Capstone Works Blog

We’ve been talking about cybersecurity quite a bit lately, and for good reason. Any organization that doesn’t acknowledge the threat that comes with being ill-prepared in the face of a cyberattack is basically sitting on a ticking time bomb. 

Business cybersecurity, and all its assorted intricacies and requirements, can be a real challenge for organizations of all sizes to deal with—particularly because it depends so much on employee engagement. That being said, there are a few things you can do to help boost your team’s cybersecurity awareness by promoting more secure behaviors.

The last few years have seen an unsettling jump in cybercrime rates, with more businesses struck by various attacks, ransomware, and data breaches. Phishing attacks against end users haven’t slowed down, either—in fact, they’ve become effective enough that even the pros can be tricked. Let’s consider some of the cybercrime trends we anticipate to see in 2023.

Let’s cut to the chase: scams are everywhere out there today, which makes it important that you are aware of how to avoid them. Let’s run through a few basic tips we always recommend.

They say that everything’s bigger in Texas. Unfortunately, as of late this includes the losses that businesses incur to cybercriminal activity. Let’s discuss how serious this problem is, and what you need to do to keep it from harming your business.

Phishing is one of the leading vectors for larger cyberattacks, and right now, it’s the biggest cyberthreat for Texas-based businesses. In this guide, we’re going to cover what to look for. If you are a business owner, we recommend sharing this blog with your entire staff and asking that they read and confirm they understand it. Go ahead and share it as much as you want—if you find it useful, we’d love to hear from you!

Austin might be the tech hub of the midwest, but that doesn’t mean that every business is on the same page when it comes to their IT. Cybersecurity has been such a problem recently that it’s close to growing out of control, but Texas CEOs are stuck dealing with louder, more visible issues to the point where they might not be seeing the threats underfoot.

Cybersecurity can be a challenging animal for any business—particularly a small business. That makes it important that you understand a few key terms. Let’s go over these terms as a review—or as an introduction, if that’s the case.

The United States as a whole has seen a growing wave of cybersecurity threats, and the great state of Texas is no less likely to see these threats. In fact, there are plenty of reasons that Texas would be targeted directly. Let’s briefly review some of these reasons, and how they support the importance of cybersecurity preparedness for Austin businesses.

The manufacturing industry has been deeply intertwined with modern technology since the 1950s and 1960s, when computer-aided design (commonly known as CAD) first enabled the digitization of these processes. Today, this interconnectivity has evolved into the Industrial Internet of Things. Let’s consider how these technologies, while greatly beneficial to productivity, have the potential to enable risks… and, critically, how to better resist these risks.

Most businesses rely on information technology in order to operate, with accountants, CPAs, and accounting firms being no exception. This means that modern accounting firms therefore have a lot of IT-related considerations to manage—particularly related to their security.

It’s no secret that your data is a hot commodity. Each day sophisticated cybercriminals attempt to make money by stealing your private information to pose as you, blackmail you, or simply sell your information to someone who will. If you want to stay in business, you’ll need to be able to thwart these attempts. But to do so, you must understand the increasingly advanced methods hackers use. In this two-part article, we’ll examine the techniques hackers are currently employing to gain access to your sensitive data.

Cracking Passwords

The fact that hackers might simply guess your passwords probably seems painfully obvious, but the hard truth is that many companies still lack proper password management. If your password is a series of common words, a dictionary attack can use algorithms to cycle through a word database and quickly discover your chosen phrase.

Simply adding some numbers won’t be enough, either, as hackers can up the ante with a brute force attack which allows them, with some additional computing power, to cycle through alpha-numeric combinations until they strike gold.

And if they are very determined and well equipped, a hacker can also use a rainbow table attack. When passwords are attempted, they are “hashed” to avoid sending the actual plaintext password over the communication line. In this type of attack, pre-computed tables are used to recover these hashes and reverse them to reduce guessing time and discover complex passwords.

To prevent these, you’ll need to create unique passwords that are more than ten characters long and have a mix of numbers, lowercase and uppercase letters, and symbols for each account. One popular trick for this is to think of a phrase and codify it. For example, “Cousin Greg lives in Seattle” becomes “C0u$iNGr3gLiV3SinS3ATtLE”.

Additionally, you should use multi-factor authentication whenever possible so that your password isn’t the only thing standing between an attacker and access to your accounts.

Phishing Schemes

One of the most common methods of data hacking, phishing scams are so effective, they’ve produced many high-profile data breaches including the hacking of Clinton campaign chairman John Podesta, who unknowingly gave up his Gmail password, and Snapchat, where an employee gave up payroll information that led to widespread identity theft.

