{"id":10553,"date":"2020-10-25T13:49:07","date_gmt":"2020-10-25T17:49:07","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=10553"},"modified":"2021-03-12T14:29:50","modified_gmt":"2021-03-12T19:29:50","slug":"how-to-prevent-cybercrime-9-helpful-tips","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/how-to-prevent-cybercrime-9-helpful-tips\/","title":{"rendered":"How to Prevent Cybercrime: 9 Helpful Tips"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"h-we-ll-walk-you-through-how-to-cyber-police-your-data-for-cybercrime-prevention-and-control\">We\u2019ll walk you\nthrough how to cyber police your data for cybercrime prevention and control<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Many cyber security articles on\ncybercrime often start with a shocking statistic about how cyber attacks are on\nthe rise. <strong><em>Danger! Beware!<\/em><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But we\u2019re not going to do that here.\nInstead, we\u2019re going to present you with parodied lyrics to a song. The\nevolving modern cybercrime landscape is suitable for a parody of an 80s song by\nThe Police:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><em>Every account you create<\/em><\/p><p><em>Every transaction you make<\/em><\/p><p><em>Every security best practice you fake<\/em><\/p><p><em>Every email you communicate<\/em><\/p><p><em>Hackers are watching you.<\/em><\/p><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">It is true that cybercrime is\nincreasing in occurrence each day and evolving to become more complex. But what is cybercrime? What constitutes such a\nsignificant (and growing) industry? In the broadest sense, cybercrime is any type\nof illegal activity involving the internet. Some of the most common types of cybercrime include identity theft and\ninformation misuse, data and intellectual property theft, human trafficking,\nchild pornography, and terrorism. As you might guess from our variation of song\nlyrics, many of these crimes are committed using a variety of cyber security attack tactics such as phishing,\nCEO fraud, man-in-the-middle (MitM), hacking, SQL injections, DDoS, and malware\nattacks. Historically, these crimes were committed by lone wolves. Nowadays, however,\ncybercrime is a booming industry comprised of criminal enterprises, organized\nhacker syndicates, hacktivists, and nation-state actors. &nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The gargantuan task of knowing how to prevent cybercrime often comes down to\nnullifying cyber security threats and\nfiguring out how to prevent cyber attacks.\nHowever, hackers\u2019 continuously-changing tactics, a growing number of actors,\nand rapidly expanding technologies make it challenging for cyber security\nexperts and businesses alike to stay a minimum of one step ahead of\ncybercriminals. Furthermore, there is no one singular method of 100% cyber crime prevention \u2014 understanding how to prevent cybercrime is about bringing\ntogether an effective combination of technologies, best practices, and\nprocedures to craft the solution that is best for your business.&nbsp; <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What are some of the best methods cybercrime prevention and control from a business perspective? Let\u2019s hash it out.<span id=\"newline\"><\/span><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-to-prevent-cybercrime-step-1-follow-industry-best-practices-and-guidelines\">How\nto prevent cybercrime\n\u2014 step #1: Follow industry best practices and guidelines<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Cyber crime prevention is not a one-size-fits-all approach.\nOrganizations of different sizes have different needs, threats, risk\ntolerances, vulnerabilities, and capabilities. Luckily, governments,\nregulators, and even industry organizations have provided some general frameworks\nand security recommended practices for organizations to follow to reduce their\nlikelihood of falling victim to cyber security\nattacks. However, it is important to note that some are more particular\nthan others in their recommendations or requirements. For example:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>GDPR<\/strong>,\nwhich stands for General Data Protection Regulation, is comprehensive\nlegislation that rolled out in 2018 to protect the data and privacy of European\nUnion citizens (even those living abroad and international companies that\nhandle data of EU citizens). The regulation outlines much of what is or is not\nallowed, states what falls under data subjects\u2019 (the citizens\u2019) expectations of\nprivacy, and details some of the stiff penalties that businesses and\norganizations alike could face for noncompliance.<\/li><\/ul>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/CSF-1.1-300x300.png\" alt=\"Cybersecurity Framework\" class=\"wp-image-10561\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/CSF-1.1-300x300.