“If you were a criminal hacker looking to exploit a company – inflicting the irreparable harm of a data breach – what’s the first thing you would do?” My short and easy answer: scour LinkedIn. LinkedIn is a treasure trove of easily accessible personal information and company IT data. Unbeknownst to most of the employees who post their information on LinkedIn, any hacker looking to wreak havoc on a company’s highly sensitive, business-critical data could find his or her point of entry using this ubiquitous business networking forum.
Why is LinkedIn So Attractive to Hackers?
Here’s a look at LinkedIn through a hacker’s eyes. Conducting a search for a specific organization on LinkedIn will turn up any number of professionals’ profiles, some of which will include the person’s business e-mail address. Once a hacker has seen a few e-mail addresses for the same company, he’s learned the company’s e-mail address structure (e.g. firstname.lastname@companyname.com ) and can build an e-mail list of employees to target. In fact, hackers can successfully guess 50 to 60 percent of all employee email addresses using this method.
Next, the hacker will formulate a phishing or social engineering plan. Using his knowledge of your firm’s IT platforms, his scheme could take the form of an e-mail that directs his unsuspecting victims to a webpage requiring them to enter their username and password credentials, for example.
The hacker will avoid including IT staffers on his distribution list, as that’s too likely to raise red flags. But customer service, accounting, marketing, and human resources personnel make much more attractive targets. The hacker will create urgency and emotion with his request. And, finally, he’ll send out his bait, hook his targets and voilá: he’s gained a foothold, the first step to getting the access he needs to breach the network and steal valuable credit-card, social-security or other data stores. A company’s worst nightmare has just begun.
As a penetration tester, my best efforts result in me finding a vulnerability like this, and helping companies close this security gap before real hackers find their way through. The scariest part of this scenario is that any company with more than 100 employees is at risk for this kind of stealth attack from an ill-intentioned hacker who has made LinkedIn his or her best friend.
What’s a Business to Do?
So, now that you know why LinkedIn has unwittingly become a hacker’s BFF, what’s a business to do? Companies have competing priorities when it comes to social media and LinkedIn in particular. They want their employees out there promoting the company, recruiting new customers and talent and driving up online visibility. But they also have a driving need to protect their data—especially in regulated industries where a data breach could cost them not only reputation points and customer loyalty, but also countless dollars in fines.
As far as anyone can tell, however. LinkedIn is here to stay. Smart companies will accept this fact, and quickly and effectively find the balance between freedom and security. Employees will continue to post personal data on LinkedIn, but their companies in turn will need to prevent that superficial information from becoming a hacker’s key to their business-critical data stores.
Here are three things your firm can do to protect your business-critical data:
1. Invest in good, frequent social engineering training. Just because hackers can guess your employees’ e-mail addresses doesn’t mean your people should fall for their schemes and provide their login or other information. A strong social engineering training program can help your employees learn to recognize and resist a phishing scam. And one-and-done is not the way to go here; frequent reminders and follow-up training can help keep employees vigilant.
2. Develop a statement that clearly tells employees how your company will handle network security information. For example, “We will never ask for your username and password,” or “All network-related communications will come only from this specific e-mail address.” This statement should be well known to all of your people and can prevent employees from sharing usernames and passwords with parties who have malicious intent.
3. Have a clear reporting process for suspicious activity. Make sure employees know how to report social engineering schemes and suspicious e-mails. Keep it simple, maybe with a catch phrase, for example, like “See something? Say something.” Wallet cards or another physical reference might be a good idea here—anything that makes it easy to recognize a potential hacker and report suspicious activity before it becomes a full-blown network attack.
Hi. I’m Designer of Blog Magic. I’m CEO/Founder of ThemeXpose. I’m Creative Art Director, Web Designer, UI/UX Designer, Interaction Designer, Industrial Designer, Web Developer, Business Enthusiast, StartUp Enthusiast, Speaker, Writer and Photographer. Inspired to make things looks better.
0 comments:
Post a Comment