AXEL.org

cybersecurity

Big Tech’s Big Secret: Why Google and Apple Want Your Data

Two of the biggest tech companies in Silicon Valley have long been rivals. Whether it be iPhone vs. Android or Chrome vs. Safari, Apple and Google have never been on the friendliest of terms. Except for one, massive partnership. This year, Google is expected to pay Apple USD $15 billion to have Google be the default search engine on Safari [1]. At first, this deal seems like a head-scratcher. After all, why would Google pay its biggest rival billions when most already prefer Google as their search engine of choice? Put simply, Google outbids others to ensure other corporations (namely, Microsoft) can’t have their search engines become the default.

In addition to the two companies’ rivalry, there is another reason why Apple and Google’s lucrative partnership is so puzzling. Specifically, the two corporations’ stance on data privacy. In recent years, Apple has highlighted its privacy features extensively, with entire marketing campaigns dedicated to showcasing Apple’s (seemingly) hard-line stance on user privacy. On the other hand, Google’s revenue depends on advertising, and thus, user data. Over 80% of Google’s revenue comes from targeted advertising [2]. Overall, Apple and Google’s partnership shows how Big Tech companies that claim to prioritize your privacy may sacrifice that right for a big payday.

Apple’s Stance on Privacy

Just a few months ago, Apple launched a marketing campaign with the tagline “Privacy. That’s iPhone [3].” Clearly, Apple knows that privacy is something that the public wants, particularly in today’s Digital Age. In fact, Apple even states that “Privacy is a fundamental human right” on its website. On Apple’s site that details its privacy features, the company touts that Maps “doesn’t associate your data with your Apple ID” and that “your Apple ID isn’t connected to Siri.” Finally, Apple states that Safari “helps stop advertisers that follow you from site to site [4].” Clearly, Apple wants its users to believe their data is protected with them. Put simply, Apple wants to market itself as the Big Tech company that actually cares about your privacy. But is that the case?

Well, not really. While Apple is certainly better with privacy than most other Silicon Valley giants, that’s not a particularly high bar to clear. Apple still collects data in aggregate and keeps your exact maps locations for 24 hours [5]. While Apple may say that the benefits of this data collection vastly outweigh the harms, they’re still collecting the data. But worst of all, Apple still allows apps that don’t care about privacy at all. All of Apple’s privacy features are only on its own software. If you use more popular apps, such as Google Maps, Gmail, Facebook, YouTube, and others, you’re not protecting your data, even if you’re using the apps on an iPhone.

So while Apple talks a big game, and has certainly made positive steps toward a more private future, it’s still misleading to say Apple truly cares about your privacy. By still allowing data-hungry apps on its App Store, your data is still exposed on Apple’s hardware. Of course, Apple is a business, and simply not allowing these popular apps would be a massive change. However, the implication that all of your data is protected on Apple devices is simply misleading.

Google and User Privacy

While Apple has taken some steps to protect user data, Google’s entire business model depends upon the collection and sale of data. Google collects, among other things, website histories, Gmail data (including email drafts), and specific location data, even when the Google Maps app isn’t open [6]. Google then takes that personal data and sells it, allowing companies to target their ads to specific audiences. With this hyper-specific information, Google can line its pockets with revenue, while your data is exposed to advertisers.

In fact, Google’s entire business model is the sale of user data. That’s why nearly all of Google’s products are completely free. From Google Maps to YouTube, Gmail to Drive, Google offers all of these services for free. And many have wondered how Google can offer such complicated software for no cost. The answer? Google’s software isn’t their main product. You are their main product.

For Big Tech, It’s All About Ads

Unfortunately, Google is just one of many corporations whose main product isn’t software or programs. It’s you and your data. Similar to Google, Facebook makes the vast majority of its revenue through ads. Facebook learns as much as possible about you, then uses that data to deluge your timeline with hyper-specific ads [7]. Additionally, the goal of Amazon’s expansion into smart speakers and grocery stores isn’t just to offer a wider suite of products. It’s about gathering even more information about its customers and sharing that with advertisers [8]. 