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/CSF-1.1.png 613w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure><\/div>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>NIST<\/strong>,\nalso known as the U.S. Commerce Department\u2019s National Institute of Standards\nand Technology, is the go-to resource for cyber security professionals. Last\nyear, NIST <a href=\"https:\/\/nvlpubs.nist.gov\/nistpubs\/CSWP\/NIST.CSWP.04162018.pdf\">released version 1.1<\/a> of its popular Cybersecurity Framework\ndocument, which outlines ways to improve cyber security for critical\ninfrastructure. The goal of the document is to provide \u201ca prioritized,\nflexible, repeatable, performance-based, and cost-effective approach, including\ninformation security measures and controls that may be voluntarily adopted by\nowners and operators of critical infrastructure to help them identify, assess,\nand manage cyber risks.\u201d Ideally, the framework should be used to complement\nyour organization\u2019s existing cyber security program and risk management\nprocesses, not replace them, and outlines five concurrent and continuous\n\u201cfunctions\u201d\u2014 Identify, Protect, Detect, Respond, and Recover \u2014 to address cyber\nsecurity risks.<\/li><li><strong>HIPAA<\/strong>,\nthe national Health Insurance Portability and Accountability Act in the United\nStates, is not as particular nor stringent as the GDPR about how patient data and\nconfidential personal health records are to be used, stored, or transferred.\nHIPAA\u2019s Security Rule does not technically\nrequire encryption of patient health information (PHI). Instead, \u00a7 164.312&#8217;s\nstandard for transmission security says that organizations must &#8220;Implement\ntechnical security measures to guard against unauthorized access to electronic\nprotected health information that is being transmitted over an electronic\ncommunications network.&#8221; Even the rule&#8217;s technical safeguards concerning\nthe topic of encryption are defined only as &#8220;addressable&#8221;\nrequirements \u2014 handlers of PHI must &#8220;Implement a mechanism to encrypt\nelectronic protected health information whenever deemed appropriate.&#8221;\nIsn&#8217;t that comforting? Granted, the language is left purposefully vague to\naccount for evolution and changes in technologies. However, it also leaves\nbusinesses with potential opportunities to argue away their way out of\nresponsibility and accountability.&nbsp; <\/li><li><strong>PCI SSC<\/strong>,\nthe Payment Card Industry Security Standards Council, requires businesses that\nuse account data to implement certain protections for that information. These\ndata security requirements, known as the <a href=\"https:\/\/www.pcisecuritystandards.org\/pci_security\/maintaining_payment_security\">PCI Security Standards<\/a>, require encrypted transmission of cardholder\ndata across public and open networks, use of strong access control measures,\nimplementation of a vulnerability management program, and more. Failure to\ncomply with these standards can result in significant fines and\npenalties \u2014 not to mention possible suspension of your company\u2019s card payment\nprocessing capabilities.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Sounds simple enough, right? These are\nhighly-regarded resources for IT security professionals and businesses alike. The\ntrouble is, though, not all businesses adhere to these recommendations (or, in\nsome cases, required practices). An apropos analogy is when an adult tells a\nsmall child not to touch a hot stove because they will get hurt, yet the kids\ndoes it anyway: Some children (or businesses, in this case) choose to learn the\nhard way and wind up getting burned. For companies who instead choose to \u201clisten\nto the adult\u201d and adopt these required or recommended methods of cyber crime prevention, they will be in a better\nposition to protect their data, employees, and customers from cyber security attacks and data breaches. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These other methods of cyber crime\nprevention can (and should) include the following: <\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-to-prevent-cybercrime-step-2-implement-digital-physical-security-methods\">How\nto prevent cybercrime\n\u2014 step #2: Implement digital &amp; physical security methods <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We have <a href=\"https:\/\/www.thesslstore.com\/blog\/how-improving-your-cyber-security-posture-benefits-your-bottom-line\/#comments\">previously\ndiscussed<\/a> the idea of using firewalls, antivirus, network and server\nmonitoring, and other forms of physical and digital data center security measures\nto create barriers for cybercriminals. Aside from hacktivists and nation-state\nactors who are trying to achieve ideal or political goals, many modern\ncybercriminals are simply looking for a way to make money. This could be\nthrough wire transfer scams or by stealing account information, personal data,\nor even intellectual property and proprietary research.