Mark Murphy is a White Hat. In IT parlance, that means he’s one of the good guys. On a daily basis he patrols the entire Workspace network looking out for attempts by Black Hats – cyber criminals – to attack customers’ businesses.
“I stop you being a party to an attack, I try to stop you being attacked, and I try to stop you being collateral damage in an attack on someone else,” explains Mark. “I scan the networks nine times every day, and I think we’re unique in that. I don’t think any of our peers go to that level.”
The reason for Mark’s vigilance is simple.
Cyber attacks against small businesses are on the rise – almost half of the global attacks logged during 2015 were against companies with fewer than 250 staff. “We used to see attacks against small business a couple of times a year, but now we’re seeing them weekly,” says Mark. “They’re not daily yet, but that will come.”
The problem is that small businesses are now regarded by cyber criminals as “low-hanging fruit”.
The problem is that small businesses are now regarded by cyber criminals as “low-hanging fruit”. Most large corporations have bolstered their defences in recent years and usually have whole teams dedicated to keeping their IT secure. “But if you’re a two- or three-man band, you don’t have that same level of resources, or training, or, let’s be honest, interest,” says Mark. “A lot of people just want to come into the office, work and then walk away.” One weakness in your system – be it an easy-to-guess password or giving too much information to a third party – and you become a target for Black Hats.
“These guys scan the internet looking for open windows,” explains Mark. “Once they find one, they’ll watch you, they’ll research you. The people who are doing this are much, much cleverer than you and me. They’re very motivated, they train and study a lot, because there’s a lot of money to be made.”
Don’t take the bait
Attacks can take various forms. Most of us are familiar with “phishing” – email attempts to solicit passwords or bank account information – but are less clued up about, say, “evil twins”. “It’s an easy thing to do,” claims Mark.
“You have a router at home. Your network name is broadcast so I could park outside your house, look at my iPhone and see what your network’s called. And I could then get my own wireless access point and I could set it up so it looks like it’s got the same name as your access point. Now, I’ve got two: one good and one evil twin. Next time you come home, your iPhone, for example, sees your evil twin, and says, Oh, there’s my network! And it sends it its user name and password. And the best place to do this? Outside a business centre. Because there are hundreds of SSIDs in there.”
Watch out, too, for the undead.
A “zombie” PC is one that’s been infected by a virus, and is now working for somebody else – a “zombie herder”. Mark explains: “As a herder, what might I get that zombie to do? It might just send small requests to a PC, but if I get lots of my zombies to do that and overwhelm your system, I can prevent you getting on the internet – that’s what’s called a ‘denial of service [DoS]’ attack.”
Mark has a chilling tale to tell about a small firm who lost half a million pounds this way – and yet the attack couldn’t have happened without an initial “open window” caused by human error. “Somebody rang up pretending to be from the bank,” explains Mark.
One thing is clear: the Black Hats aren’t going to go away.
“They had lots of information about a certain member of staff because they’d Googled her; she was reassured, and ended up giving away her password.” The DoS attack was launched to prevent her accessing her online banking, during which time the gang transferred the money, in small chunks labelled “Wages”, to UK clearing banks and from there, out of the country.
While we might think of our computers as being at risk from automated robo-viruses, few of us expect a cyber attack to come from someone claiming to be Darren from Accounts. “It’s what we call ‘social engineering’,” says Mark. “We all want to be friendly and helpful, so when someone phones up and has information about you, you might end up giving them just a little bit more, and then they can use that information to get even more of a foot in the door.”
You should be.
So what can a small company do, without spending thousands, to safeguard against cyber attacks?
“I’m your first line of defence,” says Mark. “I use the very same methods that hackers use to look for weaknesses – open windows, holes in the wall, missing roof tiles, anywhere a Black Hat could get in. But on top of that, there are lots of things you can do yourself that won’t cost you a penny.”
The good news – for Workspace customers at least – is that Excell Group and Workspace have just launched a new eight-year partnership. It will see both firms investing hugely in connected services across the whole Workspace portfolio, to make sure companies have the top-of-the-range business-grade Wi-Fi and voice solutions they need to grow, securely.
For example, the new Dot11 wireless network, which comes as standard in all new Workspace developments and is being retrofitted across the whole portfolio, will beef up network security to unprecedented levels. “It automatically looks for evil twins, and if it finds one, it recognises it, and it will prevent you from associating with it,” explains Mark. “Plus, if you buy your own router for your office, it’s unlikely you’d put any security on it, and all the data will be sent in clear text. With Dot11, data is encrypted from your laptop all the way up to the network. It’s much safer.”
One thing is clear: the Black Hats aren’t going to go away. “We can’t destroy them,” admits Mark, “but we can lessen their impact. If I find a problem I’ll contact you and fix it for you, or advise you how to fix it. But just be aware of cyber-crime. It’s now and it’s real.”