Within any organization, certain employees have access to information that could tip the scales of risk for the business. If a cybercriminal were to gain access to a company's most sensitive information through stealing credentials from one of these employees, the business could face serious financial and reputational repercussions. Board members, though typically not employees, are included in this group of vulnerable targets for two key reasons:
- They possess materially important data. Board members have access to information that is materially important to the business; yet because they typically aren't employees of the business, they don't go through the same security training or have company-issued devices. Consequentially, they may not have the same level of security on those devices to protect the sensitive data they access.
- They have an ability to influence. Often a hacker will impersonate an executive when sending a phishing lure to intended victims. Given the role and influence of board members, it's likely that a recipient will pay attention to a phishing email if it appears to be sent by one of them. Although this makes board members especially valuable to cybercriminals, it also puts them in a prime position to set the tone for security and ensure that organizations are taking the right steps toward preventing credential theft.
Credential Theft Prevention Checklist
According to the 2017 Verizon Data Breach Report, 81% of hacking-related breaches leveraged either stolen and/or weak passwords, up from 63% reported in prior years. Given that credential theft is the most common element across cyberattacks, it's no longer an option to delay conversations with security leaders on the topic. To be proactive, board members should reference this checklist:
Understand how data is accessed. As a first step, boards should ask themselves the following questions:
• What is the value of the information to which we have access?
• How are we getting access to that information?
• How is that information protected?
• Given the sensitivity of the information, do we think it is protected enough?
After going through this exercise themselves, they can pose these same questions throughout the organization to ensure that employees with access to the most sensitive data are properly protected.
Ask about multifactor authentication. Passwords alone are never enough. A practical example of multifactor authentication is withdrawing money from an ATM. Banks always require both a card and a password, and it's hard to imagine a world where only one of these requirements would be needed. The same concept should apply to accessing data, making it important to ask:
• How does the company ensure that, when someone authenticates, it authenticates who they really are?
Be familiar with the company's overarching information security strategy. Credential theft is one tactic cybercriminals use, and how a company addresses this is part of its overarching cybersecurity strategy. Conversations about this strategy should include questions like:
• Has the company invested in cybersecurity training for its employees? Familiarity with what a creative phishing lure looks like should be part of a larger cybersecurity awareness program about credential theft.
• What kind of technology is the company investing in to prevent not only credential theft-based attacks but also other types of cyberattacks?
Board members are in a unique position as highly influential leaders — and as potential victims — to keep the scales of business risk steady. When thinking critically about the significance of credential theft, they can ensure they are doing their part to prevent successful cyberattacks by avoiding falling victim themselves.
- 10 Social Engineering Attacks Your End Users Need to Know About
- Why Data Breach Stats Get It Wrong
- How Systematic Lying Can Improve Your Security
Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry's most knowledgeable IT security experts. Check out the INsecurity agenda here.