Michael Hannan explains the importance of having strong cybersecurity for your business and what you can to do mitigate a cyber disaster.

1. Cybersecurity:
HOW SAFE IS YOUR ORGANIZATION?

2. Speaker
MICHAEL has led a number of IT risk assessments, Sarbanes-Oxley Section 404
projects, SOC audits, and third party internal control attestations. He is a certified
Information Systems Auditor and a member of the Institute of Internal Auditors.
816-945-5668 • mhannan@cbiz.com
MICHAEL HANNAN, CISA
Manager, Business and Technology Risk, CBIZ MHM
2 CBIZ, Inc.

3. 3 CBIZ, Inc.
SMB in the Crosshairs

4. CBIZ, Inc.4
Has your business assessed the impact on
operations if an intruder gained access to your
proprietary bidding model and sold it to your
competitors, or stole bank account credentials to
conduct fraudulent transactions? Would your
business be able to recover and remain
competitive?

5. FINANCIAL
INSTITUTIONS
Why is cyber risk a top concern?
5 CBIZ, Inc.
Cyber crime is
exploding.
Regulatory compliance,
stakeholder concerns,
liability, litigation,
business interruption,
reputation . . .
there’s a lot to manage
and a lot at stake.
Increased
Regulatory
Scrutiny Risk to
Brand and
Reputation
Litigation-
Inadequate
Board
Oversight
Litigation -
Employees
on Social
MediaCyber
Extortion
Fraud
Regulatory
Fines
Data
Breach
Costs
Litigation-
Loss of
Customer
Data

6. Goals for Attackers
6
- Access to Personal Information. While contractors may not have as much personally
identifiable information (PII) as a retailer or financial institution, construction firms still have
employee information that could include social security numbers, bank accounts for payroll, as
well as healthcare information.
- Access to proprietary corporate assets including privileged contracts, project/bid
data, architectural designs (including security designs), and intellectual property.
Hackers may also target information regarding a construction organization’s bank and other
financial accounts via social engineering and phishing schemes, and then attempt to entice an
employee to unwittingly transfer corporate funds/assets.
- Access to personal information on other organization’s servers. One of the most
prominent examples of this is the Target breach in which the initial intrusion was traced back to
credentials stolen from an HVAC contractor. Disgruntled employees or subcontractors may wish
to embarrass the organization.
- Extortion (CryptoLocker). CryptoLocker is a ransomware trojan which targets computers
running Microsoft Windows. This ransomware is typically propagated as an attachment or link
associated with a seemingly innocuous e-mail message. The intent is to breach a corporation’s
systems spreading malware and encrypting corporate data. The company is then forced to pay a
ransom in order to recover/unlock any data that has not been backed up.
CBIZ, Inc.

7. 7 CBIZ, Inc.
Cyber Risk
The Human Element
Approx. 95% of security incidents are
caused by human error:
 System misconfiguration
 Poor patch management
 Use of default usernames and
passwords or easy-to-guess
passwords
 Lost devices
 Sending sensitive information to an
incorrect email address or from a
personal email address

8. Recent Attacks
CBIZ, Inc.8
Turner Construction falls victim to phishing scam that
affects employees nationwide – April 2016
Seagate - 10,000 W-2 tax documents were released by an
employee during a successful phishing scam.
Individual at Boeing discloses 36,000 employees
information after seeking “document formatting” assistance
from spouse – February 2017

9. CBIZ, Inc.9
Another Threat - Ransomware
 Defined as “a type of malicious software designed to
block access to a computer system until a sum of
money is paid.”
 Most recent WannaCry Ransomware
 Users held to ransom to pay a fee in virtual currency to
retrieve their content.
Locks the screen
Encrypts the files and threatens user with a
countdown.
Selected files are deleted every hour until the ransom
is paid.

10. Case Study: DUMPSTER DIVING
10 CBIZ, Inc.
Bad actors go through your dumpsters in search of customer account numbers,
Social Security numbers, employee directories, executive calendars and signatures.
PREVENTION
 Contract with an outside document destruction company.
 Have shred bins for sensitive documentation easily accessible to employees.
 Post educational materials in proper locations to help employees know what not
to place in trash receptacles

11. Case Study: PHISHING
11 CBIZ, Inc.
Email Phishing can provide outside parties an entry point to sensitive
information.
PREVENTION
 Continuously educate and remind employees about the risks of email phishing and
how to identify an email phish
 Deploy email scanning software
 Test employees by performing email phishing tests periodically
Nearly 2/3 of the security incidents involved phishing attacks.

12. Case Study: PRETEXTING
12 CBIZ, Inc.
Unsuspecting individuals may fall victim to a face-to-face encounter with an
attacker and never realize it.
PREVENTION
 Have all non-employees sign-in with every visit and allow no employees access to
restricted areas without prior approval from a supervisor
 Know your vendors—never allow unscheduled vendors access to any restricted or
secured area
 Train employees how to handle a person who never says no and what targets a
social engineer might try to acquire

13. CBIZ, Inc.13
Breaches Occur Because Companies Fall Short
Do you…
 know what controls are in place and working consistently to
defend the company’s electronic and physical data?
 know when IT controls fail?
 know when your company security environment has been
breached?
 know your obligation(s) in the event of a data breach?
 know that all employees are trained at least annually on the
proper handling of removable media (such as thumb drives,
laptops, etc.) and email protocols of sensitive data?

14. CBIZ, Inc.14
Cost of Data Breach
Average cost per record of a data breach: $221
Average records exposed per breach: 29,611
Average cost spent on notification: $590,000
Average cost of post discovery efforts (costs
include implementing hotline, credit monitoring,
fines, etc.): $1,720,000
Average loss of business and reputation:
$3,970,000
Compiled from:
-2016 Ponemon Institute Cost of Data Breach

15. CBIZ, Inc.15
Educate Their Users on Security
Monitor Network Activity
Report Suspicious Activity
Perform External / Internal Penetration Test
Conduct Phishing Campaigns
Obtain Cybersecurity Insurance
What Can Management Do

16. CBIZ, Inc.16
Do you have cybersecurity insurance?
Do you understand how the policy works?
Do you know what coverages you have for
various incidents?
Does your policy protect information on
unencrypted devices or mobile devices?
Does your policy cover identity theft resolution
services for those affected individuals?
What other limitations exist in the policy?
What does the policy not cover?
Cybersecurity Insurance

17. CBIZ, Inc.17
 Are they clearly identified?
 How secure are these third-party providers?
 Who in the company is responsible for these
third-party providers?
 How are security violations reported?
 How are controls monitored for these third-
party providers?
 Do they have access into your network or
systems and how is that access
granted/revoked timely?
3rd Party Providers and the Cloud

18. ?
QUESTIONS
?
??
18 CBIZ, Inc.

19. Connect with Us
linkedin.com/company/cbiz
@cbz
youtube.com/BizTipsVideos
slideshare.net/CBIZInc
www.facebook.com/cbizservices
19 CBIZ, Inc.

20. 20