"According to a recent study cited by the U.S. House Small Business
Subcommittee on Health and Technology, nearly 20% of all cyber attacks
hit small businesses with 250 or fewer employees. Roughly 60% of small
businesses close within six months of a cyber attack." (Source: Forbes)
This is an amazing statistic. It's something we've been talking a lot about it our local Manchester, NH area. Having just opened in April, we've been doing our networking. For the last several years I've been working in and with large enterprise, global in scope corporations --both as an employee, and as a government Infosec worker --a director at the DoD Cyber Crime Center (DC3). This mostly home based from the Baltimore-DC area, but now, participating in the local ISC2 meetings and talking with the owners of local businesses instead of the CISOs of large companies, I've come to the realization that our government (at least DoD) really has no clue just how bad it is for small and medium sized companies. I recall a conversation with a CISO who told me that nearly 60% of their critical suppliers were companies with less than 25 employees!
So during my local polling at a local Chamber event, many of the companies had no idea what APT was, nor had they any idea that employees walking working from home, leaving the company, angry on the job (scheming to leave), building their own companies on the side, etc., can, and do take information from their current employer. And not only do they take information from their current employer, they often times use this information to compete. The Forbes article talks of an a company who continues to lose contracts to the same competitor, only to realize they'd left the employee's computer access turned on after he left.
Carnegie Mellon has a center that does Insider Threat studies. I did a bit of work with them a few years ago. They do case studies of insider threats --how do insiders break, steal, compete with their former employers either as they're heading out the door, disgruntled and terminated, or just plain through stupidity while still employed (I had an employee once who used our corporate web template to build his own website selling pianos!). In nearly every case, interactions between HR and the employees managers could have helped prevent many of these issues. In all of these cases, monitoring employee computer use, notifying the employee that their system would be monitored during personnel improvement plans, during the last two weeks of employment, and post employment could have saved these companies a lot of heart ache, and more importantly, a ton of money.
So where does Wapack Labs fit?
Most small businesses have no clue what a forensic lab can do for them.
Wapack can tell you, with high levels of certainty, if employees are, or have stolen from you. We'll make two copies of the hard drive, placing an exact duplicate back in the machine. We'll place the original in our safe (for use in court if needed), and examine the second exact copy. We'll look at everything from outbound emails, to copies of files moved to external media (i.e.: USB sticks).
If you've got a problem employee, don't wait. Call us today for a free consult. We'll help devise a strategy that will help protect you from losses of insider threats. And if you get hit with an attack from outside of your company, Wapack can help with that too.
Happy Memorial Day!
