AXEL.org

Tech Tips

Cybersecurity Strategies for Small Businesses and Firms

When it comes to ransomware and data breaches, we mostly hear about the attacks on massive corporations. After all, these cyber-assaults can affect millions, so it only makes sense that attacks on big businesses are the ones we hear about. However, this creates a false assumption that only big businesses are affected by cybercrime. Unfortunately, this couldn’t be further from the truth. In fact, small businesses and firms are often targeted by cybercriminals due to their valuable data and relative lack of cybersecurity protocols [1]. Many smaller companies still have not taken the threat of cybercrime seriously. In fact, 51% of small businesses have not dedicated any resources to cybersecurity [2]. In 2021, a year full of cybercrime and ransomware attacks, that’s a recipe for disaster.

Ransomware and data breaches can affect anyone from first-year law students to senior executives. Of course, large companies have sizable cybersecurity operations, so if cybercriminals strike, they’re prepared. For small businesses and firms, however, it’s up to individuals to protect themselves and their clients. Thankfully, there are easy, inexpensive ways for smaller companies to keep themselves safe from cybercrime.

Secure Passwords

Many of us are guilty of using the same password for multiple accounts. It’s perfectly logical to reuse passwords sometimes when we have hundreds of online accounts for various businesses, social media sites and software. However, using just one password for all your accounts can be disastrous, especially if your work passwords are reused. Think about it: If your Facebook password is leaked, and you have the same password for every account, in effect, all your accounts are leaked. While you don’t need unique, thirty-character-long passwords for every account, ensuring that your passwords are varied and strong keeps your most important data safe. Having one of your passwords leaked is bad, but manageable; having all of your passwords leaked is catastrophic.

Cyber Insurance

Cybercrime can still occur even when precautions have been taken. That’s why it may be smart to invest in a relatively new insurance offering, cyber insurance. Many large corporations utilize cyber insurance to minimize the financial risk of a data breach. In fact, after Target’s 2013 data breach, cyber insurance covered USD $90 million of the total damages [3]. For smaller businesses and law firms, one cyberattack could be financially devastating enough to shutter doors permanently. It is a significant investment, but cyber insurance could pay off in the long term.

Ethical Hackers

One of the quickest, easiest ways to determine if your small firm has a security hole is to hire a white hat, or ethical, hacker. The job of a white hat hacker is to breach a company’s computer system, but with permission. Once the hacker gains access to the system, they can snoop around, looking for vulnerabilities. If a vulnerability is found, they simply tell the company and potentially fix it. While the idea of letting a stranger into your computer systems may sound frightening, this process is one of the best ways to prepare for cybercrime. After all, if you find and patch the vulnerabilities, there isn’t much a cybercriminal can do to your business.

Of course, ethical hackers don’t come cheap, and the more experienced an ethical hacker is, the higher the cost. Big corporations have paid from USD $1,000 to USD $15,000 for white hat hackers to breach their computer systems and look for security vulnerabilities [4]. While hiring or contracting an ethical hacker can be a large investment, there’s no better way to determine if your firm is prepared for a cybercriminal attack.

Culture of Security

In addition to paid solutions, a free technique to protect you and your firm’s cybersecurity is to encourage a culture of security. This means updating your software often, using encryption, and being knowledgeable about modern technology and its risks. First, updating your software is one of the easiest ways to minimize the risk of cybercrime. In fact, the infamous Equifax data breach of 2017 occurred because Equifax simply forgot to update its security software when a vulnerability was detected [5]. Keeping software up-to-date is one of the simplest ways to keep yourself and your firm protected. Next, using encryption is an inexpensive, useful tool to keep your documents safe from data breaches. If your documents are unencrypted, cybercriminals have easy access to your most vital files. Encryption provides an extra layer of security that keeps your documents safe from data breaches and leaks.

Finally, cybersecurity education is the largest part of a culture of security. When everyone is aware of cybersecurity risks like phishing scams and the danger of public Wi-Fi, the risk of cybercrime is minimized. Simply informing your friends and coworkers about modern cybersecurity risks helps cultivate a culture of security that helps you (and your clients) stay safe from cybercrime. Simply put, staying informed on cybersecurity is a long-term, effective solution to minimize the risk of ransomware attacks and data breaches.

