Cybersecurity Guide for Businesses
Protect Computers and Networks
Install security and antivirus software that protects against malware, or malicious software, which can access a computer system without the owner’s consent for a variety of uses, including theft of information. Also, use a firewall program to prevent unauthorized access. Protection options vary, so find one that is right for the size and complexity of your business. Update the software, as appropriate, to keep it current. For example, set antivirus software to run a scan after each update. If you use a wireless (Wi-Fi) network, make sure it is secure and encrypted. Protect access to the router by using strong passwords.
Require Strong Authentication
Ensure that employees and other users connecting to your network use strong user IDs and passwords for computers, mobile devices, and online accounts by using combinations of upper- and lower-case letters, numbers, and symbols that are hard to guess and changed regularly. Consider implementing multifactor authentication that requires additional information beyond a password to gain access. Check with vendors that handle sensitive data to see if they offer multifactor authentication to access systems or accounts.
Control Access to Data
Control access to data and computers and create user accounts for each employee. Take measures to limit access or use of business computers to authorized individuals. Lock up laptops when not in use as they can be easily stolen or lost. Require each employee to have a separate user account and prohibit employees from sharing accounts. Only give employees access to the specific data systems they need to do their jobs, and don’t let them install software without permission. Also, make sure that only employees who need administrative privileges, such as IT staff and key personnel, have them and regularly review their ongoing need for access.
Teach Employees the Basics
Establish security practices and policies for employees, such as appropriate Internet usage guidelines, and set expectations and consequences for policy violations. Establish a top-down corporate culture that stresses the importance of strong cybersecurity, especially when it comes to handling and protecting customer information and other vital data. Ensure that all employees know how to identify and report potential security incidents.
Train Employees to be Careful Where They Connect to the Internet
Train employees to be careful where and how they connect to the Internet. Employees and third parties should only connect to your network using a trusted and secure connection. Public computers, such as at an Internet café, hotel business center, or public library, may not be secure. Also, your employees shouldn’t connect to your business’s network if they are unsure about the wireless connection they are using, as is the case with many free Wi-Fi networks at public “hotspots.” It can be relatively easy for cyber criminals to intercept the Internet traffic in these locations.
Train Employees About the Dangers of Suspicious E-mails
Employees need to be suspicious of unsolicited e-mails asking them to click on a link, open an attachment, or provide account information. It’s easy for cyber criminals to copy a reputable company’s or organization’s logo into a phishing e-mail. By complying with what appears to be a simple request, your employees may be installing malware on your network. The safest strategy is to ignore unsolicited requests, no matter how legitimate they appear.
Patch Software in a Timely Manner
Software vendors regularly provide patches or updates to their products to correct security flaws and improve functionality. A good practice is to download and install these software updates as soon as they are available. It may be most efficient to configure software to install such updates automatically.
Make Backup Copies of Important Systems and Data
Regularly backup the data from computers used by your business. Remember to apply the same security measures, such as encryption, to your backup data that you would apply to the original. In addition to automated backups, regularly backup sensitive business data to a storage device at a secondary location that is secure.
Don't Forget about Tablets and Smartphones
Mobile devices can be a source of security challenges, especially if they hold confidential information or can access your business’s network. If your employees connect their devices to the business’s network, require them to password protect their devices, encrypt their data, and install security apps to prevent criminals from accessing the device while it is connected to public networks. Be sure to develop and enforce reporting procedures for lost or stolen equipment.
Watch Out for Fraudulent Transactions and Bills
Scams can range from payments with a worthless check or a fake credit or debit card to fraudulent returns of merchandise. Be sure you have insurance to protect against risks. Additionally, ensure that you report any irregularities immediately.
A message from the Federal Deposit Insurance Corporation FDIC-019-2016
Cybersecurity Guide for Customers
Protect Your Computer
Install software that protects against malware, or malicious software, which can access a computer system without your consent to steal passwords or account numbers. Also, use a firewall program to prevent unauthorized access to your PC. While protection options vary, make sure the settings allow for automatic updates.
