(Digital Safety – 3 Minute read)
Hi there accounting fans! We’re back for part 2 of this awesome article written by our OpSec guru, Chan Ju Ping!
Backup All Essential Data for digital safety
When all else fails, and your sites, services, or devices still got pwned. You may get a ransom demand from the hacker for USD1500 in Bitcoin. You will be glad you made a backup of your entire system periodically.
This is what I did prior to trying to move The Comic Accountant’s site to the current domain. The purpose was to restore the site should I make any changes that would result in the site being unavailable.
Using Jetpack, I would be able to keep a running backup based on any updates made to the site. The initial plan was to test out that the backing up and cloning process would work without a cinch. Then do a final clone before shifting operations to the current site we are on.
That didn’t happen after one of you reported Malwarebytes detected trojans on his site (Thanks, Accounting fans!). We then made the pivot into disabling the site itself. Using the backup to salvage all the most important items, the site content. The Comic Accountant’s team, to their credit, also had the site backed up as well prior to me rolling in with my own solutions.
When planning for a backup, it’s best to have at least 2 separate backup locations. The first backup location for most people is in a cloud storage provider like Google Drive or OneDrive. The second option then should be a physical hard drive on premise which you make regular backups to.
If the data is particularly important, consider ‘air-gapped’ principles. This means having a computer that is never connected to the Internet, and all data is transferred via external storage.
Creating digital safety for your team
LAPSUS$ was offering to pay up to $20,000 to employees of several companies to gain access to internal systems. Insider attacks are one of the most difficult attacks to defend yourself against.The only real counter is to ensure that you pay your team well and treat them with a high-degree of respect. Then they wouldn’t think of stabbing you in the back at the first opportunity.
For fraud to happen, there needs to be both a means and a motivation. So if you get rid of the motivation, there is less chance of fraud happening.
Compartmentalizing your online service or business into independently-managed units with strict policies in place for access would also help mitigate the damage somewhat. Insider attacks can be the most damaging of all potential attacks as they can disable or work around any of the mitigation tactics described in this document. Ultimately, technological solutions can only go so far, and it is our human connections that may serve to be our best defense after all.
Tips to stay safe!
In summary, here are the items you can immediately implement:
- Activate MFA for all your online accounts as far as and as soon as possible. Use security keys, and if unavailable use app-based MFAs like Authy or Google Authenticator.
- Remove phone numbers as a tool to verify logins.
- Use a password manager.
- Backup all essential data regularly.
For further reading, I recommend checking out articles from the Electronic Frontier Foundation. Their section on Surveillance Self-Defense is an excellent document that covers most of your everyday security needs, and more.
In any organization, your defense is only as strong as your weakest link. If you are still a small company, it is easier to implement these security practices for everyone involved. If you grow your company into a larger organization, these practices should grow with you as well such that security culture is the de facto culture in your company.