"Cybercrime has been rising for decades, but the pandemic and remote users working from home have created the perfect storm for criminal hacking."
Brent Panell, CCFE, CMFE, CISO, is the co-founder and chief executive officer of ControlAltProtect, LLC.
The Forensic Cyber Firm of credentialed industry-leading cyber engineers is based in Birmingham. Their team is highly trained in detecting the latest cyber attack methods.
"We have helped corporations across the world recover from cyber attacks, and plenty of them are based here in Alabama," Panell said.
Chief technology officer Hans Lemons said the one crucial security layer 90% of companies lack is email phishing detection and remediation.
"This is a must layer given that over 90% of cyber attacks begin with a phishing email," Lemons said. "Trusting the existing email platform to keep a company safe results in breaches.
"And that's not all: the attacks are malware and ransomware too. We've also worked closely with identity theft victims to sterilize their digital lives. Cyber attacks destroy company reputations, futures, and victims' lives. Show me a person who's fallen victim, and usually, they are not invested in data security. No safety belt and hitting the windshield prompts victims to invest in cyber security and buckle up, so to speak."
When asked about the three things all post-breach hacking victims have in common, Lemons was quick to answer:
1. "' I never thought I would be a victim of cybercrime until I was a victim.' Studies show that most people just don't believe they will ever be targeted. The exact opposite is true for all Americans.
2."' I didn't think anyone wanted my information.' Most people underestimate the value of personal data on the Dark Web. All personal information has value to criminal hackers.
3."' I thought my IT guy had me protected.' IT professionals are awesome at their professions … but they are not skilled, trained, or experienced at stopping cyber attacks. You don't ask an internal specialist to analyze your heart."
All of this begs the question: who wants to tap into Alabama, and why?
"Russia and China account for at least 60% of the attacks on small- to mid-cap American companies," said Lemons. "Alabama has been blessed with growth in manufacturing, space expansions in Huntsville, among many others. So, we are primary targets given the lack of data security among our businesses."
Panell said criminals want to steal a lot from companies, including proprietary information, access to use their emails to conduct nefarious acts, socials, addresses, access to servers and more.
"Hackers are looking to either steal data, ransom the business, or both," Pannell explained. "And this can shut down a business for a substantial amount of time. Hackers often use small to mid-size companies in order to attack larger ones. We commonly see the biggest customer of a small firm being the reason the small firm was attacked in the first place. Hackers find the path of least resistance, and 'trusted vendors' are easy targets. Unfortunately, the lack of data security by the small firm often results in the larger company's cyber liability carrier suing them for negligence. The digital forensic trail proves who clicked and who's responsible for infecting others. Without a security team or consultant to safeguard your business, it's a dangerous gamble."
"We've seen companies shut down for months due to cyber attacks," Lemons said. "Hackers get footholds in as many places as possible. In many cases we've worked, the IT teams successfully identify 80 - 90% of the footholds following the attack, but the hackers come storming back weeks or months later. Stronger, better, and demanding more money to un-encrypt the ransomed data."
Lemons said a recent case involved a prominent CPA firm that had cyber concerns.
"Upon investigation, a Chinese APT hacking group was exfiltrating data from the firm in real-time," Lemons said. "The email tenant was completely compromised. The hackers were using the firm to target several high-profile clients of the tax firm and ramping efforts to infect backup files. The next step was ransomware, as we discovered many backup files were already infected upon arrival. We stepped in, remediated, and saved this client and several of their customers."
According to Panell, most states do not publish statics related to cyber breaches.
"It's difficult to accurately measure breach stats within any state, to be frank," Panell said. "The fact is, cyber insurance carriers who pay claims and the FBI's IC3 divisions who work high profile cases and support cries for help from cyber victims are swamped.
"Bottom line, our stats are very bad. The Southeast US is heavily targeted as the vast majority of companies simply do not invest in data security. We were one of the last states to create a Breach Notification Act requiring that businesses report known breaches."
Lemons added that potentially, all Alabama businesses are under attack.
"There are two types of companies: those that know they've been hacked and those who don't," Lemons said. "Failed attack attempts are commonly blocked by everyday products like Microsoft's Office 365 email, firewalls, intrusion detection, anti-virus, etc. Attacks are happening by the thousands each second. The important fact [is] hackers are getting better and better and avoiding detection. The days of having a firewall, a cyber policy, and a competent IT guy protecting you have come and gone."
If you operate or own a company, you should know there are certain industries that are hot right now.
"Financial, Medical, and CPAs are some of the most targeted," Lemonds added. "However, we often see all types. Company A in the manufacturing sector or simply a mom-and-pop company is used to target a CPA firm, a hospital or a dentist. Hackers will take anything you give them and use it to gain more access, cause more damage and ultimately get paid."
Panell said they have no desire to instill fear, but their goal as a company is to educate the general public on the true threats they face daily.
"We've become synonymous with the ability to detect and stop cyber hackers," Panell said. "We see the latest attack techniques and deal with the victims. What we see is concerning as most business owners and leaders simply don't realize the risks and trust the wrong professionals to keep them safe."
The monetary damage annually caused by cyber criminals is massive. It can cost an American company up to $1.24 million.
Panell suggests following safe email guidelines.
"Don't open emails from senders you don't know," he said. "Educate yourself on cybercrime tactics. Slow down when opening emails and ask yourself if the email content looks suspicious. When in doubt, don't click. Employers should invest in quality training programs and not just video training sessions. On-site tabletop training sessions are the most impactful."
Another helpful tip: Panell said to change your passwords every 30 to 45 days and use multi-factor authentication. There are also affordable and even free cyber security assessment options, such as ControlAltProtect.
To connect with the author of this story, or to comment, email news@1819news.com.
Don't miss out! Subscribe to our newsletter and get our top stories every weekday morning.
