CDM-CYBER-DEFENSE-eMAGAZINE-March-2019

the egg?’ for the aforementioned computer intrusions and theft of PII and PI, we can confidently
assert that both were targets for cyber criminals and nation state actors. According to a recent
report from the National Counterintelligence and Security Center, “Cyberspace remains a
preferred operational domain for a wide range of industrial espionage threat actors, from
adversarial nation states, to commercial enterprises operating under state influence, to sponsored
activities conducted by proxy hacker groups.”
At 4iQ, we’ve continued to observe the flourishing trade of PII in underground communities and
the dark web, despite efforts by companies to secure their networks with security protocols and
employee cyber security training. In 2018, 4iQ curated 13,000 data breaches, while in 2017, an
average of 245 breaches were discovered on a monthly basis.
Compromised networks can be difficult to detect, and some take years to mitigate. Maintaining
the integrity or availability of networks is a difficult task for the Chief Information Security Officer
or others with that responsibility, as risk mitigation can be difficult to manage. There is no universal
remedy to avoid being compromised, but that doesn’t mean you should feel powerless. Take, for
instance, the infamous 2017 Equifax breach that affected some 148 million consumers worldwide.
In the aftermath of the breach, a House Oversight Committee report concluded that the breach
was entirely preventable given Equifax’s poor and dated cybersecurity practices. This problem
isn’t unique to Equifax, and therein lies the problem. As a consumer, you expect companies
holding your sensitive information to practice proper cyber hygiene, but that just isn’t always the
case.
A company-wide approach needs to be taken in order to safeguard personal data. Minute details,
such as using unique passwords for all your accounts, often get overlooked, leading to detrimental
outcomes. If an employee was affected by a third-party breach, and they happened to be using
the same password for their work email as they were using for their outside account which was
compromised, your company could indirectly be impacted. It’s cliché, but your organization is truly
only as strong as its weakest link. Sitting through mandatory cybersecurity training might be a
pain, but it serves a purpose. Additionally, keeping security software up to date and using a breach
watch service can help mitigate your organization’s vulnerability, in turn reducing the vulnerability
of all its stakeholders. Data breaches are an all too common occurrence for businesses in today’s
global cyber-culture. Why risk adversaries and competitors using compromised networks to gain
a business advantage under the guise of a breach?