While Facebook and Amazon both carefully state that they don’t “sell” your data to third parties, they do “share” your data with third parties. In practice, this still means advertisers can pay for access to your data. And, unfortunately, that is how most Big Tech companies operate. While these mega-corporations may offer a variety of free software and products to customers, those aren’t their main business. If they aren’t selling products or services, they’re selling you.

AXEL is Different

At AXEL, we also believe that privacy is a human right. Unlike other companies though, we don’t hide behind our slogans. AXEL takes steps to ensure your data is protected from cybercriminals and advertisers alike. From military-grade encryption to blockchain technology, AXEL offers the most stringent security for your most important data.

Additionally, with AXEL, you’re not the product. That’s why we never sell your data to any third party. We don’t offer any “too good to be true” deals while selling your data on the side. AXEL Go is a secure file-sharing and storage software that puts you in control of your data. If you’re ready to take back control of your data, try two weeks of AXEL Go for free here. After the free trial, AXEL Go is just $9.99 per month. After all, our business model is offering the best, most secure file-sharing service to all; not offering your private data to the highest bidder.

[1] Ion, Florence. “Google Continues to Pay Apple Billions to Keep You From Using… Bing?” Gizmodo. August 26, 2021. https://gizmodo.com/google-will-continue-to-pay-apple-billions-to-keep-you-1847564608.

[2] Graham, Megan, and Jennifer Elias. “How Google’s $150 Billion Advertising Business Works.” CNBC. May 21, 2021. https://www.cnbc.com/2021/05/18/how-does-google-make-money-advertising-business-breakdown-.html.

[3] Apple. YouTube. May 20, 2021.

https://www.youtube.com/watch?v=8w4qPUSG17Y.

[4] “Privacy.” Apple. 

https://www.apple.com/privacy/.

[5] “Apple Delivers a New Redesigned Maps for All Users in the United States.” Apple Newsroom. August 06, 2021. https://www.apple.com/newsroom/2020/01/apple-delivers-a-new-redesigned-maps-for-all-users-in-the-united-states/.

[6] Haselton, Todd. “How to Find out What Google Knows about You and Limit the Data It Collects.” CNBC. December 06, 2017. https://www.cnbc.com/2017/11/20/what-does-google-know-about-me.html.

[7] Gilbert, Ben. “How Facebook Makes Money from Your Data, in Mark Zuckerberg’s Words.” Business Insider. April 11, 2018. https://www.businessinsider.com/how-facebook-makes-money-according-to-mark-zuckerberg-2018-4.
[8] M, Laura. “Does Amazon Sell Your Personal Information?” DeleteMe. August 21, 2020. https://joindeleteme.com/blog/does-amazon-sell-your-personal-information/.

Data Privacy and Security Increase Profitability in the Cannabis Industry

Experts estimate that the cannabis industry is currently worth $60 billion, and that number is predicted to grow to $100 billion by 2030. As this industry grows and the customer base gets larger, so too does the need for modern data custody technologies. It might not be obvious at first glance, but data custody and security are critical components of running a successful cannabis business. Here are four reasons why.

The Importance of Data Security in the Cannabis Industry

First, medical dispensaries could be considered “healthcare providers” under the Health Insurance Portability and Accountability Act (HIPAA). Under HIPAA, healthcare providers must implement safeguards to prevent the incidental disclosure of any patient’s “protected health information.” Disclosures could result in a fine of up to $50,000 per disclosure. 

Second, each cannabis company has numerous trade secrets to protect. These could include growing processes, distribution plans, recipes for edibles, extraction techniques, soil mixtures, etc. The theft of any of these trade secrets could be disastrous to a company.

Third, cannabis companies must comply with (sometimes conflicting) state laws. For example, in California, the Medicinal and Adult-Use Cannabis Regulation and Safety Act (MAUCRSA) requires cannabis delivery companies to maintain records of every person who receives a delivery. At the same time, the California Consumer Privacy Act (CCPA) gives customers the right to demand that companies delete any records pertaining to them.

Fourth, data breaches result in damage to a company’s reputation. Dispensaries often sell T-shirts and other merchandise stamped with the company logo to foster customer loyalty, but a newsworthy data breach could shake that loyalty. Further, data breaches could damage the industry’s image as a whole and become a roadblock to legalization efforts at the federal level.