Backup Your Data

Whether you’re a thirty-year veteran at a firm or just starting your first job in the workforce, backing up your data offline could be the most important strategy on this list. Security vulnerabilities and cybercriminals pose a threat to cloud-based files. If you get locked out of this online data by cybercriminals, you’ll be forced to either pay a hefty ransom or lose all of your online files. The solution? Simply backup your documents offline. And don’t do it just once! At least monthly, copy your files to an offline hard drive. Backing up your documents offline ensures that you, or your firm, are able to continue working even if a cyberattack hits.

Try AXEL Go

If you’re ready to start creating your culture of security, try AXEL Go. AXEL Go is a cloud file-sharing software with an unwavering focus on privacy. AXEL Go lets employees and students share, store, and collect documents securely, all in a simple, easy-to-understand user interface. Offering military-grade encryption, blockchain technology, and decentralized servers, AXEL Go offers the perfect pairing of simplicity and stringent security. To try AXEL Go free for two weeks, click here.

[1] Shankar, AJ. “Council Post: Ransomware Attackers Take Aim at Law Firms.” Forbes. Forbes Magazine, March 11, 2021. https://www.forbes.com/sites/forbestechcouncil/2021/03/12/ransomware-attackers-take-aim-at-aw-firms/

[2] Knutson, Ted. “Small Businesses Bearing Brunt of Ransomware Attacks, Senate Told.” Forbes. Forbes Magazine, July 28, 2021. https://www.forbes.com/sites/tedknutson/2021/07/27/small-businesses-bearing-brunt-of-ransomware-attacks-senate-told/?sh=705864499556

[3] Newman, Craig. “Target’s Cyber Insurance: A $100 Million Policy vs. $300 Million (so Far) in Costs.” Patterson Belknap Webb & Tyler LLP, January 16, 2019. https://www.pbwt.com/data-security-law-blog/targets-cyber-insurance-a-100-million-policy-vs-300-million-so-far-in-costs/

[4] Fazzini, Kate. “Some Freelance Hackers Can Get Paid $500,000 a Year to Test Defenses of Companies like Tesla.” CNBC. CNBC, December 13, 2018. https://www.cnbc.com/2018/12/12/freelance-hackers-get-paid-to-test-the-defenses-of-firms-like-tesla.html

[5] Ng, Alfred. “How the Equifax Hack Happened, and What Still Needs to Be Done.” CNET. CNET, September 7, 2018. https://www.cnet.com/tech/services-and-software/equifaxs-hack-one-year-later-a-look-back-at-how-it-happened-and-whats-changed/

Lawyers are the New I.T.: Tech Tips for Legal Professionals

As workplaces embrace modern technology more than ever before, knowledge of that technology is essential. No matter your job, employees must possess some amount of technical skill in order to maintain efficiency and complete their tasks. Even the most traditional law firms in the United States use some amount of technology. However, no matter if you work at a more traditional firm or one that has gleefully embraced legal tech, we can all become more advanced and efficient with our technology.

From increasing efficiency to protecting your business (and your clients), these tech tips will help ensure your firm is offering the very best.

Embrace New Tech

This may sound simple, but embracing new technology is one of the best ways to stay efficient and safe in the workplace. No, you don’t have to buy new computers every six months, but being aware and researching new programs can give you an edge over the competition. Find out what software can help automate your tasks, or what legal tech program saves your firm valuable time.

The best businesses are all embracing the technology that is available to them. However, change can certainly be scary. After all, many of us learned to work from home, using new software and programs that we weren’t used to. It was undoubtedly stressful to learn so many new programs in a short amount of time. But after a bit, we got used to it. We mastered the new technology, and are more efficient and successful because of it. Using new technology can be daunting, but it undoubtedly helps yourself and your business in the long run.

Update, Update, Update

Updating your software is one of the most important (and easiest) tech tasks to complete. We’ve all seen them and occasionally ignore them. Restarting a device in the middle of a workday can certainly be annoying, but it’s vital to do so. Software updates patch security holes and other vulnerabilities in your software. And as we’ve seen with the numerous ransomware attacks this year, cybercriminals will find these vulnerabilities and exploit you and your business without hesitation. Updating your operating systems and security software will give you more protection against these threats.

Take Advantage of Free Trials

Many legal tech providers offer free trials of their products for firms. Use them! Test out new programs often to see if it works for your firm. Don’t become complacent simply because you’re used to a certain software. If there’s software that fits your firm’s needs better, try it out.

