What Solar Eclipse 2017 Can Teach You About Cybersecurity
Do you have a doomsday plan? How can you keep someone from hacking your site? What happens when you are under attack? Whether you are the CTO of an association or the tech manager for a local nonprofit, there are many ways to be vulnerable to cyber attack or disruption. Small and medium-sized organizations are particularly targeted because of their relative lack of security and cyber defense resources.
Solar eclipses have historically been seen as bad omens—or at the very least an indicator of the abnormal. Whether it was the gods angry at the actions of humans, the apocalypse, or a giant dragon eating the sun, cultures from around the world have created stories explaining the midday obstruction of the sun. Often the sight was cause for panic. Even actions of non-human animals had been disrupted by solar eclipses. As astronomy has improved so we may predict the paths of the sun and moon, we are both prepared to experience solar eclipses and are still fascinated by this rare phenomenon.
While we are thinking of the concept of bad omens, perhaps it is also a time to consider your own digital “eclipses” and worst case scenarios. A solid security plan can help fight off the apocalypse but sometimes you need to be cognizant of the fact that your site (and maybe, perhaps, the sun) is not invulnerable.
How to Keep the Sun (and Your Site) Up and Running
The best way for any civilization to keep calm (or capitalize on the fear) during a solar eclipse was to better understand what the solar eclipse was and how to predict it. Similarly, the best way to offset the risks of having a public-facing WordPress or Drupal website is to understand how to best protect your website and integrations. There are two major aspects of cybersecurity planning: technology and behavior.
Technology can both promote vulnerability and mitigate it. Having a comprehensive security plan can plug the vulnerable gaps. For example, a number of cyberattacks on WordPress are not directed at domains themselves, but gain access through vulnerabilities in integrations. Regularly accepting updates should be a staple of your site maintenance plan.
A comprehensive security plan can include:
- Having a backup of your site
- Conduct regular “red team” and other incident simulations with IT team
- Redundant data centers
- Centralized software for asset management and change management
- Segmented network and use access so employees can only access the data they need
- Cloud services (such as CloudFlare) that uses web application firewalls to avoid DDoS and other malicious attacks
- Regularly run penetration tests through managed security services
Behavior also has an incredible impact on the security of your website. Some of the basics like not clicking on Google “unsafe” websites or strengthening your passwords should be common sense by now. But hackers have become more sophisticated. Phishing emails with infected links are more likely to blend in with other innocuous emails. Educate all of your employees on your network or who interact with your website.
The Day the Sun Goes Dark: What to Do When You Are Hacked
Imagine some of the panic that the ancient humans felt when seeing the sun darken on a clear day. If your site is hacked and you don’t have a pre-set plan, take a leaf out of Dune and remember that “fear is the mind killer”. Don’t let fear dictate your reaction.
Once you calm down, there are a number of options at your disposal based on your specific situation.
Your immediate next step should be to document what you’ve seen or direct your IT team to document. What has been affected and who noticed the problem? Can you access your CMS? What time did you notice this issue? What timezone? What actions have you taken recently? Did you change a plugin or widget?
Try to find the source of the problem. Scan the website, your local environment, and check your hosting provider. Check if you have been blacklisted by Google. Talk to those who may have opened a contaminated email while on the network.
Once you have located the source of the vulnerability, you can reset all access and quarantine your site. Depending on the situation, you can even create a backup of the website. Make sure your development/IT team has appropriate information such as CMS login, hosting login, web logs, and FTP / sFTP access credentials, and any backups you might have.
After you find and remove the hack, consider reaching out to related IT communities and support from your host or other sites. Update all of your information and change passwords. If possible, gather evidence of the vulnerability such as suspicious emails.
Notify relevant persons of the hack and exposure of sensitive information. Know your legal constraints and take steps to re-secure and tighten your security.
Predicting Solar Eclipses and The Future Of Cyber Attacks
Mobile devices and apps are the new frontier of cybersecurity. As cyberthieves’ tools and techniques evolve to access the trove of valuable information on mobile, organizations should consider how they are protecting that information. Some of the previously mentioned security measures can be applied to mobile devices and apps. Secure behavior should be applicable on mobile as well as on desktop.
The future of cyberattacks is increasingly concerning as the Internet of Things spreads into every aspect of modern life. In fact, people have found a way to encode malware in a strand of DNA. Talk about doomsday scenario, right?
Organizations—regardless of size—should know how to protect valuable client and financial data. The federal government has recently established cybersecurity resources for small business. There is no excuse to be lax in security. The consequences of major exposure can affect anything from medical care to mortgages.
If you need help building a security plan, consider reaching out to our technology team. We can point you to the right tools for your website. And if you are planning on viewing the solar eclipse on Monday, August 21st, please @wdgtweet on social media so we can see your photos!
