Failing the Phish Test

Phish testing your employees is a vital part of any security awareness program.  It seems logical that by exposing employees to phishing and helping them identify tactics, the chance of anyone in your organization to be phished lessens.  But does it?

When employees who failed phish tests are called out, made to feel poorly or singled out in a group the exact opposite can happen.

End users are the largest, most vulnerable target in most organizations. In real-world attacks, end users are relentlessly bombarded with spear-phishing and socially engineered schemes.

As the champion of your organizations cyber security, it is imperative that these tests be used as teachable moments to educate and encourage your end users.

Use Failure as a Teachable Moment.

Look at the failure of phish testing in a different light: you’ve identified a weakness in your security that can now be remedied.

Effective Phish Testing Checklist

Every phish test should follow some basic tenets in order to educate users:

  1. The links in a phish test campaign should go directly to a site with immediate education.
  2. Do not call out or embarrass users who fail the test.  Public shaming results in decreased threat reporting.
  3. Do not tie user responses to employee evaluation testing.  Doing so can can create resentment towards security, which is not good for the organization.
  4. Offer encouragement and education by directing users to additional training.  This can be optional or required depending on how many times the user has failed.
  5. Provide additional written materials such as articles and information from other sources.
  6. Reward people who report incidents.  This can be as simple as a kudo’s in the company newsletter or even prizes and contests.  Make sure that your organizations culture gives positive support to employees who report incidents.

Protecting Your Network 

JDL Group can help you put in place the right cyber security measures for you and your organization. If you want to learn more about protecting yourself and your employees from phishing campaigns check out our free anti-phishing toolkit.  

References: 

https://www.infosecurity-magazine.com/next-gen-infosec/reward-flag-phish-highlight-failed/

https://www.sophos.com/en-us/products/phish-threat.aspx

 

Phish testing your employees is a vital part of any security awareness program.  It seems logical that by exposing employees to phishing and helping them identify tactics, the chance of anyone in your organization to be phished lessens.  But does it?

When employees who failed phish tests are called out, made to feel poorly or singled out in a group the exact opposite can happen.

End users are the largest, most vulnerable target in most organizations. In real-world attacks, end users are relentlessly bombarded with spear-phishing and socially engineered schemes.

As the champion of your organizations cyber security, it is imperative that these tests be used as teachable moments to educate and encourage your end users.

Use Failure as a Teachable Moment.

Look at the failure of phish testing in a different light: you’ve identified a weakness in your security that can now be remedied.

Effective Phish Testing Checklist

Every phish test should follow some basic tenets in order to educate users:

  1. The links in a phish test campaign should go directly to a site with immediate education.
  2. Do not call out or embarrass users who fail the test.  Public shaming results in decreased threat reporting.
  3. Do not tie user responses to employee evaluation testing.  Doing so can can create resentment towards security, which is not good for the organization.
  4. Offer encouragement and education by directing users to additional training.  This can be optional or required depending on how many times the user has failed.
  5. Provide additional written materials such as articles and information from other sources.
  6. Reward people who report incidents.  This can be as simple as a kudo’s in the company newsletter or even prizes and contests.  Make sure that your organizations culture gives positive support to employees who report incidents.

Protecting Your Network 

JDL Group can help you put in place the right cyber security measures for you and your organization. If you want to learn more about protecting yourself and your employees from phishing campaigns check out our free anti-phishing toolkit.  

References: 

https://www.infosecurity-magazine.com/next-gen-infosec/reward-flag-phish-highlight-failed/

https://www.sophos.com/en-us/products/phish-threat.aspx

 

How to Reduce Your Law Firm’s Cyber Risk

law firm cyber security

Experts agree that cybersecurity threats present significant risks to businesses, including law firms. Clients place a great deal of trust in law firms, which have a clear duty to protect their clients’ sensitive information. While bigger targets exist, hackers have begun targeting law firms because they found them to be the weakest link.

Law firms usually have relatively weak or non-existent cyber-defense systems or protocols in place. Fortunately, mitigating risks from data breaches or ransomware requires a small number of relatively simple measures. Here are some cybersecurity best practices any law firm can put in place.

1. Use Multi-Factor Authentication

Also known as two-factor authentication, this simple procedure makes use of a user password and something else the user has (e.g., token, app, device, etc.) to generate a second temporary password or code to login to an information system. It may seem cumbersome to require a password plus a second step, but it is the easiest procedure a law firm can implement to significantly improve security.

2. Never Share Logins or Passwords

Password sharing remains a common practice, even in businesses. Employees do this all the time, often just to give a coworker access to a program or to simplify login procedures from a remote location. In some cases, passwords can be found on notes sitting on employee desks or sticking to monitors.

Reusing accounts presents a similar risk. In this instance, employees continue to use the account of a departed employee to maintain access to a specific profile or to data that profile can access.