Room for Improvement

Last year, a group of ethical “white hat” hackers located a breach in the THSuite point-of-sale system, which is used by many dispensaries. Through the breach in THSuite, the hackers were able to access roughly 85,000 unencrypted files containing the personally identifying information of 30,000 people, including names, phone numbers, addresses, emails, birthdays, images of state-issued IDs, signatures, quantities of cannabis purchased, and medical ID numbers. 

This breach, and all the reasons discussed above, highlight the need for modern technological solutions. The International Cannabis Bar Association (INCBA) and AXEL are working together to bring these solutions to Bar members. INCBA members will now receive a 20% discount when they sign up for Premium or Business Plan subscriptions of AXEL Go. AXEL Go is the safest way to collect, store and share files during in-office, hybrid and remote work situations.

AXEL’s patented blockchain technology and AES-256 encryption help attorneys collect, store, and share client files in a user-friendly manner that is impervious to hackers, unauthorized access, and ransomware attacks. The decentralized nature of the network ensures that there is no single point of failure. Further, files uploaded to the AXEL network are heavily encrypted, sharded, and scattered between 400+ different global servers, providing a high level of security without sacrificing speed. Sensitive files and shifting regulatory frameworks in the cannabis industry call for an abundance of caution permitted by AXEL Go. INCBA members can sign up for a 14-day trial of AXEL Go and redeem discounts here.

Data Breaches are Here to Stay (For the Unprepared)

On August 18, T-Mobile announced that a recent data breach has affected over 40 million customers. Thankfully, it appears that no financial information was leaked. However, in a statement, T-Mobile stated “While our investigation is still underway and we continue to learn additional details, we have now been able to confirm that the data stolen from our systems did include some personal information.” Those responsible for the breach targeted T-Mobile credit applications, putting names, phone numbers and social security numbers at risk [1].

This massive data leak is just one of many that have occurred in recent years. From banks to superstores, data breaches have affected businesses in every industry, putting customers at risk. With this never-ending barrage of data breaches occurring, it’s fair to ask: When will they stop?

Well, we simply don’t know. If businesses continue to neglect cybersecurity, data breaches will remain common and catastrophic. However, there are ways to minimize this risk. Simply taking the time to protect your data is the key to preventing these massive, costly data breaches. After all, protecting your data is a lot easier than dealing with a massive data breach. Just ask Equifax.

The Equifax Data Breach

In 2017, Equifax, a consumer credit reporting agency, fell victim to a massive cyberattack and data breach. In the attack, over 160 million customers’ personal information was leaked, including names, phone numbers, social security numbers, driver’s license numbers and more [2].

In addition to the massive security breach, Equifax’s response to the attack was criticized as well. Although Equifax learned of the attack in July 2017, it was not announced publicly until September 2017. Additionally, Equifax social media directed customers to unofficial sites not owned by Equifax, putting clients further at risk of phishing attacks [3]. Put simply, the Equifax data breach showed what a business should not do in the event of a data breach. From poor communication to a lackadaisical response to the sheer scale of the breach, Equifax was largely unprepared for the breach and its consequences.

But how did the breach occur? While some data breaches can be the consequence of an honest mistake, this was anything but. Equifax was targeted because of its refusal to update its security software. In March 2017, an update for Equifax’s security software was released, but the update was not immediately installed. Quickly, cybercriminals realized there was a security hole in the older version of the software. Then, in May 2017, cybercriminals found that Equifax’s dispute portal still used the flawed security software. They gained access to documents that contained customers’ personal information, and slowly extracted the data over 76 days to avoid detection. As the attackers continued to extract the data, Equifax learned of the breach on July 29, and quickly shut off access. However, by the time Equifax cut off access to the criminals, the damage had already been done.

Why do Criminals Want Your Data?

While data breaches can be catastrophic to consumers, they can lead to big paydays for hackers. For the T-Mobile breach, the release of phone numbers can lead to increased phishing attempts among victims. And because the criminals have access to each phone number’s accompanying name, they can craft a much more convincing phishing text message. If customers fall for the trick, it puts the rest of their data, including financial information, at risk.

If cybercriminals gain access to financial information in a data breach, the consequences can be even more severe. Using this financial information, the hackers (or those who buy the data from the hackers) can open new credit lines, receive loans, or file false tax returns. And because these financial agreements are under your name, you could be on the hook for paying it back.

