" cybersecurity Archives - LuxSci

Posts Tagged ‘cybersecurity’

Improve Account Security by Enabling Multifactor Authentication

Tuesday, May 17th, 2022

This month, the Cybersecurity and Infrastructure Security Agency (CISA) launched an initiative called MFA May to encourage individuals and businesses to enable multifactor authentication for their accounts. This article defines multifactor authentication and explains why organizations should implement it to improve the security of their accounts.

multifactor authentication

 

What is Multifactor Authentication?

Multifactor authentication requires users to present two or more credentials to log in to their accounts. Multifactor authentication is sometimes called two-factor authentication for this reason. The first factor required is a typical username and password. The second factor is usually a code contained within a text, email, or push notification. The user must enter this numerical code to confirm that they are logging into the account. Sometimes an authenticator application is used to generate the code. Instead of a numerical code, the second factor could be a biometric marker like a thumbprint scan.

By requiring a second piece of information to log in to an account, multifactor authentication increases the security of accounts. Even if a hacker gets ahold of your password, they will be unable to log in to an account without the second piece of authentication.

How Multifactor Authentication can Stop Cybercriminals

As you can tell, multifactor authentication is an effective tool for limiting account access. A study by Microsoft found that users who enable multifactor authentication for their accounts will block 99 percent of automated attacks.

It is easier than ever before for hackers to acquire users’ passwords. Data breaches compromise millions of account credentials each year, which can be purchased on the dark web for pennies. Hackers can also use dictionary attacks to guess simple passwords using computer technology. Lastly, users may unwittingly hand over their credentials to a malicious actor during a phishing attack.

However, administrators can stop these attacks by enabling multifactor authentication. Even if a hacker knows your password, they will be unable to access your account without that second piece of information.

How to Enable Multifactor Authentication

Many vendors now offer multifactor authentication. We recommend enabling it as often as possible, especially for sensitive accounts like email, financial accounts, and medical records.

LuxSci has offered options for multifactor authentication to our users for over a decade. Users have the flexibility to choose the second option for authentication. They can choose to send a token to an alternate email address or enable a third-party app like DuoSecurity or Google authenticator to validate their identities. Please contact our support team to learn more about enabling multifactor authentication on your LuxSci account.

Conclusion: Why Use Multifactor Authentication

Cyber threats are increasing across all industries. Although HIPAA does not yet require users to implement multifactor authentication, security experts strongly recommend it. Enabling multifactor authentication is an inexpensive and effective way to improve your security posture. Although users may object to the extra step, enforcing multifactor authentication as an administrator is a smart move.

What is Cyber Insurance?

Tuesday, March 1st, 2022

As cyberattacks are increasing in frequency, many organizations have come to view them as inevitable. Even organizations that have a strong cybersecurity program can be impacted by a zero-day vulnerability or employee errors. Cyber insurance helps limit the impact of a cyberattack by helping organizations recover the costs. Cyber insurance is not a replacement for a comprehensive cybersecurity program. In fact, many cyber liability insurance policies require organizations to take steps to secure sensitive information.

cyber insurance

Who Needs Cyber Insurance?

In the 1990s, the earliest forms of cyber liability insurance were created to help address data processing errors. California’s passage of the Security Breach and Information Act in 2003 led to increased demand for insurance policies. Under this law, California companies were required to notify customers if their information was accessed or stolen by unauthorized persons. As other states passed similar laws and instituted financial penalties for data breaches, cyber insurance policies grew in popularity.

Historically, financial information and credit card numbers were prime targets for cyber criminals. As ecommerce and online banking took off, large financial institutions and retail chains were likely to have cyber insurance because of their increased risk. More recently, cybercriminals have expanded their scope to go after sensitive information collected by other industries. The healthcare, education, and manufacturing industries have become frequent targets for cyber criminals. As a result, more organizations are buying cyber insurance. According to the Government Accountability Office (GAO), cyber insurance sales increased from 26 percent in 2016 to 47 percent in 2020.

This means that any business transmitting or storing sensitive data online is vulnerable to a cyberattack. Sensitive data is not limited to financial information or medical records. Intellectual property, customer or lead lists, and other types of company data could all be at risk.

What Does Cyber Insurance Cover?

There are many types of cyber insurance policies and different coverage options. However, most plans reimburse companies for expenses caused by cyberattacks. Common coverage options include:

  • data recovery costs
  • system forensics to discover the cause of a cyberattack or location of a breach
  • customer notification and reparation costs
  • system repairs
  • legal fees

Some cyber insurance policies may even cover the cost of paying a ransom if compromised by ransomware. Although, it’s tempting to pay a ransom and resume operations quickly, organizations should not count on insurance reimbursement. Law enforcement also discourages companies from paying ransoms and these fees can be quite hefty.

What Doesn’t Cyber Insurance Cover?

Unfortunately, cyber insurance can’t help a company recover from the reputation costs of a data breach or security incident. Many organizations suffer from a loss of business in the aftermath of a cyberattack or breach. Cyber insurance does nothing to defray those costs.

Can I Ignore Cybersecurity?

