Combat Online Crime – Five Ways to Improve Your Company’s Cyber-Hygiene

Cyber-crime is a growing problem that has begun to invade almost every part of the internet. There are numerous ways criminals can attack individuals and businesses online, from traditional fraud or theft, to leaking personal data and hijacking websites through ransomware or distributed denial of service (DDoS) attacks. At ReputationDefender, we help businesses shore up their defenses against these threats which can damage the company’s reputation and leave its leaders struggling to regain control of personal data.

Unfortunately, not every battle is winnable. There are many targeted online attacks, called Advanced Persistent Threats (APT), which are carried out by a massive organization (often a nation-state) with a lot of resources at their disposal. The latest big DDoS attacks also have the ability to knock out huge swaths of the internet for a short period of time, and they are very difficult to defend against.

Most Online Crime is Preventable

However, the majority of cyber-crime instances occur as a result of human error or systems that aren’t secure. People who fail to practice basic hygiene are more likely to get sick or spread disease to others and the same is true of online viruses and malware. Companies that succeed in blocking most access channels will send hackers on to easier targets. Basic cyber-hygiene won’t protect against every threat, but it will make it much less likely that your company will be one of the unlucky ones.

  • Education – A chain is only as strong as its weakest link and in this case that means the employee with the least amount of tech experience. Reduce the risk by educating everyone with computer access in basic security protocols, such as password strength and phishing scam recognition. Make sure anyone with home access is running security software.
  • Use Available Resources – There are a number of online sites that have a lot of information on cyber-security. In the UK, the Get Safe Online site offers valuable resources for companies and individuals who want to protect their privacy. Do not assume that you know everything; read the experts’ advice and then share it with other staff members.
  • Update Regularly – Microsoft, Adobe and other office software offer regular updates and security patches. It is extremely important to make sure someone is in charge of installing these; they’re often designed specifically to close vulnerabilities that criminals have learned to exploit.
  • Invest in Security – Viruses and malware are constantly changing. At some point, technology from ten years ago simply won’t protect against modern threats. Up-to-date security might seem like a big investment, but it’s nothing to what the company will lose through direct stealing or reputation damage if it’s hacked.
  • Perform Internal Audits – Security issues do not go away if you ignore them; they get worse. It’s worth hiring a professional to perform regular audits so you can diagnose the company’s weakest areas and work on fixing them.

Ultimately, combating cyber-crime will take a concerted effort amongst international and governmental agencies to track down these individuals and eliminate all the different ways they can attack. However in the short term, companies can accomplish a lot by making sure their own security practices are first rate.

How Can I Avoid a Phishing Attack?

Phishing attacks are scams that trick people into exposing financial details and other sensitive data. Phishing is not new; this type of online attack has been around almost as long as the internet, but today’s schemes are more sophisticated and harder to detect than ever. In the past, all but the most naïve could see through badly written requests to transfer money or suspicious-looking prize notices. This is not the case with modern phishing schemes which often resemble official communications so closely it’s hard to tell the difference. Some hackers take the time to learn co-worker’s names and personal details to make them appear even more convincing.

Phishing scams pose numerous risks. The most common scenario is a virus that will infect a computer through a contaminated link or a compressed document. Malware delivered through phishing can steal personal information, including financial details, or it may contain ransomware that will encrypt computer files and hold them hostage until you pay a fee. Most viruses have the ability to spread and infect an entire company network and businesses are frequently targeted since they have more resources and incentive to protect their data.

Falling prey to a phishing attack leaves a company vulnerable to financial theft, as well as leaks that could release trade secrets and confidential information. Compromising data released to the public causes reputational damage that’s hard to undo. Experts at Reputation Defender work to safeguard client reputations through regular privacy audits that catch problems as they emerge. We also help to repair online reputation by creating and promoting positive content.

Types of Phishing Attacks

There are basically two ways a hacker may design a phishing scheme:

  • Mass-scale phishing – A general attack that includes many different methods of communication. A lot like casting a large fishing net, mass-scale attacks do not target a specific person. However, they may include numerous semi-random attempts aimed at discovering the weakest link in a company’s network – the one employee gullible enough to click on a random link or reveal their password to a stranger.
  • Spear-phishing or Whaling – Spear-phishing is a targeted attack aimed at a specific person or a group of people. This type of phishing attack often includes details that make the included information seem legitimate. Emails can be designed to resemble personal office communication or a typical business invoice. Whaling is a type of spear-phishing that targets high-level personnel, particularly the CEO. Hooking these so-called “large fish” gives cyber criminals easier access to sensitive company data and financial accounts.
Methods of Delivery

Fraudsters have found even more creative ways to deliver links, through email, phone calls, text messaging and social media feeds.