How do Data Breaches Happen?

While the cause of T-Mobile’s breach is not immediately apparent, Equifax’s cause certainly is clear: Negligence of cybersecurity. Treating cybersecurity as an afterthought is the main cause of many data breaches. Attackers often use phishing techniques and malware in order to gain access to valuable data. For example, when Target was the victim of a data breach in 2013, the attackers stole credentials and installed malware to Target’s software to extract names and credit card numbers [4]. 

In addition to outside cybercriminals, insider attacks pose a threat to businesses as well. In fact, employee error is the main cause of most data breaches [5]. While most of these breaches are small and have few negative consequences, it shows that outside actors are not the only cybersecurity risk. 47% of business leaders say that human error has caused a data breach in their organization. From losing a device to unintentionally sending confidential emails, internal data breaches certainly pose a threat. Thankfully, there are ways to minimize this risk.

How to Minimize the Risk of a Data Breach

One of the best ways for businesses to prevent a data breach is to encrypt confidential files. With strong encryption, files are unintelligible to unauthorized attackers, making your data useless to cybercriminals. So even if attackers gain access to your documents, encryption blocks the attackers from understanding the data. This ensures that your documents are usable for you, but worthless to criminals.

For individuals, there are easy strategies to minimize harm if your data is leaked. One easy technique to protect yourself is to use different passwords for different accounts. If you use the same password for all of your accounts, just one leak can make all of your accounts at risk. Therefore, it’s important to use different passwords for all your online accounts to ensure one leaked password doesn’t compromise all of your accounts. Additionally, simply checking your credit card history and credit reports can help stop identity theft after a data breach. If you catch fraud early, it can be stopped. Simply using these two techniques can help minimize the damage of a data breach if your information is compromised.

AXEL Offers Unparalleled Protection

AXEL believes that privacy is a human right. With this in mind, we created AXEL Go, a secure file-sharing and storage software. Offering industry-leading encryption and decentralized blockchain technology, AXEL Go is the best way to protect yourself or your business from unauthorized cybercriminals. Put simply, personal information deserves the best protection. If you’re ready to try the best protection, get two free weeks of AXEL Go here. 

[1] Schwartz, Mathew J., and Ron Ross. “T-Mobile: Attackers Stole 8.6 Million Customers’ Details.” Data Breach Today. August 18, 2021. https://www.databreachtoday.com/t-mobile-attackers-stole-86-million-customers-details-a-17314?rf=2021-08-19_ENEWS_ACQ_DBT__Slot1_ART17314&mkt_tok=MDUxLVpYSS0yMzcAAAF-_hUkPD9ryUOmFe0rRKxJ3eQA_mnHG9wpo_qAsffgZRgbqIV4FLolYFKr0A7f0CcMmHSwwy3ta4adyJhcjljmHueKFGYuyCT0ezu_kdFj7GYGdCBegA.

[2] Ng, Alfred. “How the Equifax Hack Happened, and What Still Needs to Be Done.” CNET. September 07, 2018. https://www.cnet.com/tech/services-and-software/equifaxs-hack-one-year-later-a-look-back-at-how-it-happened-and-whats-changed/.

[3] Morse, Jack. “Equifax Has Been Directing Victims to a Fake Phishing Site for Weeks.” Mashable. June 10, 2021. https://mashable.com/article/equifax-twitter-phishing-site-facepalm

[4] McCoy, Kevin. “Target to Pay $18.5M for 2013 Data Breach That Affected 41 Million Consumers.” USA Today. May 23, 2017. https://www.usatoday.com/story/money/2017/05/23/target-pay-185m-2013-data-breach-affected-consumers/102063932/.

[5] Reinicke, Carmen. “The Biggest Cybersecurity Risk to US Businesses Is Employee Negligence, Study Says.” CNBC. June 21, 2018. https://www.cnbc.com/2018/06/21/the-biggest-cybersecurity-risk-to-us-businesses-is-employee-negligence-study-says.html.