In a phishing scheme, disguised e-mails are used to lure the recipient into a trap. Posing as a trusted source, such as someone you do business with, your bank, or your email provider, hackers trick you into providing them information directly, clicking a link that leads you to a fake site, or downloading an attachment that then allows them access to your system. One of the oldest tricks in the book, phishing is an evergreen technique that is continually being re-invented in order to become harder to spot.

The best way prevent being hooked in by a phishing scam is to study the way they are being used and stay vigilant. Make sure to check the spelling of URLs in email links and watch out for URL redirects. Keep your browsers up-to-date to ensure you have the most recent security patches and install anti-phishing toolbars on your browser that can run checks on sites you visit and compare them to a database of known phishing sites. And, of course, never give out personal information over email.

These are two of the most popular ways attackers attempt to gain access to your system but stay tuned for Part 2 of this article as we dive into three more sophisticated methods cyber attackers are currently using. Concerned you’re not as safe as you thought? Contact Capstone Works immediately. Our cybersecurity professionals have the expertise to make sure you’re one step ahead of the latest tricks, scams, and hacks that could threaten your business.

Email is (and has been) a prime method of communication for businesses of all sizes. With email comes a whole slew of issues that are essentially synonymous with the technology; spam, information overload, phishing, and information privacy. Even Central Texas small businesses that only do business locally are at risk of these issues. Personal email accounts are equally at risk. Employing proper precautions and practices whenever communicating via email is very important to prevent the risk of security compromises, monetary loss, and even legality issues.

The FBI has issued alerts to all businesses about the spread of BEC scams.  One of the fastest growing hazards facing businesses today is the growth of Business Email Compromise or BEC scams.  According to the FBI, these scams have grown by more than 270% since the beginning of last year.  At their last reporting, more than 7,000 businesses have lost more than $1.2 billion in the last 2 years.  At Capstone Works we help you to manage your IT risks.  We are at the forefront of IT risk management; monitoring, assessing and evaluating threats to your network no matter where they may come from.  You can be confident knowing that Capstone Works is in your corner.  While these scams may, at first, seem less impressive than thefts perpetrated by sophisticated malware targeting banks and other large institutions; a BEC attack is, in reality, more vicious.  They are more versatile and can avoid the basic security steps taken by businesses and individuals.  Instead of simply targeting your machines, a BEC scam targets your people!  Criminals are convincing their victims to hand company money right over to them, and they have been very successful in doing so.  According to the FBI, “The scam has been reported in all 50 states and in 79 countries.  Fraudulent transfers have been reported going to 72 countries; however, the majority of the transfers are going to Asian banks located within China and Hong Kong.

Most small business owners believe cyberattacks are the concern of large corporations, however nothing could be further from the truth. According to Verizon Data Breach Investigations Report 71% of cyberattacks occur at businesses with less than 100 employees. [1]

Unfortunately, many “SMBs suffer from 'It can't happen to us' syndrome,” notes Robert Siciliano, security expert for McAfee. “They also typically don't have the resources to secure their networks to the degree a large enterprise would. But the information on their networks – and access to their bank accounts – still makes them a big target.” Even though it turns out SMB’s have a larger target on their backs than they realize, two thirds of SMBs surveyed by Symantec say they're not concerned about cyber threats; and more than 80 percent have no formal cyber security plan.

Angry customers, negative media coverage, frustrated employees, untold revenue lost, lingering anger from customers: that’s the status for Delta Airlines this week.  Of course this is not news to anyone; unless you have been living under a rock you have heard the numerous news reports detailing the Delta computer disaster.  Whether caused by a minor power outage at Delta headquarters or an internal computer hiccup, the airline was forced to cancel over 500 flights causing gridlock across America’s airports at the height of vacation season. You may not be running an international transportation corporation, but imagine what would happen to your clients if you had an unexpected IT failure.  Think something like this can’t happen to you? Think again.  The problem that Delta airlines faced was not the power outage at their headquarters; it was an inadequate IT Disaster Recovery Plan.  As a business owner you don’t want to be caught off guard in the middle of an IT nightmare.  An IT Disaster Recovery Plan may sound like a great idea, but you might not even know what one looks like, let alone know where to start.  Here at Capstone Works we are your IT partner and are ready to put together a comprehensive IT Disaster Recovery Plan.  The goal of any good plan is fivefold, it should:

Your identity has quite a lot of value, especially in the wrong hands. Security firm ZoneAlarm put together some numbers in 2011 concerning identity fraud, and it even shocked us. Let's talk about a few of these statistics and what it means.