Cybersecurity: A Look Back at 2021, Predictions for 2022

Security in 2021 can best be described as a continued explosion of threats: cloud security, phishing attacks, remote work, insider threats, social media and mobile malware all dominated security teams’ time. In addition to well-publicized cyberattacks like Colonial Pipeline, JBS and Kaseya, the year ended with a bang in December with the critical Log4j vulnerability, serving as a reminder of the fragility of the world’s digital infrastructure.

Given the ongoing threat landscape, what can we expect in 2022?

The need for cyber insurance will be a bigger priority. Given the continued surge of ransomware attacks, which soared 288% in the first half of 2021 alone, the need for cyber insurance, especially in the SMB market, has never been greater. Though many industry experts argue against payouts, making cyber coverage a controversial topic, the evolving threat landscape means cyber insurance should be a top consideration as part of organizations’ cyber strategy. As such, we anticipate a booming cyber insurance industry as many organizations heed these warnings and seek to guard against ransomware attacks. Yet, in addition to cyber insurance, companies will need a designated DR or RR (Rolling Recovery) plan.

Zero trust will take on greater prominence with the continued role of the remote and hybrid workplace. Remote work will continue, with hybrid work gradually becoming the new normal – driving the need for zero trust. With the federal government mandating agencies to adopt zero-trust network policies and design, we expect this to become more common in the private sector to follow suit as 2022 becomes the year of verify everything.

Log4j will continue to be a top threat. As one of the top vulnerabilities to hit in over 20 years, log4j is not going away any time soon. Look for this vulnerability to push a new surge in hardware purchases and software replacements and upgrades as tech teams look to stay ahead of bad actors looking to continue to exploit this vulnerability.

Data security will take on even greater importance. As malicious actors seek new ways to exploit data and vulnerabilities, organizations must shore up their data protection practices. Alongside this, governments and consumers are looking to protect their data with many new laws and regulations regarding data collection and storage moving forward. Everyone will adopt privacy practices and will need to educate employees to help safeguard data while increasing their data security posture.

Cyber teams are going to be in the spotlight now more than ever. Understanding your security posture is crucial; knowing what current tools are available and what gaps currently exist in your infrastructure will help you to protect your enterprise. The need for a budget and having the right people in place is critical. With ongoing talent shortages, consider partnering with a third-party firm to ensure you have fail-proof processes, documentation, and regular third-party assessments.

Stay up to date on all White Rock Cybersecurity initiatives through LinkedIn or Twitter. 

Protect Against Phishing and Ransomware

Join speaker, Selby Philipose, Senior Solutions Architect with Barracuda.

In this webinar, you will learn:

• How to protect your organization against ransomware attacks

• 13 types of email cyberthreats

• Top 3 phishing attacks and how to defend against them
  

Contact us today, to learn more.

WHITE ROCK CYBERSECURITY REACHES KEY MILESTONES IN 2021 New partners, industry award recognition among the highlights

DALLAS – January 19, 2021 – White Rock Cybersecurity, a premier solutions provider of information technology and network security, today announced key milestones the company reached during 2021.

As insider threats, nation-sponsored entities, and evolving cyber-attack techniques wreak havoc on enterprises, White Rock takes proactive steps in helping businesses fine-tune cybersecurity programs to safeguard against these threats. As more companies seek assistance, White Rock is realizing significant growth. During 2021, the company marked the following key highlights: 

• White Rock ranked #25 on CRN’s Fast Growth 150 Company Award, where CRN recognizes the fastest-growing North American technology integrators, solution providers, and IT consultants for their significant growth and meaningful performance over the previous two years.

• Kaspersky's Cloud Partner of the Year recognition.

• The addition of several new solutions to the company’s prestigious partnerships providing best-in-class cybersecurity resources for their clients.

• Greater access and insights into industry-specific national security concerns as White Rock Cybersecurity president James Range joined InfraGard, a partnership between the Federal Bureau of Investigation (FBI) and members of the private sector for the protection of U.S. Critical Infrastructure. Range, also graduated from the class of 2021 FBI Citizen’s Academy.

“During a time where a cybersecurity breach puts small and medium sized companies out of business, we want to make sure that our customers have the right tools at hand to guard against breaches at all times,” said Range.  “Companies need endpoint and email protection, employee security awareness programs and data backup solutions to reduce risk.”

About White Rock Cybersecurity
White Rock Cybersecurity is a premier solutions provider specializing in information technology and network security. White Rock's comprehensive suite of IT and network security solutions defend enterprises from existing and emerging security threats, with leading edge, best-in-class products and services for the most advanced protection. For more information, visit wrsecure.com or check us out at LinkedIn or Twitter.

Retailers: Protect Your Business Against Cyberattacks This Holiday Season

By Ron Brown, VP of Technology, White Rock Cybersecurity

Digital transformation has been the biggest disruptor for retailers over the past few years, holding the promise to truly transform retail business models. Yet with the holiday season fast approaching, that same digital transformation is also a double-edged sword. In a survey by BDO, 34% of retailers cite cyber attacks or privacy breaches as the top digital threat facing their businesses, with long-term objectives by 40% of retailers surveyed being to shore up their cybersecurity.