What the New Infrastructure Bill Means for Tech

On Tuesday, the United States Senate passed a USD $1 trillion infrastructure bill, sending it to the House of Representatives for further debate. While the details and amount of money are subject to change, it is likely that some kind of bill to expand and rebuild the country’s infrastructure will be passed and signed in the coming months. And while most of the bill’s funding will focus on fixing America’s roads, bridges, and other transportation infrastructure, tech is far from being ignored.

Infrastructure spending has long been a goal of many Presidential administrations. And while many bills fall victim to partisan battles, the general idea of infrastructure spending enjoys bipartisan support. Of course, certain tenets of the infrastructure bill will still face fierce debate, particularly the portions that pertain to technology. However, because there is bipartisan agreement that America’s infrastructure needs updates, a bill is likely to pass. And while the numbers may change, the country is still set to spend billions to update, modernize, and regulate technology infrastructure.

Crypto Tax Changes

One of the most important (and controversial) tenets of the bill is creating tax-reporting mandates for cryptocurrency brokers. In practice, this would make reporting cryptocurrency income similar to traditional stock income, where brokers already report their clients’ sales to the IRS. Congressional accountants estimate that this update to crypto tax laws would raise USD $28 billion over ten years [1]. And while this money doesn’t cover the entire cost of the bill, it would pay for the USD $25 billion to repair America’s structurally deficient bridges.

The reason for its controversy is cryptocurrency’s unique nature. Opponents say that the language of the bill regarding cryptocurrency is too broad, leading to software developers and crypto miners facing tax requirements. Additionally, some fully oppose taxes on cryptocurrencies, due to their purposefully decentralized nature. However, supporters of this tax claim that cryptocurrencies are like any other property, and therefore should be subject to capital-gains taxes. Supporters want cryptocurrency gains to be taxed the same as other properties, such as gold and stocks. So while cryptocurrency will still be largely decentralized and international, it will likely become subject to national taxes in the future.

Broadband Access

Another large portion of the infrastructure bill is dedicated to broadband affordability. While those living in urban or suburban communities typically have easy access to the Internet, those living in rural communities aren’t afforded that same accessibility. Many rural areas don’t have consistent access to the Internet, and if they do, the costs can be immense. To combat this Internet inequality, the infrastructure bill offers billions in grants to low-income households. The new program offers monthly USD $30 subsidies toward purchasing high-speed Internet [2]. 

As millions of Americans have spent the past year working and studying from home, reliable Internet access has become a necessity, especially for low-income college students. The new bill also provides USD $1 billion for colleges and universities to provide additional direct grants to students in need. Overall, expanding broadband access will help ensure more Americans have affordable access to the Internet. After all, access to online services has proven itself to almost be a necessity in nearly every facet of life.

Electric Vehicle Expansion

One of the largest physical infrastructure plans included in the bill is a USD $7.5 billion investment in electric vehicle (EV) charging stations [3]. While EVs have been available to Americans for years, adoption has been slow, partially due to the lack of EV chargers available across the country. This investment hopes to encourage Americans to switch to more environmentally-friendly EVs, as opposed to traditional gasoline-powered cars. In addition to EV charging stations, the bill also sets aside USD $7.5 billion to help cities adopt zero-emission public transportation vehicles. 

Cybersecurity Updates

The bill also offers USD $1.9 billion for cybersecurity updates. USD $1 billion of that fund is slated to be given as grants to state and local governments [4]. Following increased numbers of cyberattacks and ransomware incidents, this money will be useful for updating aging technology. State and local governments often rely on older tech, making it easier for cybercriminals to stage a successful attack.

In addition, these grants will greatly help local governments, who are particularly susceptible to ransomware attacks [5]. Local governments often oversee critical infrastructure, such as water, sewage, schools, and airports. Because all of these are necessities for the community, cybercriminals often target them, knowing that local governments will be desperate enough to pay the ransom. Thankfully, the infrastructure bill’s investment in modernizing cybersecurity for local governments can help protect these communities from the rising threat of cybercrime.

Why Tech is Infrastructure

While the infrastructure bill receives broad support from Americans, some have objected to the bill’s spending outside of traditional infrastructure. After all, “infrastructure” has always meant roads and bridges, rather than tech. But because technology is becoming so present in our lives, it’s important to ensure our tech consistently works. Think about it: If your employer’s Internet went out on a workday, it would be more than an inconvenience. It would likely cause nearly everyone’s work to pause. Simply put, we are incredibly reliant on technology, so it makes sense to ensure that technology works properly and consistently.

