IT security can be a black-box for many, with the risks and protection methods being difficult to understand. I titled this article “IT Security Boogeyman” because some organizations and experts ring the alarm bell about irrelevant threats and/or offer bad recommendations. IT researchers have often identified “the next big threat” only to be proven wrong. When this occurs, it is important to move-on and focus energy on threats relevant to your organization’s size and profile. Focusing on every possible threat leads to fatigue, reducing the attention available for protecting against pertinent threats. 

One of the Boogeyman threats was recently in the news again: being hacked by an airport or other public USB charging station. This is a theoretical threat, and the urgency is based on the technical simplicity of hacking a cell phone from a charging cable. This attack may seem simple to law-enforcement who warned against it, since they have very expensive equipment allowing them to hack into criminals’ cell phones with relative ease. In real life, this type of attack requires equipment along with the logistics of sneaking a device in and out of a public location. There are scant documented examples of this type of attack, if any. At the end of the day, this alarm only wastes the public’s limited attention for IT security because it is unlikely, and because anyone who wants their phone charged quickly will use their own high-power charging device. 

Our next Boogeyman is an oft-repeated security recommendation to use a low-cost VPN when browsing the web. The threat is that web activity can be monitored and bank credentials or other personal data can be stolen. This threat is easy for IT security researchers to execute with their toolset. Hackers have access to similar tools, but executing this type of attack is extremely rare except for on public WiFi networks, where it is still rare. Using a low-cost VPN to protect against this threat on public WiFi networks makes people less secure by routing many peoples’ personal and confidential data through the VPN company, creating a juicy target for attackers. Indeed, several VPN providers have been compromised over the years. Many security experts are now recommending the use of your cell phone hotspot instead of public WiFi to address this threat, because it will connect more reliably and usually provides faster bandwidth. 

Understanding which threats pose a risk to you and your organization requires understanding the adversary. Today, most attacks are executed by sophisticated organizations. Often called “gangs,” they operate more like corporations with HR departments, annual reviews and bonuses. As a business, they will minimize risk and investment for the best return. Ransomware is extremely profitable, and can be successfully deployed from Eastern Europe or Asia, where law-enforcement often looks the other way. These factors make other types of attacks costly and risky by comparison. With that in mind, I have outlined the three threats which AT sees attempted most often, and the value to the adversary: 

Ransomware 
Ransomware is the 800 lbs gorilla in the IT security world these days. For the uninitiated, ransomware attackers will lock-up all data and systems on a network, demanding a ransom to provide the unlock key. Ransoms can reach into the millions, and are often just a fraction of the cost to restore business operations. There are some critical components to effectively protecting against Ransomware. The first is advanced email security filtering. Ransomware most-often starts with an email, which either initiates the malware installation process or entices staff to call a human who convinces staff to install malware. Email must be thoroughly scanned, including opening and scanning all attachments for malicious scripts. The second critical component is behavior-based security software called EDR, since anti-virus software cannot detect modern ransomware installations. The third critical component for protecting against ransomware is Security Awareness Training for staff. Staff must be cautious about opening attachments, and skeptical of any urgent situation requiring them to call immediately.  

For companies not fully in the cloud, Mulit-Factor Authentication (MFA) and password policies are also vital to keep outsiders from gaining access and installing ransomware on the network. MFA is crucial for all organizations, but for other reasons. 


Stolen Personnel Data 
For the majority of companies, the most valuable data in possession of the company is private health and banking data of the staff held in HR files. This data can be compromised in multiple ways. Here are the two most common methods we have seen: 
 

1. Mailbox Compromise - This is when an attacker gains access to a staff mailbox by using that staff members credentials. Here is how it happens: Since the majority of the businesses use Office 365, attackers try common passwords against an entire company (Password1, Spring2023, etc) and usually gain access. Another method is to send an email with a link to a fakes Office 365 logon page, where staff member accidentally give their password to attackers. Once access to a mailbox is gained, the mailbox can be quickly exported for future searches of personnel data, and then an email is sent out to all contacts in the mailbox, to extend the attack further. One company found that 85% of Office 365 customers have been compromised in this manner during a recent 12 month period.  (Read the article here.) MFA is the best protection against mailbox compromise. Microsoft states that 99.9% of these attacks would have been blocked with MFA.
2. Impersonation -The second method used to gain access to personnel data originates with a seemingly authentic email. An email appearing to come from an executive will be sent to a subordinate asking for all recent W2s (or a member list, or insurance info, etc). This method has also been attempted for other types of fraud, such as illegitimate wire transfers and the purchase of gift cards. Email security filtering and Security Awareness Training are the best methods of protection against this threat. 

Website Attacks 
Websites can be enticing targets for multiple reasons: attackers can insert code to send all entered credit cards to another location, attackers can retrieve personal data, or they can simply use the website as an entry-point for installing ransomware. AT has seen all three attempted multiple times. Website security is a comprehensive topic by itself, but two areas we see small organizations overlook are: 

1. Decommissioning old applications: many associations keep old web applications online without upgrading them. New applications are written with more secure tools and are more secure by design. 
2. Upgraded Firewall Protection: The newest type of firewall inspects data provided to your application or website, and this type of firewall is often called a Web Application Firewall (WAF). A WAF provides a higher level of protection against traditional hacking methods on websites, often at an affordable monthly fee rather than requiring a large investment in new equipment. AT has been offering a WAF solution for a few years now, due to an increase in malicious web activity. 

Extra Credit: Protect your members 
Volunteers are often high-profile and/or successful professionals in the field. Their success makes them an appealing target for personal fraud. This is especially true when their contact information is posted online, such as the “Find a Doctor,” “Find an expert” page on your company’s website. AT has seen attackers impersonate association staff to target board members for fraud, as well as attackers impersonating board members to target the general membership for fraud. 

Some of the impersonation methods used are difficult or impossible for IT to protect against. The only option to protect your members may be education: alert them to the problem, and provide Security Awareness Training for your board and member volunteers.