Technology has never been stagnant; it advances quickly, and new programs that maximize efficiency can come quickly as well. Being open-minded about new programs and software will help ensure your firm is as efficient as possible. Of course, this doesn’t mean you should change your entire firm’s software every week, but learning about and testing out new programs will keep you knowledgeable about the technology that could potentially help your firm. And when a new program comes out that works perfectly for your workplace, you’ll be the first to take advantage of it.

Learn Your Technology

Most of us know the basics of computers and common software, but there are so many more things to learn. From the classic “Ctrl + C” and “Ctrl + V” for copying and pasting to the most advanced Excel commands, there are so many ways to maximize efficiency with shortcuts. Take an afternoon to learn and practice shortcuts that can help your efficiency at the office. And when your business upgrades to new software, learn that software quickly as well! Learning the ins and outs of programs can save you hours per day, leaving more time available for other projects.

In addition to learning about your technology, you should learn what to do when the technology suddenly stops working. From Internet outages to hardware malfunctions, be aware of common troubleshooting techniques to help prevent costly, efficiency-killing problems throughout the office. Learning these techniques can save you both time and money.

Backup Your Documents

Unfortunately in today’s digital era, online documents are constantly in jeopardy. Security holes, data breaches, and cybercriminals all pose a threat to data in the cloud. The solution? Make sure your data is available offline. This means putting your documents (yes, all of them) onto a physical hard drive, safe from online dangers.

In addition, you should update your hard drive often. Don’t make it a one-and-done task; update your hard drive monthly. This ensures that all of your data, including your most recent documents, are safe and secure from cybercriminals and ransomware attacks. After all, they can’t hold your data hostage if you already have it offline. So while this is a monthly task that takes some time, it gives yourself and your business peace of mind, with the knowledge that your data will always be available.

Encrypt Your Data

Finally, to truly protect your data, encryption is the way to go. Encryption changes your data into a code, and can only be accessed with a “key” to that code. This means if hackers got ahold of your encrypted data, they would have nothing of value. It really is the ultimate form of protection from cybercriminals and data breaches.

However, not all encryption is built the same. For example, AXEL Go, AXEL’s file-sharing and cloud-storage software, offers industry-leading AES 256-bit encryption. While 256-bit encryption may not sound impressive, in practice, it is astoundingly secure. The number of potential combinations to find the “key” is a massive 78-digit number. Experts estimate it would take the world’s fastest supercomputer billions of years to find the encryption key. So even if thieves got their hands on your encrypted data, it’s worthless to them, but usable for you.

Get Two Free Weeks of AXEL Go

If you’re ready to embrace new technology and protect your data, try two free weeks of AXEL Go. AXEL Go is a file-sharing software with an unwavering focus on security. AXEL Go lets employees share, store, and collect documents securely, all in a simple, easy-to-understand user interface. Offering blockchain technology, military-grade encryption, and digital “shredding,” AXEL Go offers the perfect marriage of simplicity and stringent security. To try AXEL Go for free for two weeks, click here.

The 10 WORST Data Breaches of the Decade

As another decade comes to a close, now is the perfect time to reflect on some of the top 10 worst data breaches and cyber-security blunders from the last ten years. Over the 2010s, we’ve seen the pace of technological growth rapidly advance. From the development of facial recognition software to the growth of artificial intelligence and quantum computing, the digital age has taken a monumental leap forward.

And while this technology has brought innumerable benefits, the vast quantity of personal information now stored digitally has exposed us to catastrophic privacy violations from even the smallest data breach.

While there have been data breaches as long as data has existed, the danger has never been more apparent. Our entire lives are stored digitally, from personal files like family photos to vital business data like employee records and legal documents. The digital world is inescapable, and millions of users across the web are unknowingly putting their privacy at risk.

Data breaches have become so common that society has become desensitized to the effects, which, ironically, makes it all that more dangerous.

So in case you’ve forgotten just how pervasive data breaches have become, we’ve assembled a list of the ten most damaging breaches of the last decade.

