Increasingly attackers are not targeting businesses finance depts or directors, but support staff and IT. It’s vital all business departments and staff are included when looking at security awareness training. Also, don’t assume that IT is immune to such attacks (as we’ve seen from the Twitter incident) as increasingly IT support desks are targeted by hackers posing as staff members trying to reset their passwords or similar types of scams.

TIP: Conduct security awareness training regularly and at least annually to ensure staff are up to date on the latest examples and styles of attacks so they can act accordingly. Ideally have a multifaceted campaign through the year that helps to raise awareness at frequent touchpoints, rather than just one annual hit.

Whilst details surrounding how Twitter employees were manipulated into giving access to Twitter’s internal systems are vague, one of the most likely scenarios is that they were tricked into resetting the credentials of another employee (or several employees) until they found one with access.

This highlights why it’s so important to consider likely scenario’s when designing business processes, especially support for end-users and customers. Consider the following typical business processes:

• Resetting a user or customers password.
• Changing account details such as email address or details used to verify someone’s identity.
• IT problems such as file access problems or problems opening an ’email attachment’.
• Requests for payments or transfers or changing payment details on an invoice.

Each of these processes has the potential to harm the business or it’s customers if an attacker exploits these processes successfully.

TIP: Challenge yourself and think how an attacker might be able to impersonate a customer or client. What checks do you do to verify someone’s identity before changing passwords or sending data? Do you ask questions that cannot easily be guessed or found on social media (such as favourite colour, pets name or date of birth)? Build in the right level of checks and balances into your business processes to help prevent a would-be attacker simply calling up your support team and asking for the CEO’s password to be changed.

Suppliers, IT Support providers and other essential business providers are also a point of weakness for potential attacks. Attackers may conduct a number of calls or emails to businesses to discover more about how a business operates, or review websites and search for links to potential suppliers or providers. Using this information an attacker may exploit lax processes in an attempt to gain access to sensitive information.

TIP: Make sure you have robust security practises in place with suppliers and providers around sensitive business processes. Also, remember that phone numbers can be ‘spoofed’ to look like a genuine number and emails from business addresses could be the result of the supplier falling victim to an attack. Plan your processes accordingly and build in verification before doing anything sensitive, like reveal information or make payments.

Multi-factor authentication adds another layer of security to your password. Instead of just using your password to log in, you’re also asked to provide a code or allow access provided to you via SMS, or increasingly an app like Authenticator. This helps to protect accounts from password hacks or resets as it ensures a second means of verifying your identity.

TIP: Make sure you have MFA enabled on all accounts containing or with access to sensitive information, especially for cloud-based services where you can log in from anywhere.