Law firms should eliminate password and login sharing, requiring their IT department to create new logins for incoming employees and delete old accounts.

3. Choose Better Passwords

law firm cyber security Passwords constitute the first, and sometimes only, line of defense against cyber-attacks. Hackers today use improved technology to crack passwords, ending the days when an employee could use the same simple password forever.

Law firms should require passwords that are longer, use more diverse characters, and are changed regularly. A good password consists of at least eight characters, a mix of letters, numbers, and special characters, a limitation on repeat characters (e.g., BB).

Each system should have a unique password, and law firm employees should be encouraged to vary passwords on different websites they access. Another good practice is to use an extremely complicated password for email accounts, which is needed to reset passwords. Password managers also exist to help manage many different accounts.

4. Update Systems

Installing updates, while often frustrating, protects an operating system from vulnerabilities. Upgrading the operating system to the current version (e.g., Windows 10 or Sierra) provides extra protection.

5. Encryption

This uses a formula to make data unreadable without a key. As long as the key is secure, the data remains safe. Several services exist that provide encryption, and the latest computers have encryption that simply needs to be enabled.

These steps are relatively easy to set up, but transform a firm’s cybersecurity. Law firms face risks like every other business. By enacting industry best practices, a law firm reduces the dangers of an attack and gives their clients the security they expect.

Contact Us

JDL Group can help your law firm adopt the right cyber security strategy. Contact us today.

Additional Resources:
http://www.onelegal.com/blog/5-steps-to-getting-serious-about-law-firm-cyber-security/
http://www.lawtechnologytoday.org/2017/02/tips-for-risk-mitigation/
http://www.lawtechnologytoday.org/2017/01/why-remote-security-is-a-must/
https://blog.lexicata.com/how-to-improve-data-security-at-your-law-firm/

ransomware attacks on law firms

law firm cyber security

Experts agree that cybersecurity threats present significant risks to businesses, including law firms. Clients place a great deal of trust in law firms, which have a clear duty to protect their clients’ sensitive information. While bigger targets exist, hackers have begun targeting law firms because they found them to be the weakest link.

Law firms usually have relatively weak or non-existent cyber-defense systems or protocols in place. Fortunately, mitigating risks from data breaches or ransomware requires a small number of relatively simple measures. Here are some cybersecurity best practices any law firm can put in place.

1. Use Multi-Factor Authentication

Also known as two-factor authentication, this simple procedure makes use of a user password and something else the user has (e.g., token, app, device, etc.) to generate a second temporary password or code to login to an information system. It may seem cumbersome to require a password plus a second step, but it is the easiest procedure a law firm can implement to significantly improve security.

2. Never Share Logins or Passwords

Password sharing remains a common practice, even in businesses. Employees do this all the time, often just to give a coworker access to a program or to simplify login procedures from a remote location. In some cases, passwords can be found on notes sitting on employee desks or sticking to monitors.

Reusing accounts presents a similar risk. In this instance, employees continue to use the account of a departed employee to maintain access to a specific profile or to data that profile can access.

Law firms should eliminate password and login sharing, requiring their IT department to create new logins for incoming employees and delete old accounts.

3. Choose Better Passwords

law firm cyber security Passwords constitute the first, and sometimes only, line of defense against cyber-attacks. Hackers today use improved technology to crack passwords, ending the days when an employee could use the same simple password forever.

Law firms should require passwords that are longer, use more diverse characters, and are changed regularly. A good password consists of at least eight characters, a mix of letters, numbers, and special characters, a limitation on repeat characters (e.g., BB).

Each system should have a unique password, and law firm employees should be encouraged to vary passwords on different websites they access. Another good practice is to use an extremely complicated password for email accounts, which is needed to reset passwords. Password managers also exist to help manage many different accounts.

4. Update Systems

Installing updates, while often frustrating, protects an operating system from vulnerabilities. Upgrading the operating system to the current version (e.g., Windows 10 or Sierra) provides extra protection.

5. Encryption

This uses a formula to make data unreadable without a key. As long as the key is secure, the data remains safe. Several services exist that provide encryption, and the latest computers have encryption that simply needs to be enabled.

These steps are relatively easy to set up, but transform a firm’s cybersecurity. Law firms face risks like every other business. By enacting industry best practices, a law firm reduces the dangers of an attack and gives their clients the security they expect.

Contact Us

JDL Group can help your law firm adopt the right cyber security strategy. Contact us today.

