As the holiday season approaches, many people are looking forward to spending time with family and friends. However, for business owners, this can also be a time of heightened risk for cyber attacks.
Examples of past holiday season-related cyberattacks include the REvil cyber gang targeting the software company, Kaseya, at the beginning of the July 4th holiday weekend.
This attack was particularly successful, resulting in more than 100,000 customer systems being infected with ransomware. As a result, Kaseya had to take its entire network offline for several days in order to clean up and restore all of its data. The same Russian-linked group first gained notoriety after launching an attack on JBS meat processor, extorting the company for $11 million.
Why are cybercriminals targeting businesses during the holidays? The contributing factors...
Increased Time Off
As federal holidays approach, many businesses and organizations may let their guard down when it comes to cyber security. With fewer staff around to detect and respond to attacks, cyber threat actors see this as an opportunity to launch targeted attacks against them.
Cybereason, a cybersecurity technology company, published a survey in which 89% of cybersecurity professionals at organizations surveyed expressed concern about a weekend or holiday ransomware attack. Even more concerning, only about half indicated they had the proper cyber security solutions in place to prevent an attack.
According to Lockton's 2021 HR Trends Survey, almost half (44%) of U.S. employers reported closing their doors for Christmas Eve in 2021, with 5% being closed Christmas through New Year's Day of 2022.
Employees may feel year-end fatigue due to the end of the calendar year and the end of an organization's fiscal year. This can lead to employees being less vigilant about cyber security, which can leave the organization vulnerable to cyber attacks.
Job Vacancies
According to the U.S. Bureau of Labor Statistics, as of the last business day of August 2022, there were more than 10 million job openings across the U.S. The great resignation and lack of employees in the workforce contribute to employees feeling overworked and can be especially risky during the holiday season when they may be less focused on their work and more susceptible to cyberattacks.
The holiday season can create a perfect storm of cyber vulnerabilities. For some businesses, such as retail, the influx of customers can lead to a higher chance of a cyberattack. Hackers may take advantage of the increase in online activity, such as online shopping, to launch attacks that would otherwise be easily spotted.
Poor Cybersecurity Hygiene
Many organizations rely on their internal IT departments to help combat cyber threats, but during the holiday season, when employees are often taking time off or working reduced hours, response times can be slow. This leaves businesses vulnerable to attack and can lead to costly data breaches.
One way for businesses to prevent costly cyberattacks during the holiday season is by partnering with a mature managed IT provider. Managed IT providers have the expertise and resources to help businesses quickly identify and respond to any cyber threat. In addition, managed IT providers can help businesses develop and enforce cybersecurity best practices, which can help reduce the risk of a data breach.
What Industries are the Biggest Targets for Cyberattacks?
Healthcare
According to Cybereason, the Healthcare sector is one of the most vulnerable industries for ransomware attacks and is least likely to have developed specific contingencies. It also has the largest potential for big payout.
For example, the FIN12 hacking group targets organizations with annual revenues of over $6 billion. A ransomware outbreak in the healthcare sector can restrict access to important medical records, appointment details, treatment notes, patient data, and other critical information, leading to the worst-case scenario for patients - death. Threat actors know this, and they know the organization will pay the ransom they're demanding.
Manufacturing
Cybereason ranks Manufacturing as the second least likely industry to have developed cybersecurity practices. The manufacturing industry is highly vulnerable to phishing and other cybersecurity vulnerabilities due to outdated systems and policies.
Retail
Financially motivated actors are well aware of the impact that ransomware attacks can have on retailers during the holiday season. By targeting retailers for ransomware attacks during this time of year, these actors know that the impact on the retailer's profitability will be significant. Ransomware can cause a retailer to experience downtime, which can lead to lost sales and revenue. In addition, a ransomware attack can also cause a retailer to incur costs associated with repairing or rebuilding its systems.
Hospitality
Recently, attackers have compromised the networks of several major hotel chains, exposing the information of hundreds of millions of guests. Attackers were able to gain access to the networks by infecting hotel employees’ computers with malware. This allowed them to steal sensitive data such as credit card numbers and passport information. Breaches like these can harm corporate reputations, disrupt operations and cause huge financial loss.
5 Ways to Keep Your Business Safe from Cyber Attacks During the Holiday Season
1. Educate your employees about phishing and other common attack vectors
Employees should be educated about the different types of attacks that may occur during the holiday season. This includes phishing attacks, where attackers send fake emails in an attempt to steal login credentials or other sensitive information. Employees should also be aware of social engineering attacks, which can involve tricking people into giving away sensitive information or installing malware on their devices.
Cyber simulations can be a great way to help employees prevent cyberattacks. They allow employees to practice identifying and responding to common attack vectors, such as phishing emails. This can help employees stay alert and recognize potential threats when they occur.
2. Install comprehensive security software and keep it up-to-date
Businesses and other organizations should make sure that they have comprehensive security software installed and that it is kept up-to-date. This will help protect them from a variety of cyberattacks, including ransomware attacks, phishing attacks, and social engineering attacks.
3. Back up your data regularly and store it in a secure location
The holiday season is a time when many businesses and organizations let their guard down. Cyberattackers take advantage of this by launching attacks that may be more costly than those launched during other times of the year.
One of the most important ways to protect your organization from these attacks is to back up your data regularly and store it in a secure off-site location or in the cloud. This way, if your systems are compromised, you will still have the data you need to continue operations.
Additionally, by having a solid backup plan in place, you can reduce the amount of damage that an attack may cause. So make sure to back up your data — it could save your business during the holiday season.
4. Restrict access to sensitive data to only authorized users
It is important for businesses to restrict access to sensitive data to only authorized users because if unauthorized users have access, they could potentially leak or steal the data. This could lead to financial losses for the business and could also jeopardize the privacy of the business's customers. By restricting access to sensitive data to only authorized users, businesses can help protect themselves from these risks.
5. Monitor your network for signs of unusual or malicious activity
Any business or organization, regardless of size or sector, is at risk for cyberattacks. But during the holiday season, when employees may be less vigilant, those risks can increase. That's why it's important for organizations to monitor their networks for signs of unusual or malicious activity.
One way to do this is by using security analytics tools to detect patterns that may suggest an attack is underway. These tools can help identify malicious traffic and suspicious activity, such as malware or unauthorized access attempts.
Another important step is to have a strong incident response plan in place. If an organization does experience a cyberattack, it's critical to have a plan for mitigating the damage and securing the network. This includes communicating with employees about what happened and what steps they need to take to protect themselves and the organization.
Conclusion
Businesses and other organizations should make sure that their employees are properly trained in security best practices. Additionally, they should install updates and patches as soon as they become available and use strong passwords and authentication methods.
By taking these steps, businesses can help reduce their risk of a costly cyberattack during the holidays. Partnering with a managed security service provider like Digital Boardwalk can help your business avoid cyberattacks by ensuring that your security measures are up-to-date, relevant, and effective. Contact us today to learn more about our services and how we can help protect your business from cyberattacks.
