Security experts are warning businesses large and small to take extra steps to protect information systems from possible cyber attacks in the wake of the Russian invasion of the Ukraine.
Michael D. Moore, CEO of M3 Networks, a Southlake-based IT services and cybersecurity firm, puts it bluntly.
“Now is the time to be vigilant at your highest level. If a rogue nation is empowering its criminal element to unleash its worst actions on you, you need to be prepared,” he said.
Moore said cyber attacks were the precursor to the actual invasion.
“The Ukraine, before they got hit with bombs, Russia hit it with DDoS (Denial of Service) attacks and malware that crippled their infrastructure and their communications prior to sending the first tank across the border,” he said.
Federal officials are warning of possible cyber attacks by Russian-backed groups against U.S. targets in the wake of the Ukraine invasion with the U.S. Cybersecurity & Infrastructure Security Agency warning organizations to be prepared for cyber attacks.
Businesses, particularly high-tech and financial institutions, should be on high alert, said Dr. Murat Kantarcioglu, professor of computer science at UT Dallas.
“Those are the organizations that should be hypervigilant because those are areas where the U.S. has imposed sanctions against Russia,” he said. Other organizations should also be on high alert, he added.
“Now is the time to take stock of your computer security position,” he said. “Defense is your best plan, but you also should know how to recover if you do come under attack.”
Although it has not been linked to the tensions brought on by the Russian invasion, Seattle-based Expeditors International of Washington Inc. announced Feb. 20 it was the subject of a cyberattack that impacted operations around the globe. In Ukraine, Moore said, officials there have reported a wave of various highly coordinated cyber attacks around the county.
Moore’s company is reaching out to their clients and asking them to take three steps. No. 1 and No. 2 relate to a company’s cyber-liability policy, he said.
“I’m asking them to audit their cyber liability policy and make sure they adhere to the language,” he said. That language may call for a consistent third-party cybersecurity assessment.
“What consistent means in insurance language is every 90 days or every six months. So if you say, ‘I’ve got an IT company, I’m good here,’ but you don’t do this third-party cybersecurity audit, you’re not in compliance with your insurance policy.”
Item No. 2 is for companies to perform a cybersecurity audit to remain in compliance, while No. 3 calls for companies to engage with a cybersecurity specialist attorney.
Moore also noted that while many companies experience ransomware from individuals looking for monetary gain, these attacks from Russian actors may simply be destructive in nature.
“Ransomware, it tries to get you to pay a fee and the hacker gets some money in the process,” he said. “This malware that Russia has created, that they put publicly out there for hackers to use, to do destruction to folks, it actually just deletes everything. It just does destruction. It doesn’t even ask you for money. It doesn’t try to help benefit the Russian economy or underground crime. It just literally destroys everything.”
That is a different mindset to be aware of, Moore said. “They’ve enabled other countries and other people that are friendly to them, or want to do damage to American interest, they’ve enabled them to have access to that malware to do damage to us. That’s bad.”
“It’s not a matter of if your company or you as a person are going to be individually harmed by a cyber attack, it’s a matter of when,” said Moore.
7 tips for cybersecurity
- Use passphrases instead of passwords. Example: I love the beach for Amazon.
- Use encryption and multi-factor authentication whenever it is available.
- Watch for phishing scams – the paid ad that asks, “What does Mary Ann from Gilligan’s Island look like now?”
- Stop reusing passwords – using the same password for everything makes you extremely vulnerable.
- Sign up for a third-party password manager such as 1Password, Dashlane, Roboform.
- Watch out for public WiFi.
- Improve your offboarding process – departing employees have your passwords unless you change as they leave.
Source: M3 Networks
Unusual incidents or reports of cyber crimes can be reported to the FBI at ic3.gov.
Bob Francis is business editor for the Fort Worth Report. Contact him at bob.francis@fortworthreport.org. At the Fort Worth Report, news decisions are made independently of our board members and financial supporters. Read more about our editorial independence policy here.
Republish our articles for free, online or in print, by following our guidelines.