 With cyber attacks and breaches on the rise, the holidays have become a lucrative time for cybercriminals. Consider:

• Retailers are often targeted by a wide range of tactics, techniques, and procedures (TTPs) including Card Not Present (CNP), gift card fraud, skimming, malware, account takeovers, and denial of service.

• Third-party vendor security has become a greater concern. When Target was breached back in 2014, the compromise happened via stolen vendor credentials of Target’s heating and air conditioning contractor. For most retailers, their Point of Sale (PoS) software and devices will be the Achilles Heel that constitutes a third-party risk.

Today, every organization is a target for cyberattacks, with industries that possess the most valuable data being the biggest targets. Retail is at the top of that list. However, following these steps, retailers can protect their businesses, their supply chain, and their customers from falling victim to cybercrime.

1. Ensure Continuous Monitoring, Detection, & Response (MDR)
   Invest in an appropriate level of MDR services based upon the cyber threats your organization anticipates. The key is to rapidly detect intrusions to quickly contain and eradicate the malware to reduce negative impacts upon the information system and data assets.

2. Perform Network and Endpoint Threat Assessments
   The growing list of information systems, software applications, bring your own devices, and Internet of Things (IoT), testing networks and endpoints with Intrusion Detection Systems (IDS) will reduce potential vulnerabilities to cyber-attacks.

3. Conduct Email Threat Assessments
   Email is a top gateway into an organization’s infrastructure. Conduct periodic email threat assessments targeting malware that may have made it through their anti-virus and firewalls. 

4. Implement an Effective and Timely Patch Management Program
   Some of the most significant data breaches were the result of organizations failure to implement effective and timely software patch management program of Microsoft and Cisco software.

5. Establish a Cybersecurity Awareness and Education Program
   The most cost-effective means to improve cybersecurity posture is to create a human firewall by providing quality cybersecurity educational programs to all employees and partners.

Cyberattacks are increasing in sophistication and magnitude of impact across all industries globally. However, taking proactive precautions and fine-tuning cybersecurity programs can help protect your business, supply chain and your customers against cyberattacks this holiday season.

Modern Data Protection Strategies

The International Data Corporation or IDC advises that the new best practice for effectively protecting customers against ransomware is a "3-2-1-1" strategy. The last “1” in the best practices is the critical piece of the puzzle. A copy of the data backed up is stored immutable. The growing risk of compromising your customers' data – specifically via ransomware – DEMANDS the most up-to-date and complete solutions arsenal.

 In this webinar, you'll learn: 

·         Define a modern backup strategy (teaser: it's the 3-2-1-1)

·         Protect records and maintain data with immutable storage

·         Gain greater coverage with StorageCraft's OneXafe 4400

Are you ready to respond to a ransomware attack?

In case you missed it!  Here is the recording of the webinar on Incident Response best practices.

White Rock Cybersecurity Places 25 on the 2021 CRN® Fast Growth 150 List

Dallas, TX, August 10, 2021 – White Rock Cybersecurity, a premier solutions provider specializing in information technology and network security, announced today that CRN®, a brand of The Channel Company®, has named White Rock Cybersecurity to its 2021 Fast Growth 150 list in 25th place. With this list, CRN recognizes the fastest-growing North American technology integrators, solution providers, and IT consultants for their significant growth and meaningful performance over the previous two years.

 "To be ranked in this year's CRN Fast Growth 150 list is an honor," said James Range, founder and President of White Rock Cybersecurity. "We are proud to work with such innovative partners that provide our customers the tools they need to protect their organizations and give them peace of mind.” 

 The IT channel is a highly competitive, fast-paced environment comprised of solution providers that deliver a complex array of hardware, software, communications and services. They must think outside the box to differentiate themselves, making sustained growth a notable achievement. To maintain the highest levels of growth, solution providers constantly need to evolve and keep ahead of groundbreaking changes within the marketplace. The 2021 Fast Growth 150 list acknowledges these companies’ exceptional accomplishments and ongoing dedication to success.

“In today’s unpredictable world, the pace of change within the IT channel is happening at breakneck speed. CRN’s 2021 Fast Growth 150 list highlights industry-leading companies within the IT channel and their ability to outpace an ever-evolving market,” said Blaine Raddon, CEO of The Channel Company. “The prominent companies on this year’s list serves as an inspiration, setting an admirable level of excellence for their peers to follow. We are thrilled to honor these industry-leading professionals and wish them continued success for the foreseeable future.”

A sampling of the 2021 Fast Growth 150 list will be featured in the August issue of CRN Magazine. You can view the complete list online at www.crn.com/fastgrowth150.

Cyber Liability Insurance

You don’t have to be a Cybersecurity Specialist to get the sense that we are reaching a tipping point in the size, complexity and financial toll of cyber attacks. Heritage Insurance Advisors is a client of White Rock Security and guides business owners and IT professionals to the right coverage to minimize the financial and reputational pain of these attacks. Cyber Liability Insurance can cover things that are hard to address with even the best Cybersecurity, such as customers or new employees falling for phishing attacks.