10) Facebook

Date: 2017-2019
Impact: 50 Million Users

Starting off our list is the social media powerhouse, Facebook. Although a prominent social platform, Facebook is not 100% bulletproof and has become a victim to hackers and data breaches in the past. Two years ago, Facebook announced the discovery of a bug in their site that resulted in the exposure of over 50 million accounts. By abusing the flaw, hackers were able to obtain account access tokens, which are security keys that enable users to stay logged into a Facebook account without the need to re-enter passwords when returning to the site. The real significance of this data breach was that the access tokens didn’t just allow hackers to spy on users’ private information; the tokens gave hackers full control over the victims’ accounts. The breach forced Facebook to reset the access tokens of the over 50 million affected accounts, in addition to 40 million more accounts out of precaution. (Source)

9) Uber

Date: 2016
Impact: 57 Million Users

Uber, a multi-national ride-sharing company, suffered a major data breach in 2016, which involved at least 7 million drivers and 50 million passengers. The breach compromised all sorts of personal information: names, email addresses, and phone numbers, to name but a few examples. In addition, the breach exposed over 600,000 drivers’ license numbers. What makes this data breach so much worse, is that Uber initially attempted to hide the incident to regulators and users. Instead, Uber tried to pay a $100,000.00 ransom to the hackers, in the hope that they would get rid of the data and keep the breach concealed from the public. Their plan failed, but to Uber’s credit, they did take immediate steps to secure the data and shut down further unauthorized access by the hackers. (Source)

8) JP Morgan Chase

Date: 2014
Impact: 76 Million Users and 7 Million Small Businesses

In 2014, JPMorgan Chase was the victim of a cyber-attack that resulted in the theft of nearly 80 million users’ data. From confidential information like home addresses to business information like corporate banking documents, the breach affected millions of files. Reporters and journalists stated that the hackers likely operated out of Russia or Eastern Europe and that they were able to break into the Chase network by hacking a Chase employee’s personal computer. (Source)

7) Target

Date: 2013
Impact: 110 Million Accounts

The retail giant faced a data breach that resulted in the unauthorized access of almost 110 million accounts. The attackers stole information stored on the magnetic stripe of the back of credit and debit cards swiped in several Target stores. It was incidents like this that contributed to the rise of the EMV chip, now embedded into all new credit and debit cards. Several years later, Target paid out an $18.5-million-dollar settlement, which included a $10,000.00 payment to consumers who provided evidence that they suffered losses resulting from the data breach. (Source)

6) eBay

Date: 2014
Impact: 145 Million Users

In 2014, the online commerce company, eBay, announced that its records had been breached and suggested that almost 145 million users needed to change their passwords. This cyber-attack was carried out by a team of hackers who were able to obtain the credentials of three eBay employees. Names, emails, passwords, and even security questions were all compromised in the hack. Even more concerning was that due to eBay and Paypal being so interconnected, hackers were able to gain access to people’s Paypal accounts too. In the end, eBay did not provide any reimbursement towards the consumers that had their credentials misused or their money stolen. (Source)

5) Equifax

Date: 2017
Impact: 148 Million Users

Equifax, one of the largest consumer credit reporting agencies in the United States, suffered a data breach in September 2017. In addition to the theft of 209,000 credit card numbers, approximately 148 million Americans had their name, phone number, home address, date of birth, driver’s license number, and social security number compromised as well. As more details came to light, a lack of regard for consumer data by many of Equifax’s senior staff became apparent. It was a catastrophe; they even hired a Chief Information Security Officer who’s credentials were entirely made up of not one, but two degrees, in music. Yes, music.

Fast forward to July 2019, Equifax announced a $675 million consumer settlement. They offered people who were affected by the breach a choice of  4-years of free credit monitoring services or a $125 cash payment. (Source)

4) Adult Friend Finder

Date: 2016
Impact: 400 Million Users

Almost half a billion users had their data compromised from a litany of websites across the FriendFinder network. Over 20 years of data, including names, email addresses, and passwords were all exposed. Even more worrying, is that this wasn’t FriendFinder’s first rodeo…

In May 2015, it was revealed that around 4 million FriendFinder accounts were stolen. The good news is that FriendFinder was transparent and updated the public as soon as they became aware of the attack. The breadth of this data breach is still under investigation; however, FriendFinder Networks suggests that all users reset their passwords. (Source)