When people hear the word “infrastructure,” many think of physical infrastructure, such as roads, bridges, pipes and buildings. Naturally, most of the infrastructure bill is slated to fund these physical infrastructure projects. However, with the Internet truly becoming a necessity in recent years, technology needs to be included in infrastructure as well. To a certain extent, it’s just as important as water or sewage. When our country’s technology works as intended, it can lead to incredible efficiency and convenience. And even in a pandemic, technology allowed us to continue to get work done, ensuring that businesses and governments could continue to serve their communities. But when technology doesn’t work, it can lead to chaos and frustration. Just a loss of Internet can cause entire businesses to temporarily shut down. So because technology and the Internet are so vital to individuals, businesses, and governments, it simply makes sense to consider technology as infrastructure. After all, the Internet isn’t just a luxury anymore; it’s a vital necessity for all.

[1] Gordon, Marcy. “EXPLAINER: How Cryptocurrency Fits into Infrastructure Bill.” AP NEWS. August 10, 2021. https://apnews.com/article/technology-joe-biden-business-bills-cryptocurrency-92628a41124230448f65fdeb89ffad7d.

[2] Gravely, Alexis. “Infrastructure Bill Expands Broadband Affordability for Students.” Infrastructure Bill Expands Broadband Affordability for Students. August 10, 2021. https://www.insidehighered.com/news/2021/08/10/infrastructure-bill-expands-broadband-affordability-students.

[3] Szymkowski, Sean. “Bipartisan Infrastructure Bill Passes US Senate with Billions for EV Charging Network.” Roadshow. August 10, 2021. https://www.cnet.com/roadshow/news/biden-bipartisan-infrastructure-bill-ev-charging-network-senate/.

[4] Miller, Maggie. “Senate Includes over $1.9 Billion for Cybersecurity in Infrastructure Bill.” TheHill. August 10, 2021. https://thehill.com/policy/cybersecurity/567204-over-1-billion-in-cybersecurity-funds-included-in-senate-passed.

[5] Garcia, Michael. “The Underbelly of Ransomware Attacks: Local Governments.” Council on Foreign Relations. May 10, 2021. https://www.cfr.org/blog/underbelly-ransomware-attacks-local-governments.

Another Day, Another Cyberattack: Kaseya Software and the Future of Ransomware

Once again, a major ransomware attack has affected businesses and consumers across the globe. Kaseya, a software company that provides IT infrastructure for managed service providers, was the victim of this latest cyberattack. Over the 2021 Independence Day weekend, REvil, a Russian-based hacker gang sent out a malicious software update to Kaseya’s clients, resulting in up to 1,500 small businesses being compromised[1]. Now, the group is asking for USD 50 million to undo the damage, the largest ransomware demand in history[2].

While the effects on some compromised businesses were minor, others were hit hard. For example, hundreds of grocery stores in Sweden were forced to close after their cash registers became inoperable following the attack, with railways and pharmacies in the country also being affected[3]. Additionally, some New Zealand schools were taken offline because of the attack[4]. This worldwide attack shows how crippling ransomware attacks can be, and highlights the importance of businesses protecting and securing their data.

The History of REvil

REvil, short for Ransomware Evil, is a Russian-based group of cybercriminals that attacks businesses by encrypting their data and rendering it unusable until a ransom is paid to them. Founded in 2019, REvil quickly gained prominence and, recently, has increased the scale of its attacks. While the average ransom demand from REvil was just USD 728,000[5], recent attacks have shown the group’s willingness to aim for more. For example, REvil attacked JBS, a meat processing company, in May. While food shortages were avoided, the company still paid REvil USD 11 million to prevent further supply chain interruptions[6]. Even worse, REvil uses its ransom money to hire new hackers and research new ransomware technology, becoming a thriving business of cybercrime[5]. In just two years, REvil has become a powerful group, launching successful ransomware attacks across the globe.