Email phishing

A phishing email often looks like a generic notice from a well-known company or a bank. Cyber criminals have been known to copy logos from PayPal and eBay well enough to avoid detection. Typical scare tactics include warnings that the account is insecure, the password has been changed or there is a payment past due. Phishing emails usually include a CTA asking victims to click on a link or open an attached document. A targeted spear-phishing email may reference a colleague or a boss.

Things to look for – Many phishing emails still have small spelling mistakes or grammatical errors that a native speaker wouldn’t make, so this is the first thing to check. A missing email signature is another red flag or a form of address or writing style that’s not normal. Sometimes the only way to detect a phishing email is through slight changes in the email or domain name, such as the use of zeros instead of the letter “O” or “rn instead “m”. These can be easily missed, so if anything seems off, double-check the email address and domain name carefully.

Voice phishing – Vishing

Phone calls are another phishing technique (called vishing) which is aimed at getting individuals to hand over financial details or personal information. Like email phishing, vishing is often based on scare tactics that encourage victims to take action quickly without thinking about the consequences. Fraudsters may warn that a bank account is in danger or they may threaten legal action if a bill is not paid. Between 2013 and 2016, almost 900,000 people in the US received vishing calls purporting to be from tax collectors with IRS. These calls resulted in 5,000 victims with collective losses of USD $26.5 million.

Things to look for – Asking that bills be paid over the phone is unusual, so this should be an immediate warning. Banks also rarely ask for financial details or personal information over the phone. Don’t give details out unless you’ve made the phone call yourself to an official number and you know the counselor you’re speaking with well enough to recognize his or her voice. Other things to watch for are masked numbers or unknown caller ID.

SMS phishing – Smishing

Text messaging is another phishing technique that has come to be called smishing. Smishing messages often resemble phishing emails; they can come in the form of fake account notices with a CTA link. Some cyber criminals have even been known to use smishing to highjack a two-party identification system, first by requesting a password reset on your account, then sending a text asking for the code you just received in order to fix ‘’unusual activity” on that same account.

What to look for – Unusual or unfamiliar numbers should be a give-away, as well as unsolicited messages or codes you haven’t requested. Unless this is a company that normally sends texts, you should wonder why they are using this form of communication.

Social Media Phishing

Phishing schemes have also infiltrated social media. Fraudulent posts may claim you’ve won the lottery or ask you to click and sign up for membership. Targeted attacks often pretend to be from a friend who’s opened a second account. Some scams may even come from a regular account that’s been hacked.

What to look for – Watch for irregularities (why would a friend choose to open different account?) or language that doesn’t sound like the person you know. Be suspicious of sponsored posts from unknown businesses and links included in comments made by people you don’t know well.

Avoid Getting Hooked

Avoid all forms of phishing with these basic guidelines:

  • Don’t click on a link in an email or a text message unless you’re sure who the sender is.
  • Be wary of unsolicited messages and unusual account notices. Verify with the company before taking any action.
  • Always sign in to your accounts via a trusted app or by entering the URL in your browser. Don’t use an embedded link even if you think it’s legitimate.
  • Double-check any communication that’s doesn’t follow normal protocol. It never hurts to follow-up with an old fashioned phone call to make sure the message is from the real sender, especially if there’s money or confidential information involved.
  • Don’t transfer money without verifying who’s asking for it and where it’s going.
  • Don’t give out personal information over the phone.
  • Don’t fall for scams that seem too good to be true. They probably are.

A Quick Guide to Safe Online Christmas Shopping

Christmas can be a stressful time for parents trying to manage their work schedule whilst attempting to find the latest must-have gift for their child at the same time. Many busy parents take to the internet to purchase what they need quickly and easily with only a few clicks. Internet shopping has many advantages in terms of convenience, yet products found online are notoriously less safe and may not always be what they claim. Security oversights during internet shopping can allow hackers access to financial details and sensitive personal data that could ruin your reputation. If you’ve experienced reputational damage, Reputation Defender’s ORM services will help, but it is a good idea to have security measures already in place.