Cybersecurity is Everyone’s Job

Are your employees putting your business at risk? Even the most loyal employee can expose you to a phishing or ransomware scheme – cyber training for your entire team can help you significantly reduce your risk.

Employees put you at risk in several ways:
Poor password choices: Passwords like “Password”, 123456 and “qwerty” are some of the most commonly used and easy to guess and increase your risk.

Poor password protection: Passwords don’t do any good if they are written down and posted on the device or on a nearby fixture.

Personal device issues: BYOD programs can help you save money, but employees using personal devices to access your network need training to reduce the risk of a breach

Falling for a phishing scam: Someone on your team clicks a link in an app or email – and your entire network is impacted

Unapproved software: Downloads of pirated or legal material could contain a virus or malware

Social engineering: Criminals use sophisticated methods to befriend your team and then exploit them for access to your system.

Cutting your Risk
Training and informing your team about known threats can massively cut down your risk. Comprehensive network security training should include:

• Formal classes on how to keep your network secure, including password use and ploidies

• Education about suspicious links and emails

• Information about the high threat posed by pirated or legal downloads

• What to do if you receive a suspicious email

• What to do if you lose your personal device (for those with BYOD programs)

• Proper password selection and management

Covering all of these aspects of security in a formal training session and then issuing updates as needed allows you to protect your business and ensure that every person on your team does their part when it comes to cybersecurity.

Will Your Backup Strategy Protect Your Business Against Cyber Attacks?

If you run a business or are the head of IT, then protecting your network should be one of your top priorities. Because so much of the world relies on electronic data, it is vital to keep your information safe. Like many other modern companies, you probably have more challenges than ever when comes to shielding the sensitive data that your business relies on for day-to-day operations.

Employers often use external apps and services to get work done. Workers may share private information with contractors. There may be multiple people, located thousands of miles from one another, working on the same file. With the complexity of modern computing, it is essential to have a sound network backup strategy in place to guard against the devastating effects of a cyber attack. Like most businesses, you probably already have backups. However, will they protect your information?

The headlines are full of reports about large organizations, such as police departments and hospitals, that are being forced to pay cyber attackers ransom after having their data encrypted in ransomware attacks. According to CNN Tech, cybercriminals extorted nearly $210 million from businesses and institutions after locking their computer servers.

Many of the large organizations and firms that were hit by cyber criminals surely have backups in place. So, why aren’t they working? Could your organization be at risk? It is not always easy to determine how secure your company data is. So, what can you do to protect your business?

Information technology and network security experts agree that because each organization’s security needs and priorities are different, there is no one-size-fits-all answer. Your backup strategy will depend on your organization’s priorities and requirements. For the best protection for your business, contact a security expert to help you design a backup plan that is right for your company.

The Importance of Email Archiving for Healthcare, Financial and Government Sectors

Archiving emails after a certain time is not just a good idea, for many industries, it’s the law. Failure to archive emails in a timely manner could result in both official sanctions and penalties and an inability to properly defend yourself in a criminal or civil case. Learning more about email security and archiving and the penalties for non-compliance can mitigate your risk and ensure your business stays on the right side of the law.

What Archiving is Required?

Many industries, including healthcare, banking and finance, and even government entities are required to keep track of email correspondence in an archive for a specified time period. Specific guidelines vary by industry, but your business needs to be in compliance with the Federal Regulations on Civil Procedures, which includes the following points:

• You need to know where your emails are

• You need to be able to comply with data requests

• You need to be able to retrieve your emails when requested

• You may not alter archived data; alteration is a crime and can be penalized with fines and jail time

For Financial Institutions

Outlined in Section 17a-4 of the SEC’s Securities Exchange Act, records of financial transactions and statements and other communications (including emails) need to be retained for three years. Brokers, investment firms, banks and other organizations are required to comply with this regulation.

In addition, rules under the Sarbanes Oxley Act require the retention of correspondence and documents relating to audits and financial data. Penalties for altering or deleting electronic records, including emails range from hefty fines to jail time.

For the Healthcare Industry

HIPAA may not specifically mention emails, but there are still requirements regarding documentation. Since patients can ask for a full accounting of disclosures of their PHI (Protected Health Information) for up to size years after the event, any organization wishing to comply with HIPAA should retain all communications, including emails. HITECH also specifies the need to protect and retain patient data and outlines the penalties for failing to do so.

Cut your Risk

Regulations are complex and varied, creating a robust email backup policy can protect your business not only from official sanctions and non-compliance penalties, and it can protect you in the event of a lawsuit as well.

Need help creating the right archive solution for your business? We can help you mitigate risk, fully comply with the law and protect your good name. Contact us to learn more about your options and to implement an archival program that works for your organization.

Upcoming Webinar
During an upcoming webinar on July 20th at 3pm EST / 2pm CST, experts from White Rock Security Group and Mimecast, a leader in email security and archival, will discuss the dual challenges that businesses have when it comes to archiving emails as well as protecting their networks from phishing and other types of attacks.  There is no cost to register for the webinar but there is a limit on the number of registrants.  Click here to learn more and to get registered.