It takes enough time and effort to become an expert in one area and succeed with a business in that field. If that field is something other than tech, then you shouldn’t expect yourself to know how to protect yourself from the threats that are out there. You’ll need to consult with an IT expert to make your business less vulnerable.

Raffi Jamgotchian is one such expert that can help you out. He was the director of IT Infrastructure at INVESCO in New York, a mid-tier investment firm with $400 billion in assets under management. After that, he served as CIO for Canaras Capital Management, a boutique investment firm. This gave him the experience he needed to succeed with his own venture, Triada Networks, an IT Solutions firm that caters to boutique investment firms.

Why should you care about security?

There is one big reason why you should care: money. A major security breach will not only wreck your reputation, it will also wreck your wallet. Allow Jamgotchian to put into perspective just how much money is at stake:

“The Ponemon Institute estimates that you lose $194 for every customer record that is lost. If you have a hundred clients, that’s $19,400. If you have a thousand clients, that’s $194,000. If you lose a single laptop that only costs you a couple hundred dollars to purchase, it could end up costing your business thousands.”

Did that catch your attention? A hundred thousand dollars has a way of doing that… what’s even more glaring is how little businesses are doing to protect themselves from an attack.

American Express ran a study that revealed just how vulnerable many small businesses are. They found that:

• 25% aren’t using antivirus, or it they are, many are out of date or ineffective
• 60% don’t protect their wireless networks at the office
• 66% don’t have a security plan in place
• Less than 6% of security breaches are ever discovered
• 50% of businesses that are hacked go out of business within 3 years

What is the threat landscape?

Alright, so we’ve established that you there are indeed threats out there, and if you are attacked it will cost you a lot of money. But you can’t really do anything with that information until you know what the threats actually are.

“Well, most modern threats are web-borne,” Jamgotchian explained. “2 million new viruses are identified every month according to McAfee. Attackers are targeting printers, thermostats, and other non-computing devices as an easy way to get into your network. 600,000 Facebook accounts are hacked a day.”

“Embedding malware in software and videos and later resorting to blackmail is also becoming commonplace. So even if your networks and computers may be relatively secure, what about the others in your employees’ homes?”

Jamgotchian then offered an anecdote to illustrate how a hack can come from an indirect angle:

“One business owner’s son was surfing, let’s say, things that he wouldn’t want his family to know about. The son’s computer was infected and after some online chats, he blackmailed him to install a malicious USB stick to his dad’s computer. He did it, his father’s business information was stolen.”

But not all threats are web-borne…

“Thumb drives or USB sticks can hold quite a bit of data. 50% of people who found a thumb drive in their work parking lot walk into their office and plug it in, and that number goes up to 80% if the USB thumb drive has the company’s logo on it. This is how the Stuxnet worm was introduced to the Iranian Nuclear facility.”

For anyone who missed that bit of news a year ago, the United States and Israel, both concerned about Iran’s budding nuclear capabilities, teamed up and created a computer worm called Stuxnet. They managed to infect a worker’s USB drive and get it plugged into Iran’s Natanz nuclear facilities. Stuxnet destroyed somewhere between 800 to 1,000 centrifuges there.

Hackers targeting your company aren’t likely to be as sophisticated as the techies working for the United States government, but your company isn’t likely to have the level of defense a nuclear facility would have, either. While you should be focusing on web-borne attacks, don’t forget to also enforce a security policy on thumb drives.

Jamgotchian also calls to our attention that many attacks come from foreign sources:

“One company from the Ukraine made both of these kinds of fake pop-ups and anti-virus applications, and also the software that cleans them. They made $500 million in three years, had a viable company, employees, and even had company outings and paid dividends.”

“China is the single largest source of hacking attempts currently… The People’s Liberation Army Unit 61398 was found by the Mandiant Threat Report to have hacked over 141 different companies in 20 industries. They’ve stolen terabytes of data… focusing on companies in English-speaking countries.”

“They maintain access to victims for an average of one year; the longest was nearly five years. They have between a couple dozen and several hundred operators at any given time. They even have job listings in China for open positions. Their stolen items include product development information, manufacturing processes, business plans, policy positions, meeting agendas, emails of high-ranking employees, and, of course, usernames and passwords”

What can you do about these threats?

Maybe you think you’re fine if you have a firewall already. But you might want to think again, because having a simple firewall doesn’t mean that you’re getting the effective protection.

“Sorry, basic firewalls aren’t enough,” said Jamgotchian “Threats are constantly changing and increasing… entry-level firewalls can’t provide you the protection that you need.”

If there are so many ways to attack a server, and firewalls aren’t providing enough defense, what can you do to insure your business is protected?

“[You need] to enable secure wireless networks, securely connect branch offices, or enable road warriors… In regards to the changing threat landscape, the truth is, there is no silver bullet to stopping modern threats. Different techniques like antivirus, web filtering, application control, and web application firewalls are all effective at combating different attack factors. A comprehensive solution is necessary to provide an effective defense.”

There you have it: as with most questions in life, the answer to the security problem is more nuanced and complex than it is simple and direct. You’ll need a different defense for each specific threat, and also keep yourself posted on new hacking methods and how to respond to them.

Stay ahead of the constant evolution of the cybercrime industry with the proactive security solutions of Triada Networks. Contact us at (201) 297-7778 or info@triadanet.com to schedule a vulnerability assessment to ensure there are no nasty surprises lurking in the depths of your network, waiting to ruin your budget and your reputation.