SFBW focused on the issue of cybersecurity at a recent CEO Connect held at the Alan B. Levan | NSU Broward Center of Innovation. The session was moderated by John Wensveen, executive director of the innovation center and the university’s chief information officer, and Kevin Gale, group editor-in-chief for SFBW and Lifestyle magazine.
It was notable for the depth of expertise among the panelists, which included a former FBI special agent, a chief information officer of a major hospital system, a senior IT official from a major bank and the director of client services for a company that provides IT support and managed services.
The panelists were:
- Christiaan Veerman, VP of Engineering, Head of Developer Experience, TD Bank
- Darin McGrew, director of client services, Wheelhouse IT
- Kevin Parker, principal, Blacksuit Consulting and former FBI special agent
- Steven Travers, VP and chief information officer, Broward Health
Sponsors of the event were On the Ball, a coaching, training and speaking company; Transworld Business Advisors and Now CFO, outsourced CFO consultants.
Around the time of the CEO Connect, the EPA warned that cyber criminals were attacking municipal water utilities. Attacks also figure in global hotspots such as Ukraine and Taiwan. A prominent example of yet another cyberattack occurred after the panel when a ransomware attack of CDK Global disrupted operations at auto dealerships across the U.S.
However, the panelists said even businesses who think their small size makes them unlikely targets should not be complacent. Hackers will go after companies of all sizes and can make your operations grind to a halt. One example given was a small hospital that resorted to giving patients cowbells to call for nurses after a cyberattack.
Here are some top takeaways from the CEO Connect:
- The lion’s share of critical challenges and incidents occur around email. Businesses should focus on multifactor authentication, which can involve sending a text or email to a device to confirm who is logging in. That helps protect against incidents where cell phones are stolen or cloned.
- Next-generation email filtering systems can help limit the potential for cyberattacks to reach end users.
- Make sure your organization’s tools are deployed properly. Consider the pain of a successful cyberattack that could have been prevented if the tools were working properly.
- If you don’t have an IT department, utilize the services of vendors who put information in the cloud. These service providers typically have the expertise to guard against attacks.
- Beware of old technology that may be lurking in your business. For example, Microsoft stopped providing security patches for the Windows XP system, but there are still devices using that technology. Hackers can find a way into broader systems through these weak doorways. Businesses should see if there is a way to upgrade to newer systems or try to isolate the devices from the broader network.
- Talk with vendors about how they are spotting attacks and whether they are automating responses. Some AI systems, for example, can shut down a compromised server and provide notification of the issue.
- Make sure there are clear procedures when it comes to requests to transfer money or make an emergency purchase of gift cards. AI is making it easier to imitate someone’s voice and appearance, so the top executive asking for a transfer may just be a fake. An old-fashioned telephone call to verify the request could prevent a major issue. Not every process needs to be automated.
- Train your workforce on how to spot an email that’s part of an attack. For example, why would this person I don’t know be sending me a PDF? It could be infected. An email might seem like it’s from a certain sender, but looking at the actual email account in the form the field could reveal the email address doesn’t match the name of the company in the body of the email.
- Consider how to deal with the workplace phenomenon of bringing your own device (BYOD). IT experts can install systems that protect employees’ privacy while allowing the remote deletion of company information if the device is lost or stolen. For example, Microsoft Intune is a cloud-based solution that manages user access to organizational resources.
- Have a policy that mandates employees update their device software when new releases come out. Often new releases for iOS or Android include patches to fix security vulnerabilities.
Learn about other SFBW events here.