On that note, it should be obvious that cyber insurance is not a replacement for a strong cybersecurity program. In fact, most insurance providers require organizations to meet minimum security standards to qualify for coverage. Failing to meet these standards may cause the company to void insurance policies.

In addition, lowering the organization’s risk profile by implementing a security program can also help lower insurance premiums. Demonstrating that the organization takes privacy and security seriously can help make these premiums more affordable.

Conclusion

In conclusion, any organization that transmits or stores sensitive information online or is reliant on internet-connected devices to perform vital tasks, should explore coverage options.

5 New Year’s Resolutions to Improve Your Cybersecurity

Tuesday, January 4th, 2022

Happy New Year! Start the year off by making a New Year’s resolution to improve your cybersecurity. Here is LuxSci’s list of what your organization needs to do to prepare for the new year.

cybersecurity new year’s resolution

Read the rest of this post »

Looking Ahead: 3 Cybersecurity Predictions for 2022

Tuesday, December 28th, 2021

We’ve been busy crunching the numbers and analyzing industry trends to bring you our cybersecurity predictions for 2022. Here’s what you should expect in the following year:

2022 Cybersecurity Predictions

Read the rest of this post »

2021 Year in Review

Tuesday, December 21st, 2021

As the year draws to a close, it’s a good time to take a look back. In this 2021 Year in Review, we analyze the most important developments in cybersecurity, as well as the major information security threats.

2021 year in review

2021 Year In Review: The Impact Of Coronavirus

As we entered year two of the coronavirus pandemic, we are still dealing with the fallout. The work-from-home model spurred on by COVID-19 presented a significant shift for the workplace and the way we use technology. The emergence of the Delta and Omicron variants wreaked havoc with plans to return to the office. As a result, many roles permanently shifted to full-time remote work. Still, other companies returned to the office and are managing a hybrid model. There are far more work-from-home opportunities than were available in the pre-pandemic world.

This has significantly altered the threat landscape. Organizations need to acknowledge that remote work is here to stay. As a result, they should update their security plans and invest in the equipment needed to enable secure remote work.

In addition, there have been a host of COVID-19-related threats that we have had to remain vigilant against. These have ranged from fake COVID-19 medication websites that suck up sensitive data, to malware loaders that use pandemic-related topics as a smokescreen. The most effective threats often utilize social engineering and the anxiety caused by COVID-19 is a benefit to cybercriminals.

The good news is that these threats seem to be going down, with Trend Micro finding about half the number of COVID-19-related threats in the first half of 2021 as they did in the beginning of 2020. However, this does not mean that overall cyberthreat levels are decreasing. Instead, it’s likely that attackers are simply moving on to other deception techniques.

2021 Year In Review: Ransomware

Trend Micro reported that ransomware detections have halved from 14 million in the first 6 months of 2020, to 7 million between January and June in 2021. However, it doesn’t mean that the threat is going away. The company’s report finds that attackers are adopting a targeted approach that aims for high rewards, as opposed to pursuing as many victims as possible. Indeed, we saw attacks on critical infrastructure this year that garnered national attention. The Colonial Pipeline, JBS Foods, and the Kayesa ransomware attacks were just a few that made headlines in 2021.

Figures from Palo Alto Networks show that ransomware payouts are rising. The average ransomware payment rose from $312,000 in the first six months of 2020 to $570,000 in the first half of 2021. The FBI was able to recover some ransomware payments from cryptocurrency wallets this year, but only in a small fraction of cases.

Trend Micro also noticed an increase in modern ransomware attacks that involve more sophisticated methods of infection. As ransomware threats get more sophisticated, make sure your cybersecurity program is keeping up. Annual reviews, training, and investment in cybersecurity are crucial to keep your business protected.

2021 Year In Review: Zero Trust Architecture

One of the more positive developments in cybersecurity has been the move to Zero Trust Architecture. This approach was spurred on by a government initiative that aimed to boost America’s cyberthreat resilience. The initiative also included plans to modernize the federal cybersecurity environment.

Under the plan, each agency head was required to develop plans for implementing Zero Trust Architecture according to guidelines set out by the National Institute of Standards and Technology (NIST). The government is continuing to invest more in cybersecurity as a part of America’s national defense. It’s likely we will see increased funding for such initiatives in 2022.

Zero Trust Architecture quickly caught on across all industries. It is an approach that assumes an organization’s own network is not safe from cyberthreats. This security model accepts that attackers may already be inside the network and involves creating trust zones of access which are as small as possible. The approach reduces the potential impacts of an attack. Limited trust zones prevent bad actors from accessing all of a network’s systems and data.

Stay Safe in the Future With LuxSci

The last 12 months have brought a lot of changes to the cyber landscape. One thing that always stays consistent is the tenacity of attackers in coming up with new ways to circumvent cyberdefenses.

Amid our ever-changing tech environment and the constant wave of novel attacks, the only way for companies to effectively defend themselves is with a cybersecurity partner like LuxSci. Contact us now to find out how our services can help to protect your organization from threats in 2022 and beyond.