The COVID-19 pandemic has pushed real estate businesses, amongst many other industries, toward a model where an essential point of contact between a business and its consumers is online. These changes have resulted in the development of new websites, mobile apps, increased digital content and heavier online traffic. With this enhanced presence comes an enhanced exposure to cyber risk.
According to the 2022 Allianz Risk Barometer, an annual report identifying the top corporate risks for the next 12 months and beyond, cyber incidents top the barometer for only the second time in the survey’s history, with business interruption (BI) dropping to a close second. As the cost of data breach recovery rises each year, it’s hardly difficult to recognize the cost benefits of protecting a business from cyber risks by properly training staff and enforcing up-to-date best practices for cybersecurity.
When addressing concerns about your operation’s online safety, the first step is to acknowledge the existing cybersecurity risks that expose an organization to a hacker’s malicious attacks. Some of the most common cyber risks and threats for businesses are:
Malware: Malware is malicious software that cybercriminals insert into a company’s web pages or web files after they’ve penetrated the business’s site. They then use malware to steal sensitive data, including customers’ personal information. Malware can also redirect a company’s web pages to other sites and insert pop-up ads onto a company’s web pages or website. Common malware examples are viruses, trojan viruses, ransomware and spyware. Recent malware attacks have exfiltrated data in mass amounts. Removing malware requires constant network scanning so that hackers can be identified quickly, and malware can be removed from the company’s network.
Ransomware: Ransomware is malicious software that gains access to sensitive information within a system, encrypts the information so the user cannot access it and then demands a financial payout to release the data. The first step in a ransomware attack is infection, which occurs when a user visits a security-compromised website. Ransomware is typically part of a phishing scam; by clicking a disguised link, the user downloads the ransomware. Ransomware infections are specifically focused on users with higher levels of permissions, such as administrators, to inject malicious code.
Once the code has been delivered and executed on a system, either locker ransomware shuts users out of a system or crypto ransomware encrypts data using advanced mathematical encryption keys. In almost every case, the user or owner of a targeted system will receive instructions on how to regain access. A ransom is clearly presented, along with preferred denomination and payment method and, sometimes, a deadline for payment.
Phishing: Phishing is a cybercrime in which a target is contacted by email, telephone or text message by someone posing as a legitimate institution to lure individuals into providing sensitive data such as banking and credit card details and passwords. The phished information is then used to access important accounts and can result in identity theft and financial information. Other forms of phishing include vishing or voice phishing, smishing or SMS phishing and whaling or email purportedly from one of a company’s senior figures.
Data breaches: A data breach exposes confidential, sensitive or protected information to an unauthorized person, who then views or shares the files in the data breach without permission. Individuals, businesses and governments can be at risk of a data breach and put others at risk if they are not protected. Data breaches happen most often because of weaknesses in technology or in user behavior and are not always caused by an outside hacker. Serious damage is possible if a hacker steals and sells personally identifiable information or corporate intellectual data for financial gain or to cause harm. Common vulnerabilities targeted in data breaches include weak and stolen credentials, compromised assets, payment card fraud, third-party access and the use of personal mobile devices in the workplace.
Best practices to avoid breaches include patching and updating software, employing high-grade encryption for sensitive data, upgrading devices when a manufacturer no longer supports software, enforcing “bring your own device” security policies and strong credentials, multi-factor authentication and educating employees on best security practices and ways to avoid socially engineered attacks.
Frank DeLucia
Hub International Northeast
Woodbury, NY
frank.delucia@hubinternational.com
212-338-2395