Security when Logging into Financial Accounts
Use the strongest authentication offered, especially for high-risk transactions. Use passwords that are difficult to guess and keep them secret. Create “strong” user IDs and passwords for your computers, mobile devices, and online accounts by using combinations of upper- and lower-case letters, numbers, and symbols that are hard to guess and then change them regularly. Although using the same password or PIN for several accounts can be tempting, doing so means a criminal who obtains one password or PIN can log in to other accounts.
Understand Internet Safety Features
You can have greater confidence that a website is authentic and that it encrypts (scrambles) your information during transmission if the web address starts with “https://.” Also, ensure that you are logged out of financial accounts when you complete your transactions or walk away from the computer. To learn about additional safety steps, review your web browser’s user instructions.
Be Suspicious of Unsolicited E-mails
Be suspicious of unsolicited e-mails asking you to click on a link, download an attachment, or provide account information. It’s easy for cyber criminals to copy the logo of a reputable company or organization into a phishing email. When responding to a simple request, you may be installing malware. Your safest strategy is to ignore unsolicited requests, no matter how legitimate or enticing they appear.
Be Careful Where You Connect to the Internet
Only access the Internet for banking or for other activities that involve personal information using your own laptop or mobile device through a known, trusted, and secure connection. A public computer, such as at a hotel business center or public library, and free Wi-Fi networks are not necessarily secure. It can be relatively easy for cyber criminals to intercept the Internet traffic in these locations.
Be Careful When Using Social Networking Sites
Cyber criminals use social networking sites to gather details about individuals, such as their place or date of birth, a pet’s name, their mother’s maiden name, and other information that can help them figure out passwords — or how to reset them. Don’t share your ‘page’ or access to your information with anyone you don’t know and trust. Cyber criminals may pretend to be your ‘friend’ to convince you to send money or divulge personal information.
A message from the Federal Deposit Insurance Corporation FDIC-018-2016
General Personally Identifiable Information
Personally identifiable information or (PII) can be any data that identifies you as a specific individual. This information should be kept private and not shared with others. Examples of PII include your Social Security Number, or your name in combination with your date or place of birth.
Recommendations: Be aware of what you post publicly or submit through applications or services. Consider with whom you share your PII, and give extra scrutiny and consideration as to whether you really need to share this information. If someone contacts you requesting PII through email, social media, or a phone call, do not provide the information. If it is a phone call that you think is legitimate, hang up and call the organization back through a publicly listed telephone number so you can verify the caller is who they say they are.
Information About Your Location
Giving out your location when away from home on social media is a privacy risk. This practice can result in your home being targeted for burglary. Additionally, your family and friends may be targeted by scammers seeking financial assistance on your behalf to help with a non-existent “travel emergency.” Three popular methods of this type of location sharing are geotagging (adding a location tag to a social media post or picture), posting a photo in which the background can be easily identified (like Times Square or the Eiffel tower), or “checking in” at a business.
Allowing apps to use your phone’s location services has its own privacy concerns, as the app is likely recording or using that data, and may automatically add geotagging to social media interactions in that app as a result!
Recommendations: Customize your location settings to minimize sharing your location with websites and applications, especially on your mobile devices. You can geotag social media posts, pictures, or videos after returning from vacation, going out to eat, or that business trip. Also, check the privacy settings of apps to make sure they don’t need access to your location. At a minimum, ensure your social media settings are set to only show your posts and profile to friends.
Security Questions & Social Media
Security questions are a way to authenticate your identity and are an extra layer of security on accounts, which makes it extra important to not post these answers on social media. Posting a picture or writing a post about your first car’s make and model, or color of your car, childhood address, favorite ice cream flavor, mother’s maiden name, or elementary school is a bad idea. These are common security questions and by posting this information, you give away the answers, allowing cybercriminals to potentially access your accounts.