A Troubling Trend

Unfortunately, the Kaseya attack is just one example of a larger problem faced by businesses around the globe. Hacker groups seek to attack and exploit any business they can by threatening to destroy or leak data unless a massive payment is made. Much worse than simple computer viruses, ransomware attacks can grind business to a halt within hours.

Cyberattacks involving ransomware have increased further in 2021, with recent attacks affecting people and businesses around the globe. In May, an attack on the Colonial Pipeline affected millions of Americans, causing fuel shortages in the Southeast. Even though Colonial Pipeline paid the ransom within hours of the attack, the effect was still felt by millions. 

The Colonial Pipeline attack was just one of the thousands of expected ransomware attacks in 2021[7], and, unfortunately, they show no sign of slowing down. As long as hackers continue to find vulnerabilities in business security, ransomware attacks will continue. With more and more work being done online, data becomes more and more vulnerable. Ransomware attackers can strike at any time, destroying a business’s ability to function. And even if a business pays the ransom, it can take a long period of time to get back to normal. 

So while ransomware prevention can be a headache, it helps make sure you are as protected as possible from attackers. After all, there is nothing hackers love more than a business with lax cybersecurity.

Tips to Prevent Ransomware Attacks

Create and Frequently Update Offline Backups of Data: While this is a time-consuming process, this is the best way to ensure your business can still function if a ransomware attack occurs. Backing up your data offline ensures that if you are affected by ransomware, your important data will be safe from hackers. Simply delete your affected systems and reupload your offline data onto a new system.

Consider Using White Hat Hackers: While hackers have a negative connotation, white hat hackers can help businesses tremendously. They ethically check and test your cybersecurity measures and inform you of any potential vulnerabilities. Once you know the issues, you can fix them and protect your business from the hackers who wish to hurt rather than help.

Update your Antivirus Software: This is the simplest, easiest way to make sure you and your business are protected from ransomware attacks. Each update of antivirus software helps patch vulnerabilities that are present. Staying up-to-date helps ensure you are as protected as possible from unethical hackers who check for holes in security. If your business is on an older version of antivirus software, hackers can find a way past the protection and hold your business hostage. Patching these holes through software updates keeps you safe from old security bugs that attackers often exploit.

The Future of Ransomware

As technology evolves further, unfortunately, so do the practices of unethical hackers. Every day, businesses and individuals put data at risk of cyberattacks. While businesses and antivirus softwares try to ensure every security vulnerability is patched, hackers may still find a way to attack. However, following the tips mentioned before and safeguarding your data can make you less likely to become a victim of a ransomware attack.

Unfortunately, if attackers obtain data and threaten to sell or leak it unless a ransom is paid, a business has few options other than paying the ransom or losing the data. Once attackers have access to the data, there is not much a business can do. This is why the best defense against ransomware is prevention. Taking the time to secure your data, update your software, and find vulnerabilities will increase your protection from cybercriminals who wish to wreak havoc on a business.

Securing Your Data

At AXEL, we believe data privacy is a right. Unlike other tech companies, we will never sell your data to third parties, helping ensure your data is only yours. Our file-sharing application, AXEL Go, uses blockchain technology and AES 256-bit encryption to provide the most secure cloud-sharing system in the industry. Whether for business or personal use, AXEL Go helps protect your most important files. 

Sign up today to receive a free 14-day trial of our Premium service with all of AXEL Go’s features unlocked. After the trial period, you can choose to continue your Premium account for just $9.99/month or use our Basic service free of charge. Together, we can help protect data from malicious attackers.

[1] “Up to 1,500 Businesses Compromised by Latest Ransomware Attack, Kaseya CEO Says.” CBS News. July 06, 2021. http://www.cbsnews.com/news/ransomware-attack-kaseya-1500-businesses/.

[2] “In Private Conversation, Hackers behind Massive Ransomware Outbreak Lower Demand to $50 Million.” CNBC. July 05, 2021. http://www.cnbc.com/2021/07/05/revil-hackers-behind-massive-ransomware-outbreak-drop-demand-to-50m.html.

[3] Browning, Kellen. “Hundreds of Businesses, From Sweden to U.S., Affected by Cyberattack.” The New York Times. July 03, 2021. https://www.nytimes.com/2021/07/02/technology/cyberattack-businesses-ransom.html.