3) Marriot International

Date: 2018
Impact: 500 Million Customers

In November 2018, Marriot International announced that a data breach had occurred within their system. However, the incident initially began in 2014. The breach originated in the Starwood Hotel guest reservation database, where hackers laid dormant in the system for several years before Marriott acquired the company. With that time, the attackers were able to steal passport and credit card information from hundreds of millions of people. (Source)

2) First American

Date: 2019
Impact: 885 Million Customers

Not only is First American second on this list because of volume, but they are here due to their carelessness. Data from at least 885 million people was easily accessible on the First American’s site by inputting a specific set of URLs. These URL’s had a sequential system, meaning you could simply plug and play with different numbers to find confidential information. This sort of reckless behavior regarding data security seems like it would be a story from the 1990’s. What makes it so sad though… is this is the most recent data breach on this list, occurring in 2019. (Source)

1) Yahoo!

Date: 2013-2014
Impact: Over 3 Billion Users

Yahoo takes the number one spot for the largest data breach of the decade due to the pure volume of records stolen. The internet giant that was once the face of the internet had names, email addresses, passwords, and security questions compromised due to outdated and easy-to-crack encryption. Also, Yahoo failed to correctly pinpoint the number of users affected and released several revisions on the estimate. In 2016, Yahoo announced that 500 million users had their data compromised in a 2014 data breach. That announcement was later amended with information that there was another 2013 data breach that affected approximately 1 billion users. After drastically increasing the estimate with each subsequent announcement, the final estimate was that over 3 billion people were affected. In the spirit of schadenfreude, though, you can find some solace in knowing that Yahoo did pay. When the breach was announced, Yahoo was in the process of selling the company to Verizon. The data breaches ended up chopping off approximately $350 million off Yahoo’s sale price and the two companies agreed to share regulatory and legal liabilities from the incident. (Source)

On the plus side, a class-action lawsuit was filed against Yahoo and people who’ve had a Yahoo account since 2012 are entitled to up to $358.80 of compensation. You can learn more on YahooDataBreachSettlement.com. Don’t let these Yahoo’s get off cheap for exposing your data.

—

Based on big tech’s terrible track record with data protection, it is safe to say that our data is not safe. Cybersecurity, which should be at the forefront of any company’s mind -especially when you hold the private information of millions of people- is looked at as an expense to be mitigated.

And what may be the most disheartening part is that it’s not a super team of elite hackers cracking into databases. It’s pure and simple negligence in many cases, from not updating security software, to leaving private information exposed on a public database with no password.

But finally, the decade is coming to an end, and hopefully, data breaches are ending with it. But with how little is being done to prevent them… it might be best to start keeping your data to yourself.

Your Unlocked Phone In A Stranger’s Hand? It Might Happen When You Fly Internationally

Belts off, shoes off, keys, and pocket change in the bin.

Most of us know the routine by heart. Before we even get to the front of the line we have a security bin in our hands. It’s all become so routine it’s second nature.

On the one hand, we know it’s a complete pain but on the other hand most of us have adopted an “it’s better to be safe than sorry” stance on this matter.

When does it go too far?

When does security cross the line from vigilance to invasion of privacy?

Is it when the TSA agents are giving you the kind of pat-down that your doctor wouldn’t do? Is it when they’re grilling you about every minute detail of your trip? Is it when an agent is rifling through the unmentionables in your luggage?…

…Or, maybe, it’s when they’re asking you to unlock your smartphone?

You read that correctly. There is a staggering increase in the amount of searches where a traveler’s phone is being accessed by agents. Does that make you feel secure or  violated?

Your smartphone is an extension of your life

Do you go around handing photos of your kids to complete strangers? How about confidential company documents? What about your personal medical documents?

Now think about what you keep on your phone. There is so much personal data on our phones. Data that we want to keep private. After all, that’s why we put passcodes and use thumbprint IDs to unlock our phones.

Our phones are more than just a device to make calls. It’s the one thing most of us use every day and carry with us wherever we go.

Think about your pictures, your emails, your documents, and even your message chats.

To say that our phones hold all the information about our lives wouldn’t be an exaggeration. Spend 30 minutes looking at someone’s unlocked phone and you will gain a lot of insight into that person.

So ask yourself, how comfortable would you feel with a stranger taking your unlocked phone into a private room for 30 minutes or more?

That’s the question many travelers are asking themselves lately.