&nbsp; <\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Robbin-the-Rich-300x300.png\" alt=\"Cybercrime plan\" class=\"wp-image-10560\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Robbin-the-Rich-300x300.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Robbin-the-Rich.png 441w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">However, the more challenging your defenses are to get\nthrough and the more responsive you are to their attacks, the more work a\nhacker will have to do to accomplish their goals. This makes your business less\nappealing as a target. After all, why would a thief want to go to the trouble\nand planning to rob a castle when they can just attack the king\u2019s carriage instead?\nThis same approach can be said for hackers when they are choosing a target for\na cyber security attack. In part, cyber crime prevention includes hardening your\ndefenses as much as possible so that your company appears to be more trouble\nand effort than the potential payoff is worth. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-to-prevent-cybercrime-step-3-maintain-asset-lists-patches-and-updates\">How to prevent cybercrime \u2014 step #3: Maintain asset lists, patches, and updates<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">While this should go without saying, cyber crime prevention involves keeping your\ncompany\u2019s hardware, software, and digital assets up to date through proper IT\nsecurity asset management. A very easy and common way for hackers to get\nthrough a company\u2019s defenses is to simply take advantage of security gaps that\nexist due to outdated or unpatched IT infrastructure and software. While zero-day\nvulnerabilities \u2014 such as a <a href=\"https:\/\/www.forbes.com\/sites\/daveywinder\/2019\/04\/21\/unpatched-windows-10-vulnerability-uses-microsoft-edge-to-steal-data-how-to-mitigate-the-risk\/#1aa63f75673f\">Windows\n10 cyber vulnerability<\/a> for Microsoft\nEdge web browser users \u2014 could enable threat actors to take advantage of\nweaknesses that are unknown to manufacturers, the vulnerabilities they <em>do<\/em> know about are ones that <a href=\"https:\/\/www.thesslstore.com\/blog\/critical-flash-vulnerability-28-0-0-161\/\">companies\nwill often issue updates or patches to fix<\/a>.&nbsp;&nbsp; <\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"214\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Computer-Patch-300x214.png\" alt=\"\" class=\"wp-image-10559\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Computer-Patch-300x214.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Computer-Patch.png 430w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">An equally important responsibility is ensuring you maintain\nan up-to-date inventory list of all hardware, software, data, and security\ncertificates so you know exactly what is on your networks, servers, and other\nIT systems. Keeping an up-to-date list not only helps you stay informed about\nyour assets, but it also helps you keep vital information at your fingertips so\nyou aren\u2019t scrambling for information at the last minute should a cyber\nsecurity event take place. This will play a vital role in implementing any\nincident response plans (IRPs), IT disaster recovery plans (DRPs) and business\ncontinuity plans (BCPs). <\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-to-prevent-cybercrime-step-4-manage-ssl-tls-certs-and-keys-for-your-domain-s\">How\nto prevent cybercrime\n\u2014 step #4: Manage SSL\/TLS certs and keys for your domain(s)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When discussing how to prevent cybercrime, we\u2019d be remiss\nto not mention the importance of using a secure protocol for your website in\nlieu of a nonsecure one. HTTPS, the secure version of hypertext transfer\nprotocols for websites, is essential for every website regardless of content \u2014\neven <a href=\"https:\/\/support.google.com\/webmasters\/answer\/6073543?hl=en\">Google\nsays so<\/a>. This secure protocol is made possible through the use of <strong>SSL\/TLS certificates<\/strong> \u2014 <strong>secure sockets layer<\/strong> and <strong>transport layer security<\/strong> \u2014 which\nauthenticates websites and businesses and enables secure, encrypted\ncommunication through a process known as a <a href=\"https:\/\/www.thesslstore.com\/blog\/tls-1-3-handshake-tls-1-2\/\">TLS\nhandshake<\/a>. