A dreaded issues an IT team has to deal with is that of ransomeware. However, PETER ALEXANDER, CMO, Check Point, offers five tips on how to avoid it.
It’s the call that IT teams dread: an employee is reporting that their PC screen is flashing red, with a message telling them that their files are encrypted and that they need to pay a ransom to get them unscrambled. What should they do next?
The actions that the organisation takes over the next few minutes, and hours, will be critical in determining just how big – or small – an impact the cyberattack will have. What’s more, a cyberattack does not only negatively impact the company’s physical IT systems: it also causes stress and puts employees under pressure too.
A recent paper from the University of Haifa found that cyberattacks have a strong psychological impact on all staff, increasing their levels of anxiety, stress and panic – which can then lead to mistakes being made, and in turn further damage.
So how should organisations go about eliminating these human, panicky and emotional reactions to cyber incidents, and develop a more coordinated, conditioned response?
Training is never in vain
A key example is the rigorous training that airline pilots are given in dealing with unexpected events: they are provided with extensive checklists and procedures that cover virtually every eventuality, from running out of fuel, to engine failure, to structural damage. And those procedures are practiced again and again, both in simulators and in flight conditions, so that in a real-time emergency situation, their response becomes an automatic reflex action. The result is that when an incident happens, the first thing the pilot and co-pilot will do is turn off the warning alarm, so that they can think clearly and start running through the appropriate checklist.
Enterprises need to undertake similar, rigorous planning to help them respond quickly and accurately to breaches or attacks. They should prepare an incident response (IR) plan, and assemble an IR team that includes all relevant internal stakeholders – such as IT and security specialists, HR and PR teams, plus in some cases, specialist external resources. Also, preparation alone isn’t enough: the execution of the plan needs to be practiced, through realistic training drills.
To help organisations develop faster, more effective responses, here are five key steps that they should follow, whether in a training exercise or in the wake of a genuine incident.
- Recognize the incident is happening
The critical first step is for staff to take the attack seriously and move swiftly, but without panic. Think of the ideal response to a fire alarm in an office building: everyone should immediately stop what they are doing and make their way to the exits without pausing to gather their possessions or empty their desks. A cyber incident should be granted the same instant attention and focus. As soon as it is identified, all staff need to be alerted, smoothly and efficiently, and given clear, calm instructions as to what to do next, whether that is simply stepping away from their desks, or shutting down their PCs or devices.
- Gather the resources you need
This means mobilizing the security tools and technology, as well as the trained staff which make up your organization’s security infrastructure, and getting them to focus on mitigating the incident. Clearly, not all staff will need to be involved in this stage, so it’s all about pulling together the right experience and expertise – fast. Your IR plan should set out which personnel need to be involved, and if any external security resources are to be used.
Of course, assembling the combination of tools and talent isn’t cheap. But the investment and time required to build effective defenses is dwarfed by the real-world costs of cyberattacks, in terms of remediation of immediate damage and subsequent fallout. The NotPetya ransomware attack of summer 2017 was estimated to have cost global logistics firm FedEx $300M in lost revenue and clean-up costs, and pharmaceutical giant Merck & Co stated that NotPetya cost it around $135M. So with companies on average experiencing two cyberattacks per week which breach their defenses, it’s clear that it’s far better to invest in preventing attacks, than to pay the far higher costs for a cure after the fact.
- Execute your IR plan
This is the active stage, in which you should work through your IR plan step by step to determine what the nature of the attack is, how it breached your defenses, how it can be isolated, and how the damage can be remediated. For organisations that do not have an IR plan to hand, it may be best to call in external specialist help at this stage: but for the future, here’s a checklist of what the plan should include, and important do’s and don’ts to follow when preparing a plan for your organisation.
Too often, organisations stop at stage three. But communication regarding the attack is vital – not only to all your internal stakeholders and employees, but also where necessary to external stakeholders such as partners, customers and investors. This is becoming a regulatory requirement. All stakeholders, both inside and outside your organisation, need to understand what has happened and what the implications are for them – in language pitched at their level of technical understanding.
This is a specialist stage, which should be left in the hands of your communications team. The recent revelations about Uber’s 2016 cyberbreach and the subsequent cover-up are a lesson in how not to communicate – and the consequences that might follow.
Once again, this is a truly crucial element of IR that is too often neglected. Every cyberattack should generate serious lessons for the organisation in question. After an attack active steps should be taken to repair the vulnerability, modify and improve the exploited process, retrain any staff that may have made a mistake, and put in place, or update the existing IR plan. Inability to learn from and take steps to improve cyber protection after suffering an attack leaves the organisation vulnerable to a similar attack occurring again.
Effective incident response is about training and practice. Developing an IR plan and keeping it updated involves work and investment – but during a cyberattack, that investment will pay dividends. Whether you decide to handle your IR internally or draw on external expertise, it’s important to make a plan now, and test it against possible attack scenarios. This will help to eliminate panic during an attack, limit the damage and fall-out from the incident and get your business ‘back to normal’ as fast as possible.
Tech promotes connections across groups in emerging markets
Digital technology users say they more regularly interact with people from diverse backgrounds
Smartphone users – especially those who use social media – say they are more regularly exposed to people who have different backgrounds. They are also more connected with friends they don’t see in person, a Pew Research Center survey of adults in 11 emerging economies finds.