Recommendations: When on social media, be aware of what you post (including pictures!) and how it relates to the security questions you selected for your various accounts.
Website/Application Privacy Settings and Permission
All websites and applications have privacy settings. These settings help you control what others are allowed to see, as well as manage your online experience. You should be familiar with these privacy settings and customize them to protect your information. Additionally, when creating an account on a website or application and agreeing to their services, understand what you are giving them permission to do with the data you provide.
Take Responsibility: Protecting your privacy starts with you. Website owners, websites, and service providers have a responsibility to protect your privacy. However, it is up to you to understand the privacy settings on social media, online accounts, and your devices. Knowing these settings, you will be able to customize them for greater security.
Take ownership of your privacy and read privacy policies and end user license agreements on websites (including social media), and update your settings whenever new privacy features are available.
A message from MS-ISAC January 2019 Volume 14, Issue 1
Internet Devices & Safe Online Banking
Online banking and remote access to financial accounts is part of daily life now — with connections through internet devices such as smartphones, laptops, readers, tablets or desktops — account information is a click away.
These same devices are used to connect to many other things; like baby monitors, TVs, healthcare data, doorbell cameras, news & information, refrigerators and other household items. And, frequently they are interconnected by a home network that shares all this information and allows internet access.
Without proper security for each device, your personal information is at risk.
➤ Secure All Your Internet Devices
There are several software security packages that offer protection for all your interconnected internet devices including your wireless router. Here are the first steps that are essential to an integrated approach to secure your internet devices.
Passcodes and Passwords:
Internet device suppliers allow you to reset passcodes or passwords. The strongest passwords use a combination of letters (upper and lower case), numbers and symbols and should be at least 10 characters in length to provide the best protection. Importantly, each of your devices requires a separate password — that way if one device is lost, stolen or compromised then not all are affected.
KEY POINT – Never allow your passwords to be remembered by your browser software!
Purchase and install software that detects, prevents and removes all viruses, malware or spyware found on your internet devices. Many manufacturers offer an entire suite of anti-virus security software to protect all your devices. Just remember that different internet devices have different operating systems — one security solution may not protect all your devices.
KEY POINT – Each device requires specific security software protection!
Manufacturers of internet devices update their software constantly to provide faster service and more secure products. Some of these software updates provide a needed fix for security weaknesses — so sign up with the software manufacturer to receive any updates automatically and install them on a regular basis.
KEY POINT – Software updates provide the best defense against online threats!
Your home network connects to the internet using a router that comes with a default user ID and a pre-set password from the manufacturer. Reset the manufacturer settings for both immediately. The router ID renamed by you and a strong password are essential protections for a home router. Choose the highest level of security available for your router and activate it. Also, enable the preinstalled firewall protection hardware for added safety.
KEY POINT – The router serves as the pathway to the internet for all your devices!
➤ Device Use and Best Practices
Security experts have developed best practices for everyone to follow when using any internet device.
- Wi-Fi hotspots that are public and shared by many users are not secure.
- Always log off by following the financial institution’s secured area exit procedures.
- Back up your data regularly to your personal cloud storage account or external hard-drive.
- All your internet devices should auto lock with a short time period.
- When not in use shutdown or turn off your devices.
- Enable each device to have your data erased or wiped remotely.
➤ More Connections and More Things Are Coming
The ability to conduct safe online banking, purchase things and remotely access, monitor and control home appliances through internet devices offers great convenience for everyone.
In the coming years experts predict rapid growth in the number of interconnected things — doubling by 2020. Make internet device security your number one priority!
- Stopthinkconnect.org ■ Federal Trade Commission: www.ftc.gov
- Identity Theft Resource Center: www.idtheftcenter.org
- Federal Deposit Insurance Corporation: www.fdic.gov
- National Credit Union Administration: www.ncua.gov
- On Guard Online: www.onguardonline.gov
- Financial Fraud Enforcement Task Force: www.stopfraud.gov
Financial Education Corporation