Black Friday, Cyber Monday Bring Open Season for Cyber-Criminals

Manning said that the malware is based on the Netwire tool that some administrators still use, but in this case it’s been modified. “It was hiding itself in the Notepad application,” he explained. “There was a child process that was running there.” Finding the malware is relatively easy, Manning explained in a blog entry.

Then the threat actors sent a phishing email that was relevant to the company and the employees, showing that they had spent some effort in researching their target.

Unfortunately, that’s only one type of attack and there are plenty of others. Worse, it’s essentially impossible to protect your company against every possible attack. This means that as business ramps up it’s also necessary to ramp up your efforts to fend them off.

Best practices

“The needs for best practices are amplified over the holidays,” said Dana Simberkoff, chief compliance and risk officer at AvePoint, a company that supports migration and management of Microsoft cloud services. Because of this, she advises her clients to protect customer data so that the bad guys can’t get it, even if they manage to penetrate network security.

Simberkoff listed areas where she encourages her customers to tighten their security. The first is to collect as little data as possible from consumers. “If you have it, you have to protect it,” she explained. Simberkoff said that while there’s often a push to collect as much data as possible for possible future use, that’s really not the best idea.

“Remember that less is more,” she said. “You’re responsible for the data.”

The next step is one that’s been a best practice basically forever, but one that’s frequently ignored, which is to limit what your employees can access. “Make sure that you provide your employees the minimum access to data that they need to do their job” she said. “Every person in the company doesn’t need to have access to sensitive data.”

Simberkoff said that this broad access to unnecessary data is often the result of an overworked IT staff that doesn’t have time to figure out which employee needs access to what data.

Simberkoff also noted that companies aren’t always clear about the purpose for data collection and they aren’t clear about the requests for consent. “You need to have layered consent,” she added, pointing out that you can’t collect someone’s data for one purpose and then use it for something else.

You also need to know about the data flow within your company and you must know what data transfers between your company, credit and debit card processors and vendors. Ultimately, she said, you’re responsible for what happens to your data even when it’s in a business partner’s possession.

All of this will help your company take reasonable steps to protect the data that you’ve been entrusted with, but she also noted that it’s vital for employees to understand that security is everyone’s job.

Now that the holiday shopping season is in full swing, so is the threat level. In addition to protecting your bottom line against cyber-criminals, you also need to protect your customers and your partners. And yes, the bad guys really are out to get you.

“Data is like money. That’s why companies get hacked,” Simberkoff explained. “The more data you hold, the bigger target you are.”

Originally published on eWeek