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In a nutshell, SSL\/TLS certificates have three purposes:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>To <strong>authenticate<\/strong>\nyour website or business, <\/li><li>To ensure <strong>data\nintegrity<\/strong>, and <\/li><li>To create a <strong>secure,\nencrypted connection<\/strong> for content and data to transmit back-and-forth\nbetween a user\u2019s web browser and your web server(s). <\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Once SSL\/TLS digital security certificates are installed,\nthe <a href=\"https:\/\/www.thesslstore.com\/blog\/71-of-organizations-dont-know-how-many-certificates-keys-they-have\/\">certificates\nand encryption keys<\/a> must be managed to ensure that they remain up-to-date\nand don\u2019t expire. While this may sound like a simple task, consider that the\naverage number of certificates and keys per organization range in the tens of\nthousands, according to a survey of nearly 600 IT and IT security professionals\nby KeyFactor and the Ponemon Institute:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img loading=\"lazy\" decoding=\"async\" width=\"720\" height=\"357\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Keys-and-Certs-per-Org.png\" alt=\"\" class=\"wp-image-10558\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Keys-and-Certs-per-Org.png 720w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Keys-and-Certs-per-Org-300x149.png 300w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">That\u2019s a lot to track continuously. This is one of many\nreasons why public key infrastructure (PKI) and certificate management are such\nimportant task for every business, regardless of whether they hire a specialist\nto manage their PKI or use in-house personnel. This practice helps to avoid the\nissues and costs that can result from poor management, such as those reported\nin the KeyFactor\/Ponemon Institute report:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>  <strong>Scenario   <\/strong><\/td><td><strong>Extrapolated Cost<\/strong><\/td><\/tr><tr><td>Cost of unplanned outages due to certificate expiry   <\/td><td>   $11,122,100   <\/td><\/tr><tr><td>Cost of failed audits\/compliance due to undocumented or poor key management   <\/td><td>   $14,411,500   <\/td><\/tr><tr><td>Cost of server certificate and key misuse   <\/td><td>   $13,423,250   <\/td><\/tr><tr><td>Cost of Code Signing certificate and key misuse   <\/td><td>   $15,025,150   <\/td><\/tr><tr><td>Cost of CA compromise or rogue CA for MITM and\/or phishing attacks   <\/td><td>   $13,219,850   <\/td><\/tr><tr><td>Total Cost   <\/td><td>   $67,201,850   <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS is considered the leading protocol and now\nrepresents <strong>50.6%<\/strong> of site elements as\nof April 25, 2019, according to <a href=\"https:\/\/w3techs.com\/technologies\/history_overview\/site_element\/all\">W3Techs<\/a>.\nAlthough we\u2019d like for this number to be higher, it\u2019s important to consider\nthat this statistic is up from the previous year\u2019s standing (30.8%) as of April\n1, 2018. The HTTP\/2 protocol, which can\u2019t be used without encryption, also\nrepresents <strong>36.3%<\/strong> of site elements,\nup from 24.6% in the previously mentioned timeframes. Google even recommends\nHTTPS websites supporting HTTP Strict Transport Security (HSTS), which tells\nusers\u2019 browsers to request HTTPS pages automatically (regardless of whether\nthey type HTTP into their omnibox) to minimize the risk of delivering unsecured\ncontent. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-to-prevent-cybercrime-step-5-train-employees-to-identify-and-react-to-threats\">How\nto prevent cybercrime\n\u2014 step #5: Train employees to identify and react to threats<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Do you know what the biggest vulnerability in cyber security is for most businesses? If\nyou guessed \u201cemployees\u201d or \u201cemployee negligence,\u201d then you are correct. Employees\n(in house and remote) represent the <a href=\"https:\/\/www.cnbc.com\/2018\/06\/21\/the-biggest-cybersecurity-risk-to-us-businesses-is-employee-negligence-study-says.html\">most\nsignificant security risk<\/a> to businesses and employee negligence is the\nleading cause of data breaches, according to research from Shred It. While I\nmay not have a prize to offer, I can at least share some relevant insight on how to protect\nyourself from the numerous cyber threats that exist and seek to exploit your\ncyber vulnerabilities. &nbsp;<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"281\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Cyber-awareness-training-300x281.png\" alt=\"\" class=\"wp-image-10557\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Cyber-awareness-training-300x281.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Cyber-awareness-training-768x719.png 768w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Cyber-awareness-training.png 810w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Cyber awareness training provides a <a href=\"https:\/\/www.thesslstore.com\/blog\/report-70-us-employees-lack-strong-knowledge-privacy-security-best-practices\/\">basic\nunderstanding of cyber security best practices<\/a>. Great training teaches\nemployees \u2014 everyone from C-level executives to the janitorial staff \u2014 how to: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Identify and respond to phishing and other email\nscams (hint: don\u2019t engage with them).