NLB Blog

Of all of the major cyber threats to businesses and individuals, phishing is the most common. Recent studies indicate that 65 percent of U.S. organizations experienced a successful phishing attack in 2019, and 22 percent of data breaches began with phishing campaigns. 

“In its simplest form, phishing is the practice of sending a link via email or text or embedding a link on a website that, when clicked, downloads malware onto the user’s device as well as any other devices that are connected to the same network,” says CyberScout founder and chairman Adam Levin.

Regardless of the industry or sector, ransomware is the cybersecurity threat that has consistently made the most headlines over the last five years, and with good reason. As a vector of attack, it has brought multinational corporations to a screeching halt, shut down local governments, caused school closures, and has led to at least one death by disrupting medical services.  “While the sophistication and methods of attack may vary, the short answer is that ransomware is a type of malware that encrypts critical data on a computer or computer network so that users can’t regain access without paying a ransom,” says CyberScout founder and chairman Adam Levin

October is National Cybersecurity Awareness Month (NCSAM). This year’s theme is “Do Your Part, Be Cyber Smart.” While the knowledge of cybersecurity best practices and data hygiene has increased during the seventeen years since the first NCSAM, the threats posed by hackers and other bad actors has increased too. 

While there are risks associated with remote work, the odds of a malware attack increase when more family members use the same device, especially children.

“The malicious code children collect on their way to something you’ve never heard of can hijack your computer for all kinds of purposes. There are click-harvesting scams. There are stealth programs that will turn your machine into a spambot. There’s malware that looks OK to your anti-virus program, but is actually recording every keystroke, most particularly when you log into your bank account,” warns CyberScout founder and chairman Adam Levin. 

Many companies will offer identity fraud and theft protection services to customers who have had their data compromised in a breach, but relatively few provide it as a benefit to their employees—just 25 percent as of 2019. This approach ends up costing businesses in the long run, according to CyberScout founder and chairman Adam Levin. “If you don’t subscribe to an identity theft resolution service or lack a plan of action before you suffer a personal compromise, you will need to spend more time and more money than you are probably prepared to spend,” said Levin

“Domain names are far from the only vector of attack, but they're one of the most visible,” says CyberScout founder and chairman Adam Levin.

Although hackers can deploy a wide array of methods to hijack domain names, there are fortunately several ways businesses and organizations can protect against them

Typosquatting is perhaps the least sophisticated form of domain name hacking. It relies on user error, specifically the odds of a user mis-typing a URL address into their web browser. Hacker register a misspelled version of a well-known domain name, such as “gooogle.com” or “gooogl.com” rather than google.com. (Important: do not visit either “gooogle.com” or “gooogl.com”. They are dangerous).

Domain names are a foundational service of the Internet, and are controlled by a protocol called Domain Name System, or DNS. While the details are complicated, DNS ultimately serves a straightforward purpose: it helps route traffic on the internet using human-friendly names.

Everything connected to the internet, from smartphones and fitness trackers to enterprise-level email servers, has a unique identifying address called an IP address. Every activity on the internet, from checking email to web browsing to posting to Instagram is a means of connecting a request from one IP address to its destination IP address. 

Your company’s online presence relies on a domain name. That domain name is registered, and you would think as a result that it would be hard for a criminal to steal, but that’s not the case. Domain name compromise makes possible a wide array of attacks--including the introduction of ransomware and other extinction-level exploits.

While no business can make themselves a hundred percent cybersecure, understanding not only the way domain names work, but also how they can be leveraged by hackers is mission critical when it comes to avoiding common security pitfalls. 

We’re not even halfway through 2020, and already it’s been a record-breaking year for ransomware attacks. Barely a week goes by without reports of a new strain or variant of malware wreaking havoc among companies. No industry, category, size, or group is safe from this cyber scourge.