Additional Resources:
http://www.onelegal.com/blog/5-steps-to-getting-serious-about-law-firm-cyber-security/
http://www.lawtechnologytoday.org/2017/02/tips-for-risk-mitigation/
http://www.lawtechnologytoday.org/2017/01/why-remote-security-is-a-must/
https://blog.lexicata.com/how-to-improve-data-security-at-your-law-firm/

ransomware attacks on law firms

Your Business Should Be in the Headlines for the Right Reasons, Not for a Cyber Attack

cyber security NJ Law Firm Cyber Security NYC

Today’s headlines are peppered with stories of major companies and institutions falling victim to a cyberattack. As a business owner, what’s your response to these gut-wrenching stories? If you write them off as fear mongering and believe that these attacks can never happen to your SMB, well, you’re wrong. They can and it’s up to you to prevent such a disaster.

One reason why it’s so important to shore up your company’s network security is because the ramifications of a breach extend well beyond the sensationalism surrounding a news story. Take for example one of the biggest stories of hacking in recent memory; the revelation made public last December that Yahoo had more than one billion of its accounts compromised, dating all the way back to 2013. While the headlines focused on the plight of Yahoo and the negative effect this would have on the tech company’s value, what didn’t get reported is how millions of Yahoo users were negatively affected by having their sensitive information exposed to hackers.

In the same way, seeing to your company’s network security goes beyond protecting your corporate image from a negative headline. It’s also about protecting all of those who have entrusted you with their sensitive data. This includes customers and vendors that have provided your business with their financial information, as well as employees that each have a wealth of their personal information connected to your HR department.

We’ve established that there’s a lot riding on your network security and that it’s your job to make sure this is taken care of. If you don’t currently have a security plan in place protecting your company from a data breach, where do you even begin? Fortunately, you don’t need to be an IT security expert or have a computer science degree to implement adequate security measures. As is the case with the many vital responsibilities connected to your business, you can outsource the protection of your network to the professionals, such as the IT technicians at JDL Group.

That said, IT security is such an important and comprehensive matter that it’s not something that you should outsource and then disregard. In fact, IT security works best when everybody in the company understands that they have an active role in its upkeep. Yes, everybody. We’re talking from the C-level executives down to the cleaning lady who connects her smartphone to Wi-Fi. If everyone in your company understands how to avoid the snares laid by hackers, then the cake that is your network security measures will be topped with the icing of best practices.

Remember, securing your network from cyberattacks isn’t something that you have to do on your own. JDL Group is here to help, and we can do so by implementing proven and comprehensive network security solutions like our Unified Threat Management tool, as well as remote monitoring and maintenance in order to detect and take care of any threats that may breach your defenses. We’re also available to equip your staff with the means and know-how to better understand cybersecurity.

Contact Us

For assistance in all of these areas of security and more, give us a call today at 973.607.2140.

cyber security NJ Law Firm Cyber Security NYC

Today’s headlines are peppered with stories of major companies and institutions falling victim to a cyberattack. As a business owner, what’s your response to these gut-wrenching stories? If you write them off as fear mongering and believe that these attacks can never happen to your SMB, well, you’re wrong. They can and it’s up to you to prevent such a disaster.

One reason why it’s so important to shore up your company’s network security is because the ramifications of a breach extend well beyond the sensationalism surrounding a news story. Take for example one of the biggest stories of hacking in recent memory; the revelation made public last December that Yahoo had more than one billion of its accounts compromised, dating all the way back to 2013. While the headlines focused on the plight of Yahoo and the negative effect this would have on the tech company’s value, what didn’t get reported is how millions of Yahoo users were negatively affected by having their sensitive information exposed to hackers.

In the same way, seeing to your company’s network security goes beyond protecting your corporate image from a negative headline. It’s also about protecting all of those who have entrusted you with their sensitive data. This includes customers and vendors that have provided your business with their financial information, as well as employees that each have a wealth of their personal information connected to your HR department.

We’ve established that there’s a lot riding on your network security and that it’s your job to make sure this is taken care of. If you don’t currently have a security plan in place protecting your company from a data breach, where do you even begin? Fortunately, you don’t need to be an IT security expert or have a computer science degree to implement adequate security measures. As is the case with the many vital responsibilities connected to your business, you can outsource the protection of your network to the professionals, such as the IT technicians at JDL Group.

That said, IT security is such an important and comprehensive matter that it’s not something that you should outsource and then disregard. In fact, IT security works best when everybody in the company understands that they have an active role in its upkeep. Yes, everybody. We’re talking from the C-level executives down to the cleaning lady who connects her smartphone to Wi-Fi. If everyone in your company understands how to avoid the snares laid by hackers, then the cake that is your network security measures will be topped with the icing of best practices.

Remember, securing your network from cyberattacks isn’t something that you have to do on your own. JDL Group is here to help, and we can do so by implementing proven and comprehensive network security solutions like our Unified Threat Management tool, as well as remote monitoring and maintenance in order to detect and take care of any threats that may breach your defenses. We’re also available to equip your staff with the means and know-how to better understand cybersecurity.

Contact Us

For assistance in all of these areas of security and more, give us a call today at 973.607.2140.