<\/li><li>Practice safe internet habits (such as creating\nsecure passwords and <em>not<\/em> using them\nacross multiple accounts).<\/li><li>Familiarize themselves with your organization\u2019s\ncyber security-related policies and abide by them. <\/li><li>Recognize social networking threats.<\/li><li>Safely collect, store, manage, and send client\nand company data.<\/li><li>Comply with government and industry regulations.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Your employees are your company\u2019s first line of defense. While automated cyber security protections such as firewalls, antivirus and antimalware solutions can help, they don\u2019t block every threat. This means that your employees need to be able to recognize and act quickly (and safely) to threats that make it through your network and other systems\u2019 defenses. They also need to know how to not create risks by handling sensitive data and information appropriately.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Effective cyber security training for cyber crime prevention is educational for both\nyour employees and your IT security staff. Though we already know the way that\nit is educational for the former, the way that it is also educational for the\nlatter is that it should involve regular testing as well. This training helps\ninfo sec professionals assess what is or is not working from the training so\nthey can identify areas they need to drill down on more in-depth to increase\nemployee understanding. One example of such testing, phishing simulations, will\nbe discussed in the next section. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-to-prevent-cybercrime-step-6-implement-email-security-solutions-and-phishing-simulations\">How\nto prevent cybercrime\n\u2014 step #6: Implement email security solutions and phishing simulations <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Considering the <a href=\"https:\/\/duo.com\/decipher\/the-rise-and-rise-of-business-email-compromise-scams\">rise\nin business email compromise<\/a>, phishing, and other email-related concerns, the\nmodern virtual mailbox represents a significant area of cyber security vulnerability. Unlike physical messages sent by a\nphysical mail carrier, emails can contain a variety of threats from attachments\ncontaining malware (often Microsoft Office files such as Excel spreadsheets and\nWord documents) to embedded links that direct users to malicious websites. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Many businesses tend to rely on the anti-spam filters that come with bundled with their email platform or antivirus programs to protect their business\u2019s communications. However, there are additional third-party email solutions that you can use such as anti phishing platforms and <a href=\"https:\/\/www.thesslstore.com\/enterprise\/email-document-signing-certificates.aspx\">email signing certificates<\/a>. <\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"How to Spot Phishing and Spam Emails (and what to do about it)\" width=\"960\" height=\"540\" src=\"https:\/\/www.youtube.com\/embed\/PnJJHaHmBJ0?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Anti phishing platforms can automatically identify and\neven quarantine potentially dangerous emails so users can\u2019t engage with them.\nSome anti phishing solutions even provide an educational component to help\nusers understand <em>why<\/em> emails are being\nquarantined (such as a sender\u2019s name not matching their email address or\nsignature, embedded links directing users to dangerous websites, etc.). Email\nsigning certificates allow users to digitally sign and encrypt emails\ncontaining sensitive or confidential information to avoid <a href=\"https:\/\/www.thesslstore.com\/blog\/man-in-the-middle-attack\/\">man-in-the-middle\n(MitM) attacks<\/a> and eavesdropping. By signing your emails, it allows your\nrecipients to authenticate that you are you and mitigates email tampering. <\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"334\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/No-MITM-Please-1024x334.png\" alt=\"\" class=\"wp-image-10556\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/No-MITM-Please-1024x334.png 1024w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/No-MITM-Please-300x98.