Christmas Safety Tips

Here are 6 important guidelines that will help to make your online Christmas shopping safe and hassle-free:

  • Research the product – Go to a store and check out the product, or watch a video that shows it in action. For electronic products, verify that the voltage fits within standard safety recommendations and has a plug adapted for the country where you live. Check that the online product is made by the original manufacturer and is not a cheap knock-off that may break easily or be unsafe.
  • Verify the site – Buy from legitimate, well-known dealers as much as possible. If you’re working with an auction site, check the seller’s record and reviews. Don’t fall for a con-scheme. If a bargain seems too good to be true, it’s likely not the real thing. If a seller claims to have a popular product that is out of stock everywhere else, it may very well be a fake or not even exist. Don’t pay more than the going price to get something that is unavailable elsewhere.
  • Check payment security – Use a credit or debit card if possible so there’s a record of the transaction and the bank can help you to dispute any irregularities. Double-check the security protocol on the site. HTTPS signifies that a site is using encryption or in some browsers the address bar may appear green. A padlock sign should also be visible on the pop-up payment window; however if the padlock is built into the page itself, it’s likely a fraud, so stay away. When buying directly from an individual seller, use a secure online service such as PayPal rather that transferring money directly into a stranger’s bank account.
  • Save receipts – Save the emailed electronic receipt or order confirmation at least until the product arrives. This will help you to dispute any problems or failed delivery.
  • Double check purchases – When the product arrives, open the box and make sure all parts are included and it is indeed what you ordered. If there’s a mistake, it is important to catch it early, rather than Christmas morning when the children will be disappointed and toys may end up being damaged before you can return them.
Beat the Rush

Online shopping is even harder if you wait until the last minute, so make sure to plan ahead. Remember, everyone is busier at Christmas. Delivery times may be extended and stock may not last as long as was anticipated. Get written confirmation that your package was shipped and track its progress so you’ll know ahead of time when to expect it.

Don’t Let Banking Online Make You the Next Fraud Victim

Online banking is a convenient way to manage money without the hassle of bank closing times or waiting for a cheque to clear. Yet there are risks with accessing financial information over the internet that shouldn’t be ignored. Numerous cyber criminals browse the web looking for personal data that can yield a cash payoff. All it takes is a few security oversights to make your account easy to hack and to turn you into the next target.

How to Stay Clear of Hackers

At Reputation Defender we warn our clients about the dangers of personal information becoming publicly available through careless online privacy. Data leaks can cause reputational fallout and they will also help a hacker to access your bank accounts and fraudulently transfer money. Here are some of the most important precautions you should take to stay safe whilst banking online:

• Avoid Public Networks – Never access a bank account on a public computer or a free Wi-Fi network. These are inherently insecure and may be regularly monitored by cyber criminals.
• Bank on a Single Device – Keep your banking limited to a personal laptop or an iPad that isn’t used by children or other people who may be careless online.
• Use Secure Passwords – A strong password is one that combines numbers, letters and symbols, but does not include any guessable information such as birthdays, names or addresses. It’s a good idea to change your password several times a year. If you have trouble remembering complicated passwords, invest in a password manager.
• Avoid Phishing Attacks – One common online scam is a fake notice advising that an account is insecure or the password has been reset by someone else. If you receive an unsolicited notice like this, never click on the link contained in the email. It likely contains a virus that will allow the scammer to steal your banking details. Instead, sign in via another secure app or call the bank to check your account status. Do not give out financial details in an email or over the phone. If someone is asking for this information they are not from your bank; they are a fraud.
• Keep a Close Eye on Accounts – Check into your account regularly to make sure you recognize all the transactions. Report any suspicious activity immediately so your bank can take action before further hacks take place.
• Set Privacy Controls on Social Media – This might not seem important for banking, but poor privacy elsewhere on the web can give a hacker the answer to many security questions (such as your mother’s maiden name, the name of your pet, your first car etc.). Details like this quickly become a reason for a thief to target your account.
• Protect Your Pin – Never give your pin to anyone, even someone you trust. Take measures to protect your pin in physical locations by shielding the console and checking for observers.
• Shred Physical Documents – Documents containing account numbers, social security numbers or any type of personal information should never be thrown in the trash.

Statistically, only a small number of people get hacked, yet this doesn’t mean criminals aren’t already checking out your account looking for a way in. Any account can be breached given enough time and effort, so the key is to put enough security measures in place so that criminals will lose interest.