
80,000 students, alumni
and employees.
In October, Yahoo
reported that a breach
believed to have occurred
in 2014 affected as many as
500 million user accounts
– one of the largest such
breaches to date. On Oct.
21, cyber attackers took
down the internet for a
Scott Logan,
Technical
Director
of Security,
NetGain
Technologies
large swath of the Eastern United States
for most of the day, using a malware virus
known as Mirai that attacks vulnerable
internet-connected devices such as web
cameras, DVRs and routers.
As these high-profile cases make
clear, today’s cyber attackers are highly
sophisticated.
“These attacks just keep happening
over and over again. Businesses are very
anxious, and even fearful,” said Scott
Logan, technical director of security for
NetGain Technologies Inc., Kentucky’s
largest managed IT firm with offices in
Lexington, Louisville and out of state.
“Many of these attacks could not only
force you to lose information, but they
could also ruin your brand. If you’re a
bank and you become breached, how do
you assure your customers that you’re
going to be able to protect their money?”
The bottom line is simple.
“Companies are going to need to
invest in more technology to protect them
from security threats,” said Brendan
Jacobson, co-founder of NetGain Technologies.
“It is just going to get worse.”
It’s not necessarily that
the attack tools are getting
smarter; it’s the manner in
which they are being used.
Malicious players don’t
even have to be highly tech
Cody
Shackelford,
Systems
Engineer,
Data Strategy
savvy, said Cody Shackelford,
systems engineer with
Data Strategy, which
acquired Louisville-based
boice.net this year.
Basic malware or ransomware
packages are readily available on
the black market or dark web, he said.
Attackers today are succeeding by researching
a target company or agency to determine
a weak link – for example, a “socially
engineered” phishing campaign with an
email that looks like it came from and is
written in the style of a regular communication
partner, perhaps even a coworker.
Organizations can achieve very high
levels of protection, though, by employing
multiple levels of defense that
screen all incoming digital traffic, that
restrict anything that does get through
to an individual work station, and especially
that train workers in best practices
for handling data, Shackelford said.
Cybersecurity best practices
Kentucky cybersecurity experts agree:
The worst possible response to the
increasing threat of cyberattack is to
assume you’re not at risk.
“For a long time, small businesses
just didn’t feel like they were a big
enough player to be worried about
threats,” Logan said. “Their mindset
was, ‘I’m not Chase Bank or Anthem
(Blue Cross Blue Shield),’ and they
believed they didn’t have to worry about
THE LANE REPORT • LANEREPORT.COM DECEMBER 2016 21