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/No-MITM-Please-768x251.png 768w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/No-MITM-Please.png 1369w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">While putting these protections in place is exceedingly\nimportant, you still need to take it a step further and conduct periodic\nphishing simulations. This will allow you to test the cyber security awareness\nof your employees to assess how well they can apply the lessons from your\ntraining in real-life scenarios. Seeing whether employees are approaching email\nmore judiciously or are opening every messages with wild abandon will help you\nrecognize which employees are your biggest risks as well as identify new areas to\naddress with cyber security and phishing awareness training. &nbsp;<\/p>\n\n\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-to-prevent-cybercrime-step-7-monitor-traffic-and-access-to-increase-visibility\">How\nto prevent cybercrime\n\u2014 step #7: Monitor traffic and access to increase visibility<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you want to keep an eye out for danger, it\u2019s best to\nkeep the lights on, pay attention to everyone coming and going, and make\nregular patrols. What many businesses do instead is turn off the lights, turn\non the TV, and ignore everything else. By always keeping their attention\nfocused on something else and not paying attention to the traffic and things\ngoing on around them, they will miss important cues and won\u2019t be able to\nobserve or learn from situations that occur. <\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Surveillance-300x300.png\" alt=\"\" class=\"wp-image-10564\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Surveillance-300x300.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Surveillance.png 705w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">In a nutshell, this concept summarized the importance of IT\nthreat monitoring. This function involves continuous monitoring of the traffic,\naccess, and denial logs on your network and other IT infrastructure components\nsuch as servers and workstations. It can involve the use of security\ninformation and event management (SIEM) tools and intrusion detection\/intrusion\nprevention systems (IDS\/IPS) but also can include the services of a cyber\nsecurity operations center (CSOC). A CSOC team can provide 24\/7\/365 monitoring\nof systems and logs to ensure that threats are identified and addressed to\nmitigate damage. This can be particularly helpful in monitoring traffic to\nidentify distributed denial of service (DDoS) attacks, which can result in a\nslow network, iffy connectivity, or even website downtime. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-to-prevent-cybercrime-step-8-regularly-assess-and-test-your-systems\">How\nto prevent cybercrime\n\u2014 step #8: Regularly assess and test your systems<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Vulnerability\nassessments<\/strong>, <strong>risk assessments<\/strong>, and\n<strong>penetration tests<\/strong> are simultaneously\nthe best friends and annoying acquaintances of IT security experts everywhere.\nAlthough these terms are often incorrectly used interchangeably, these three\nmethods of IT security they are related but separate functions: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>A <a href=\"https:\/\/www.thesslstore.com\/symantec\/vulnerability-assessment.aspx\">vulnerability\nassessment<\/a> helps to identify, assess, and prioritize any vulnerability in cyber security that may exist in\nyour existing system. <\/li><li>A <a href=\"https:\/\/www.thesslstore.com\/blog\/cyber-risk-assessment\/\">risk assessment<\/a>,\non the other hand, is useful for evaluating potential risks for specific tasks\nor events (if you did \u201cA,\u201d then X could happen as a result). <\/li><li>Lastly, <a href=\"https:\/\/searchsecurity.techtarget.com\/definition\/penetration-testing\">penetration\ntests<\/a> are your IT security team\u2019s way of testing to see how your defenses\ncan be breached or compromised. <\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The goal with these tools is to help you understand the strengths\nand weaknesses of your cyber security posture. This knowledge is just as\nvaluable as knowing the strengths and weaknesses of your enemy \u2014 in this case,\nhackers or insider threats. This approach supports the <a href=\"https:\/\/www.forbes.com\/sites\/jessicahagy\/2013\/10\/08\/sun-tzus-the-art-of-war-illustrated-chapter-3\/#400541d24fce\">ancient\nwisdom<\/a> of Chinese military strategist Sun Tzu in (a translation of) his\nmilitary treatise \u201cThe Art of War\u201d: <\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Art-of-War-300x300.png\" alt=\"Sun Tzu\" class=\"wp-image-10555\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Art-of-War-300x300.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Art-of-War.png 672w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure><\/div>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><em>\u201cIf you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.