The rules that you think are protecting you aren’t

Some of you may be tempted to dismiss this as a serious concern. After all it seems like it’s an illegal action being taken by overzealous border agents. And that’s what the constitution is for.

If there’s one thing most Americans are familiar with, it’s the constitution.

The Fourth Amendment prevents illegal search and seizure.

The Fifth Amendment prevents self-incrimination.

These are some of the bedrocks of the constitution and it protects the privacy rights for Americans. It also doesn’t protect you in this case.

Yes, that’s correct. The constitution doesn’t protect you when it comes to your phone being searched when you’re flying.

How is this possible? Well, the same way most questionable actions are legitimized…by a loophole.

Decades ago the Supreme Court created an exception for border agents with regards to the Fourth Amendment. So technically they can search whatever they want and there’s nothing to stop them.

So while it would be illegal for a police officer to stop you and ask you to unlock your phone, it’s perfectly legal for a border agent to do so.

What, me worry?

As you read about this issue another temptation might be to come up with reasons why you don’t think you should worry about this.

You might say to yourself “I’m a US citizen, this only applies to non-Americans”. But unfortunately you’d be wrong about that. American-born citizens have had to turn in their phones at the border already.

As a matter of fact, according to a recent lawsuit, NASA engineers, journalists, and even military veterans (all of whom are American citizens) have recently had to unlock their phones when entering the country.

Even phones that were government-issued and might contain confidential data were subject to being searched at the border.

So no one is immune from this scrutiny.

Another thing many people might say (wrongly) to themselves is the belief that “I’ve done nothing wrong so I’ve got nothing to hide”. But it’s never that simple.

Again, think about all the information that you have on your phone. Is it possible that a friend of a friend on Facebook is a criminal? What about the people you follow on Twitter? Guilty by association, perhaps?

Have you ever made a comment, seriously or in jest, about the government or the President? What if you’re reading a fictional book about a government revolution or terrorist attack?

It might seem extreme but it doesn’t take much for something innocent to lead to further scrutiny. Suddenly your phone isn’t just taken for 30 minutes but for 10 hours.

Different story now isn’t it?

And for those of you that aren’t American and are shaking their heads and thinking “this would never happen in my country”, you might want to rethink that position. Similar scenarios have already happened in Canada and there are reports of it occurring in the UK and Australia as well.

They have the power, you have the control

This situation sucks. The bad (and obvious) news is that you’re left without a choice. Border agents have all the power in this situation and if you want to get back into the country you need to comply.

The good news is that you do have a choice in how much information they get. As we’ve been known to say around here, awareness about an issue is the first step. So now that you’re aware, you can prepare yourself.

Here are some options that you can take before your next flight:

  • Don’t take your devices with you: This might be easier said than done. But for many people going on vacation, is it really necessary to bring your phone with you?If you need to take pictures you can bring a digital camera, if you want to connect to the Internet then you can take something like an iPod that has Wi-Fi capabilities. There are alternatives to having to take your smartphone with you.
  • Restore your phone to factory settings: Just backup all the data on your phone so it’s saved securely, and once it is you can restore your phone to its factory setting for your trip. All your files and apps will be off your phone and anyone who looks at it will be looking at essentially a blank device. When you return you can restore your backup so your phone is back to the way it was before your trip.
  • Buy/rent a temporary phone: If you really need a phone on your trip you can leave your main phone back at home and grab a rental or prepaid phone in your new destination.You’ll get a number for people who need to contact you and many of them come with a data plan as well. You just use it for the duration of the trip and then return it once you’re done, or simply save it for your next trip.

Doors locked, oven turned off, private phone data secured

These solutions might seem a bit extreme but keeping your data private is not a joke. It’s just a fact of life that this is something you may encounter when it comes to flying.

It’s always important to be prepared and aware whenever there’s a situation where your private data might get accessed by someone you wouldn’t want. Unfortunately this is where we’re at in society.

For better or worse security has taken us here, so it’s up to us to determine how much information we want to give up.

Ultimately it’ll be up to each individual to decide if they’re comfortable handing an unlocked phone to a complete stranger or not.

If this is something you aren’t comfortable with then at least you know what you’re up against and you can take whatever steps you need.

Traveling comes with enough stress and anxiety, and the last thing you need to worry about is an invasion of privacy. By taking these steps you’ll be ensured that your vacation is smooth sailing all the way.