South Africa, included in the study, has among the most consistent levels of connection across age groups and education levels and in terms of cross-cultural connections. This suggests both that smartphones have had a greater democratisation impact in South Africa, but also that the country is more geared to diversity than most others. Of 11 countries surveyed, it has the second-lowest spread between those using smartphones and those not using them in terms of exposure to other religious groups.
Across every country surveyed, those who use smartphones are more likely than those who use less sophisticated phones or no phones at all to regularly interact with people from different religious groups. In most countries, people with smartphones also tend to be more likely to interact regularly with people from different political parties, income levels and racial or ethnic backgrounds.
The Center’s new report is the third in a series exploring digital connectivity among populations in emerging economies based on nationally representative surveys of adults in Colombia, India, Jordan, Kenya, Lebanon, Mexico, the Philippines, Tunisia, South Africa, Venezuela and Vietnam. Earlier reports examined attitudes toward misinformation and mobile technology’s social impact.
The survey finds that smartphone and social media use are intertwined: A median of 91% of smartphone users in these countries also use social media or messaging apps, while a median of 81% of social media users say they own or share a smartphone. And, as with smartphone users, social media and messaging app users stand apart from non-users in how often they interact with people who are different from them. For example, 52% of Mexican social media users say they regularly interact with people of a different income level, compared with 28% of non-users.
These results do not show with certainty that smartphones or social media are the cause of people feeling like they have more diverse networks. For example, those who have resources to buy and maintain a smartphone are likely to differ in many key ways from those who don’t, and it could be that some combination of those differences drives this phenomenon. Still, statistical modelling indicates that smartphone and social media use are independent predictors of greater social network diversity when other factors such as age, education and sex are held constant.
Other key findings in the report include:
- Mobile phones and social media are broadening people’s social networks. More than half in most countries say they see in person only about half or fewer of the people they call or text. Mobile phones are also allowing many to stay in touch with people who live far away: A median of 93% of mobile phone users across the 11 countries surveyed say their phones have mostly helped them keep in touch with those who are far-flung. When it comes to social media, large shares report relationships with “friends” online who are distinct from those they see in person. A median of 46% of Facebook users across the 11 countries report seeing few or none of their Facebook friends in person regularly, compared with a median of 31% of Facebook users who often see most or all of their Facebook friends in person.
- Social activities and information seeking on subjects like health and education top the list of mobile activities. The survey asked mobile phone users about 10 different activities they might do on their mobile phones – activities that are social, information-seeking or commercial in nature. Among the most commonly reported activities are casual, social activities. For example, a median of 82% of mobile phone users in the 11 countries surveyed say they used their phone over the past year to send text messages and a median of 69% of users say they took pictures or videos. Many mobile phone users are also using their phones to find new information. For example, a median of 61% of mobile phone users say they used their phones over the past year to look up information about health and medicine for themselves or their families. This is more than the proportion that reports using their phones to get news and information about politics (median of 47%) or to look up information about government services (37%). Additionally, around half or more of mobile phone users in nearly all countries report having used their phones over the past 12 months to learn something important for work or school.
- Digital divides emerge in the new mobile-social environment. People with smartphones and social media – as well as younger people, those with higher levels of education, and men – are in some ways reaping more benefits than others, potentially contributing to digital divides.
- People with smartphones are much more likely to engage in activities on their phones than people with less sophisticated devices – even if the activity itself is quite simple. For example, people with smartphones are more likely than those with feature or basic phones to send text messages in each of the 11 countries surveyed, even though the activity is technically feasible from all mobile phones. Those who have smartphones are also much more likely to look up information for their households, including about health and government services.
- There are also major differences in mobile usage by age and education level in how their devices are – or are not – broadening their horizons. Younger people are more likely to use their phones for nearly all activities asked about, whether those activities are social, information-seeking or commercial. Phone users with higher levels of education are also more likely to do most activities on their phones and to interact with those who are different from them regularly than those with lower levels of education.
- Gender, too, plays a role in what people do with their devices and how they are exposed to different people and information. Men are more likely than women to say they encounter people who are different from them, whether in terms of race, politics, religion or income. And men tend to be more likely to look up information about government services and to obtain political news and information.
These findings are drawn from a Pew Research Center survey conducted among 28,122 adults in 11 countries from Sept. 7 to Dec. 7, 2018. In addition to the survey, the Center conducted focus groups with participants in Kenya, Mexico, the Philippines and Tunisia in March 2018, and their comments are included throughout the report.
Nokia to be first with Android 10
Nokia is likely to be the first smartphone brand to roll out Android 10, after its manufacturer, HMD Global, announced that the Android 10 software upgrade would start in the fourth quarter of 2019.
Previously named Android Q, it was given the number after Google announced it was ditching sweet and dessert names due to confusion in different languages. Android 10 is due for release at the end of the year.
Juho Sarvikas, chief product officer of HMD Global said: “With a proven track record in delivering software updates fast, Nokia smartphones were the first whole portfolio to benefit from a 2-letter upgrade from Android Nougat to Android Oreo and then Android Pie. We were the fastest manufacturer to upgrade from Android Oreo to Android Pie across the range.
“With today’s roll out plan we look set to do it even faster for Android Pie to Android 10 upgrades. We are the only manufacturer 100% committed to having the latest Android across the entire portfolio.”
HMD Global has given a guarantee that Nokia smartphone owners benefit from two years of OS upgrades and 3 years of security updates.