\u201d <\/em><\/p><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">These tools are invaluable in terms of identifying network vulnerabilities, out-of-date software that need patching or\nupdates, gaps in your existing cyber security defenses, and other cyber security vulnerability concerns. &nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-to-prevent-cybercrime-step-9-develop-implement-and-enforce-security-policies\">How\nto prevent cybercrime\n\u2014 step #9: Develop, implement, and enforce security policies<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">While analyzing, poking, and prodding your network and\nother IT systems is great, you still need to take it a step further and implement\nother protective measures in the form of cyber security policies. In the world\nof IT security, there are many types of security-related policies to choose\nfrom such as computer use policies, password policies, remote access policies,\nemail\/communication policies \u2014 the list goes on and on. Each of these policies\nhas its own benefits and merits that should be considered. <\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Policies-300x300.png\" alt=\"Security Policies\" class=\"wp-image-10565\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Policies-300x300.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Policies.png 710w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Access management and an access control policy are also\nextremely important. Regularly review who has access to what systems,\ninformation, or data to ensure that you\u2019re not leaving your business open to\nattack or insider threats. Limit employee access through a policy of least\nprivilege (POLP) to ensure that each employee only has access to the tools and\ninformation their job necessitates. This will help to limit your potential risk\nby reducing the number of people who have access to your most valuable data.\nNIST offers a <a href=\"https:\/\/csrc.nist.gov\/projects\/access-control-policy-and-implementation-guides\">valuable\nresource<\/a> that links to several of their access control policy and\nimplementation guides that you can review for additional information. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Just remember, however, that a policy is only as good as\nits enforcement. If you put policies into effect but never follow up or enforce\nthem, then they are essentially useless documents that serve no purpose. Be\nsure to enforce each of your security policies to ensure that your business is\ngetting the most protection possible. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-final-thoughts\">Final thoughts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Because many (though not all) cybercrimes involve cyber security attacks and exploiting known and\nzero-day vulnerabilities, implementing this combination of tactics, policies,\nand processes will help to significantly strengthen your cyber security posture\n\u2014 and your level of <a href=\"https:\/\/www.thesslstore.com\/blog\/the-rise-of-cyber-resilience\/\">cyber\nresilience<\/a> along with it. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Hopefully, it also means that the song lyrics we shared\nwith you at the beginning of this article will change and be aimed at\nprospective hackers and threat actors: <\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"276\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Police-Song-300x276.png\" alt=\"\" class=\"wp-image-10566\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Police-Song-300x276.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Police-Song.png 404w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure><\/div>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><em>Every malware you make<\/em><\/p><p><em>Every piece of data you take<\/em><\/p><p><em>Every email you fake<\/em><\/p><p><em>Every website you scrape<\/em><\/p><p><em>I won\u2019t fall for you\u2026<\/em><\/p><p><em>(Or your cyber attack tactics).<\/em><\/p><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\"><em>What additional recommendations or best practices do you have on the topic of how to prevent cybercrime? <\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cybercrime has grown into a trillion dollar industry and no business &#8211; big or small &#8211; is safe. Here are 9 actionable tips for hardening your defenses to prevent cybercrime.<\/p>\n","protected":false},"author":17,"featured_media":10554,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16],"tags":[10202,10201],"class_list":["post-10553","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","tag-cybercrime-prevention","tag-itsecurity","post-with-tags"],"views":79157,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Prevent-Cybercrime-Feature.png","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/10553","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=10553"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/10553\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/10554"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=10553"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=10553"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=10553"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}