Target, the IRS, Anthem BlueCross/BlueShield, Yahoo, and Ebay; these are just a few of the biggest data breaches over the past five years. When a person hears about a data breach in 2018, it is human nature to envision an IT Scientist cracking the code of an in-depth system of cyber security. Sometimes this is the source of a cyber attack, but many of the largest data breaches in history were started by something not highly technical. Here are some Examples of Cyber Attacks and how they begun.
General Manager of a Professional Baseball Team uses a Weak Password
This actually happened between the Houston Astros and the St. Louis Cardinals when the Astros General Manager used the same user name and password in Houston that he had previously used when he worked in the Cardinals Front Office. Some employees from the St. Louis Cardinals Organization used this information to log in to the internal computer systems of the Houston Astros and obtained access to a database known as Ground Control, which was created by Luhnow. This database included details about confidential discussions within the Astros organization, player evaluations, trade recommendations, statistical information and more.
High-level Industry Executive uses the same password for all accounts
Many high level industry executives have extensive experience and expertise in their particular profession, but have only used computers for some or a small portion of their career. Many high level execs deal with interpersonal relationships between departments, partners and even competitors much more than the day to day operations of a business. For this reason they may not be as in tune with the risks a business faces in the realm of cyber security. These execs also have access to some of the most precious information a business may possess. This makes them prime targets for cyber attacks. In many industries there are many computer programs that require these execs to remember many different usernames and passwords. When you pair these accounts with all of the accounts these people have to use in their personal life, it is human nature to use the same password for multiple platforms. This makes it easy for hackers to find their password from one platform and use it to gain access to a bigger platform with more valuable sensitive information.
Salesman is travelling across country and has their laptop stolen in an airport
A few of the most common examples of cyber attacks are when an employee has a laptop stolen when they are away from the office. Depending upon the information saved on the device, it can be the source a hacker uses to start a data breach. Several data breaches have started when an employees laptop was stolen when their car was broken into and another occurrence happened at an airport while travelling for business. Bringing this to the attention of your employees when they use devices remotely will go a long way towards protecting your business.
Employee leaves the password to his computer on a post-it note attached to his desk
Leaving out a password in plain view can be a common way someone gains access to internal servers. Most offices have commercial cleaning companies in the facility after hours with little to know supervision. The people who work for these third party companies may or may not be ethical. Regardless it is imperative to not give them the opportunity to gain access to your internal computer systems. Many banks do monthly walk-throughs on unannounced days to find if employees are leaving sensitive information out on their desk. Depending upon the type of information your organization works with, this might be necessary for your business.
An employee clicks on an email that is actually a phishing scam
Phishing scams are a very common way for hackers to either install something malicious on one of your businesses computers or gain access to your internal servers. A phishing scam is when a hacker sends an email that looks legitimate asking the receiver to click on something within the email. Many of the emails look very authentic. There are businesses out there that can help you send out test emails to prepare your employees for a phishing scam. The company will send out an email periodically to see who will fall for the request. If the employee clicks on the link you are notified and you can go through additional training with that employee.