The Russian battlefield has already extended beyond Ukraine and into the cyber realm. Now, with an increasing number of nations getting involved in the conflict, analysts and government agencies alike are warning about the increased potential for cyberattacks.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a “Shields Up” alert with advice for guarding against Russian cyber crimes. But in addition to this, the division of the U.S. Department of Homeland Security (DHS) provided tips for corporate leaders and CEOs who are especially concerned about Russian cybercrime.
CISA Shields Up Recommendations for CEOs and Corporate Leaders
CISA’s Shields Up recommendations focus on tips to protect against and respond to cyberattacks, but the agency also acknowledged that company leaders play a vital role by modeling best practices and guiding the organization’s approach to cybercrime.
For this reason, CISA included advice for CEOs and corporate leaders as they work toward “ensuring their organization adopts a heightened security posture” during the Russian and Ukrainian conflict.
Include Chief Information Security Officers (CISOs) in the Decision-Making Process — A CISO is typically well-versed on a company’s technology, related costs, security needs and operational impact. This means that a CISO may be well-positioned to advise and strategize in the event of a cyberattack.
CISA recommends that “senior management should empower CISOs by including them in the decision-making process for risk to the company and ensure that the entire organization understands that security investments are a top priority in the immediate term.” In addition, a CISO can be a valuable member of a company’s cyber crisis response team — a group that every business should establish, according to CISA’s broader Shields Up cybercrime recommendations.
Implement Lower Reporting Thresholds for Possible Cyber Crimes — Lowering the bar is rarely a good thing, but this is absolutely the case for the reporting of possible cyberattacks. In a high-risk environment, any and every suspicious incident should be addressed, documented and reported to CISA or the FBI.
Lower reporting thresholds within a company allow for quick action in the event that the suspicious event does pose a legitimate threat. When an incident is promptly reported to CISA or other authorities such as the FBI, these agencies can take action to prevent others from becoming a victim.
According to CISA, “Every organization should have documented thresholds for reporting potential cyber incidents to senior management and to the U.S. government. In this heightened threat environment, these thresholds should be significantly lower than normal. Senior management should establish an expectation that any indications of malicious cyber activity, even if blocked by security controls, should be reported…”
Expect and Plan for the Worst-Case Scenario — CISA noted that “the U.S. government does not have credible information regarding specific threats to the U.S. homeland.” But even so, they advise company leaders to assume that a threat exists and act accordingly.
CISA advised that “Senior management should ensure that exigent measures can be taken to protect your organization’s most critical assets in case of an intrusion, including disconnecting high-impact parts of the network if necessary.”
The latter measure of disconnecting portions of a company’s network may seem a bit extreme, but it alludes to the serious nature of the risk that CISA believes to exist.
Additional Tips to Prevent Cyberattacks and Cyber Crimes
Company leaders and CEOs have a highly-influential role as they model best practices and set the tone for an organization’s approach to cybersecurity. But nearly everyone within a company plays an active role to some degree. For this reason, it is prudent for business leaders to encourage measures that will minimize risk. After all, it may take a single weak password for a hacker to access a company’s most essential IT systems.
Consider these CISA best practice recommendations to improve “cyber hygiene” in a more general sense.
Use Strong Passwords and Multi-Factor Authentication — Strong passwords are essential, though they shouldn’t be your only defense. Whenever possible, use multi-factor authentication to guard against unauthorized access. Think of it as placing more than one lock on your door. A hacker would need more than just a password; they would need a code sent to your phone, a biometric such as a face ID or fingerprint, a code or link sent to your email, an authentication app code or a FIDO key. If your company has a custom enterprise software platform without multi-factor authentication, reach out to your developer to implement this measure on your platform.
Keep Your Software Updated — Cybercriminals will rapidly exploit holes, flaws and vulnerabilities. Once identified, these vulnerabilities represent easy pickings, so to speak. For this reason, prompt updates are critical for avoiding viruses / malware and preventing cyberattacks / hacks. These software updates should include website platforms, mobile apps, desktop software and operating systems. Whenever possible, activate automatic updates, especially on patches and so-called “security updates.”
Be a Cautious Clicker — According to CISA, more than 9 in 10 successful cyberattacks begin with a user clicking on a link in a phishing email or website. That’s actually empowering because it means you have control over whether or not you become a victim. Many cybersecurity experts recommend that users do not click an email link unless they recognize the sender. Similarly, it’s inadvisable to disclose personal or sensitive information online unless you have initiated the contact (and even then, a cautious approach is prudent.)
If you suspect your organization has been a victim of a Russian cyberattack, you are encouraged to contact CISA to report the incident. CISA can be contacted 24 hours a day, 7 days a week via email at central@cisa.dhs.gov or by phone at 888-282-0870.
Developing a Secure Enterprise Software Platform from the Ground Up
Some company leaders may begin addressing the aforementioned cyberattack prevention tips only to realize their enterprise software is plagued by vulnerabilities and holes. Here at 7T, we have extensive experience developing enterprise software platforms with robust, military-grade security. We’re available to work with your business to understand your unique needs from an operational and security standpoint, crafting a custom enterprise software platform that meets your exact requirements. As an innovative Dallas software and mobile app development company, 7T offers collaborative, multi-phased software development services to clients in all business sectors.
7T maintains offices in Dallas, Houston, Chicago, and Austin, but our clientele spans the globe. If you’re ready to learn more about our digital transformation solutions, contact 7T today.
