Why Cybersecurity Should Be a Priority and How to Get Started

Today’s world is powered by digital technology. While this connectivity enables us to do much more with much less, it also offers bad actors a greater range of opportunities to commit crimes. In 2021, the cost of cyber crime was estimated to be $6 trillion, and it is expected to grow to $10.5 trillion by 2025.

As much of our critical infrastructure is vulnerable to cyber attacks, the US government is taking steps to harden the country against incursions. The centerpiece of these efforts is the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA).

What Is CIRCIA and What Does It Have to Do with Forest Products Businesses?

Signed into law in March of 2022, CIRCIA will require businesses involved in the nation’s critical infrastructure to report cybersecurity breaches and ransom payments to the Department of Homeland Security’s “Cybersecurity & Infrastructure Security Agency” (CISA). Think of CISA like the CIA of cybersecurity. CISA believes that with timely reporting of cyber crimes, it will be able to better assist victims and identify patterns that can avert additional criminal acts.

Although many people think of things like power, utilities, and telecommunications as critical infrastructure, the definition is actually very expansive. The forest products industry falls within the Food and Agriculture Sector’s critical infrastructure, which means that forest products businesses will be required to follow CIRCIA regulations.

If this is news to you, there is no reason to be alarmed. CIRCIA is still under a Request for Information (RFI) period and will likely not be in effect for two to three years. For now, CISA is shining a light on “cyber hygiene,” the best practices that every business should follow to protect its network and assets from cyber criminals.

Cyber Hygiene Basics

Use Multi-Factor Authentication (MFA)
MFA is when there are multiple authentication steps required to login to a system. An example would be when after entering a username and password for a portal or app, a code is sent to your smartphone that you also need to enter in order to login.

Without MFA, all it takes is for one set of credentials to be compromised for a cyber criminal to potentially gain access to an entire system. Many software programs and services have standard MFA features, and others enable administrators to make them mandatory. If you want more information on MFA, this article is a great place to start.

Create & Practice Incident Response Plans

Think of this like emergency evacuation plans and fire drills for cyber threats. If everyone knows exactly what to do if something happens, the response will be much more swift and effective. This PDF from CISA has more details and additional resources, but below are the major points to plan out with your administrator and IT assets.

• • What to Do?
  • Who to Call? (primary contact and back up)
  • Notify Security Provider
  • Notify Law Enforcement
  • CISA is also accepting voluntary reports in the interim. Reports can be made to CISA by emailing report@cisa.gov or calling (888) 282-0870

Create Offsite Back-Ups 

Employ a solution that automatically backs up your critical system configurations and data offsite. There are a variety of cloud storage providers, such as Amazon Web Services, that your IT resources can help you select from and configure.

This will not only help to protect your business against ransomware and malware attacks, but it could be a lifeline if there are any accidents or natural disasters that affect your onsite operations.

Phishing & Spoofing Training for Employees

Phishing is when a cyber criminal seeks to infect a device with malware and viruses by getting the user to click a malicious link or download an infected file. Phishing emails often appear to come from a legitimate source, like a bank, and can be very difficult to spot. So much so that more than 90% of successful cyber attacks start with a phishing email.

Spoofing is when a cyber criminal imitates a trusted source like a legitimate website in order to gain your personal information or infect your device. For both phishing and spoofing, cybercriminals can be very sophisticated, and a malicious email or website can be very difficult to tell apart from the real source. Additionally, they often leverage alarming messaging in order to get you to click before thinking, such as:

“We suspect an unauthorized transaction on your account. To ensure that your account is not compromised, please click the link below, and confirm your identity.”

This PDF from the CISA goes into much greater detail, but here are some basic tips to share with employees:

• • Avoid opening emails and clicking links if you are not 100% sure of authenticity
  • Be wary of communications that are designed to alarm you
  • Do not divulge personal information
  • Enable MFA whenever possible
  • Only use secure passwords (a minimum of 12 characters that include uppercase and lowercase letters, numbers, and symbols)
  • Do not reuse passwords and periodically update them
  • Consider using an encrypted password generator and manager such as Keeper for both yourself and your team—this will make password security much easier
  • Ensure all devices are always using up-to-date antivirus software, firewalls, email filters, and anti-spyware

Create Offsite Back-Ups 

If you want to learn even more about cyber security, check out “Shields Up”, CISA’s initiative to harden US infrastructure and businesses against cyber attacks.

If you want assistance with cyber hygiene, reach out to CISA, they offer a range of services for free!

How Seriously Should You Take Cybersecurity?

You should take Cybersecurity very seriously, right now, regardless of CIRCIA regulations being two to three years away from enforcement. Cyber threats, such as software supply chain incursion and coordinated cyber criminal attacks, are constantly evolving.

And businesses in the forest products industry can make excellent targets. Much of the machinery and equipment you rely on is run on software and connected to a network. That means there are hundreds of exposures that increase exponentially with each team member.

Let Us Know How We Can Help 

Risk management and mitigation are at the heart of what we do at Continental Underwriters. Reach out today and we can help you hone in on cyber topics that are most relevant to your business and get you started on a path to cybersecurity.