Why Did We Get Hacked?

I just want to know, why did we get hacked?

I met a successful lawyer recently who was upset because one of her clients had been hacked.  (It’s not just her clients that are getting hacked.)  She moaned, “I just want to know WHY this happened.”

Good question.

So how did I respond?  I asked more questions.  (I’m paraphrasing the conversation below based on having this type of conversation many times over the past few years.)

Q:  “I’m sorry to hear about your client’s situation.  When did it occur?”

A:  “I just found out about it this morning.  They blew it earlier today.”  (It’s usually within the past week for them to be really upset, or even nauseous.)

Q:  “Do you know how they were hacked?  Was it a phishing situation?  Malware?  Or did the hackers convince your client to wire money to Never-Never Land?”

A:  “They wired money away.”  (By the way, a hack is often a combination of intrusions.  In the case of a fake wire request, the hacker might start with a phishing scheme, which plants malware.  Then the hacker(s) use the malware to just sit on the company’s network and study the activity.  In particular, they study the way executives communicate with one another.  Then after weeks or even months, they mimic the style of communication from the CEO to the CFO, instructing the CFO to wire money away.)

Q:  “Were their servers and computer systems fully protected with anti-virus and other security software?”

A:  “Don’t know.”

Q:  “Do you know if they have had a professional security audit in the past year by a competent I.T. managed services provider?”

A:  “She talked about doing it, but I don’t think they got around to it.”

Q:  “Do you know if they do any regular internet security training with their employees?”

A:  “I don’t think so.”

To be candid with you, I feel terrible for their client (or friend, or their company when they are the victim).

Hacking information technology systems is an indirect, impersonal robbery.

When a military sniper shoots someone, he/she has to see the person in the gun sight first.  This is one reason being a sniper is traumatic.

In contrast, a hacker is just looking at numbers, words, and code on computer screens.  It is totally impersonal.  They never see the pain they cause, the jobs that are lost, the emotions…  They can be indifferent, and even justify their thievery as a win for their “cause.”

The reports we have seen indicate a significant number of small business attacks are by the Chinese cyberespionage group APT10.  Some people believe the Chinese government is behind the group because they are after more than money:  APT10 is doing reconnaissance of small-midsize American businesses.  They want your intellectual property and client data, possibly more than your cash.

Although… cash is nice.

Let’s get back to our question, “WHY did this happen?”

Let me be candid and fair with you:

#1 – Hackers are similar to burglars.  They are constantly on the lookout for an unprotected home in a neighborhood where they can enter the home, take what they want, and leave without being noticed.  Hackers basically knock on the doors of your home.  If your company has proper protection and has trained the occupants of your “home” not to open the door, then hackers cannot get in.

Hackers use automated phishing and malware programs to identify vulnerable networks of small-midsize businesses, and larger ones, and then attack the easy ones.

HINT:  Do not be EASY prey for a hacker and they typically will not bother you.  Another good analogy is hackers are similar to sharks…

#2 – Be responsible.  Get a thorough security assessment of every information technology network and device used by your organization ANNUALLY.  Have you had a network security assessment done of your I.T. in the past year?

If not, and you want to be frugal, then WCA Technologies provides I.T. security assessments at no charge as a service to our local business, nonprofit, and government services community.

#3 – Do something.  Your assessment may say you do NOT need to spend a dime on new equipment, but you are not training your employees how to use their computers, mobile devices, and the internet safely.  You may just need training.

You might just need to keep doing what you are doing.

Either way, it is MUCH BETTER to know in advance of a security breach than try to explain how you did everything possible after your organization makes a mistake.  Your board of directors and shareholders demand that your leadership team manages the assets of your organization responsibly.

Therefore, confirming the security of your I.T. infrastructure and systems is just prudent.

Acting upon the advice in a network security assessment is wise.

At least if you have a recent network security assessment you know what to do, and ultimately have written confirmation you are a responsible steward of your organization’s resources.

Then you can rest easy, and the hackers across the globe can pursue easier targets instead of you.

How secure is your network?

Find out.

WCA Technologies is currently offering a complimentary network security assessment for your organization.  Give us a call.  We are good people serving great organizations in New York City’s five boroughs.

We specialize in serving small-midsize law firms, nonprofits, and corporations that want a “better” or best partner to protect their digital assets from cyberthieves while improving their efficiencies through technology.  We have seen the issues you are facing, and overcome every challenge successfully.

To learn more contact Peter Fidler, Partner & Senior Consultant of WCA Technologies via email pfidler@wcatech.com/dev or call (212) 642-0980.

WCA Technologies was one of only three companies recognized by Microsoft in 2017 as an Up and Coming Partner in the New York Area.  The experienced team of technologists has also been ranked among the top 501 I.T. Managed Service Providers in America by MSPmentor.

In January 2018 WCA Technologies celebrates its 30 year anniversary.