[4] Satter, Raphael. “Up to 1,500 Businesses Affected by Ransomware Attack, U.S. Firm’s CEO Says.” Reuters. July 05, 2021. http://www.reuters.com/technology/hackers-demand-70-million-liberate-data-held-by-companies-hit-mass-cyberattack-2021-07-05/

[5] Javers, Eamon. “Axis of REvil: What We Know about the Hacker Collective Taunting Apple.” CNBC. April 23, 2021. https://www.cnbc.com/2021/04/23/axis-of-revil-inside-the-hacker-collective-taunting-apple.html.

[6] Bunge, Jacob. “JBS Paid $11 Million to Resolve Ransomware Attack.” The Wall Street Journal. June 10, 2021. https://www.wsj.com/articles/jbs-paid-11-million-to-resolve-ransomware-attack-11623280781.

[7] Hum, Thomas. “Over 65,000 Ransomware Attacks Expected in 2021: Former Cisco CEO.” Yahoo! Finance. June 14, 2021. https://finance.yahoo.com/news/over-65000-ransomware-attacks-expected-in-2021-former-cisco-ceo-125100793.html.

Breaking Down Biden’s Executive Order on Cybersecurity

On the heels of two of the largest hacks in United States history (SolarWinds and Microsoft Exchange Server), President Biden released an executive order on May 12th dealing with cybersecurity. Let’s dig into what’s in the order and how it could affect the nation’s cyber defense strategy.

The breakdown – Remove barriers to sharing information

IT contractors collect a vast amount of data every day for federal government agencies. Due to contractual obligations and restrictions, however, these agencies don’t share this data freely with each other. This can lead to knowledge gaps and situations where agencies can’t put together a complete picture of a threat. This executive order seeks to eliminate these knowledge gaps by amending service provider contracts and streamlining the information-sharing process.  

AXEL Commentary: Since organizations are already collecting this data, ensuring a pipeline for sharing seems like a good idea. The caveat is that there were no specifics as to what is actually being collected daily. For example, are they tracking international or domestic actors? Both? Does it violate privacy or civil liberties? When you’re talking about the U.S. Government surveilling people under the guise of national security, the track record is spotty, to say the least.

Modernize federal cybersecurity

There are no reasons given why the current cybersecurity protocols are lagging, but let’s assume that the Administration is correct that the government isn’t on the cutting-edge of cyber defense. Of course, you’d hope this assumption wouldn’t apply to agencies dealing with crucial defense systems such as nuclear weapons, but…

The main priority of this section is to migrate federal computer systems to cloud-based options that integrate ‘Zero Trust Architecture.’ Zero Trust networks eliminate the concept of an ‘edge’ and require all users, whether they connect through a local or cloud-based node, to validate and provide the necessary credentials to maintain access.

AXEL Commentary: Zero Trust Architecture is an excellent idea in an ideal world. In reality, thus far, it’s proven to be little more than the go-to buzzword for IT department heads. The cost of updating legacy systems to the Zero Trust model would be prohibitive. The Administration is talking about updating all federal networks to this method. Knowing how slow government can be to upgrade, it seems infeasible that Zero Trust security can be implemented holistically any time in the near future. The technical difficulties combined with the eventual re-training efforts required would be enormous.

Solidify security throughout the software supply chain

As the recent hacks proved, federal agencies often rely on private third-party vendors for their software solutions. These solutions typically aren’t developed with cybersecurity as the main priority, leaving critical systems susceptible to attack. This order aims to incentivize organizations throughout the supply chain to harden their security systems.

AXEL Commentary: Again, it comes down to the question of practicality. The order prioritizes this initiative specifically for ‘critical systems, so the scope is at least somewhat limited. It certainly makes sense to ensure software providers for important systems prioritize security. The details for how this would actually play out are scarce, but there is some optimism that it can be accomplished.

Create a Cyber Safety Review Board

This order establishes the framework for a Cyber Safety Review Board. Members on the board would assess ‘significant cyber events’ taking place on national networks and recommend remediation procedures or tips for future prevention.

AXEL Commentary: Jokes about the unstoppable expansion of governmental bureaucracy aside, it’s surprising such a committee doesn’t already exist. Cyber-attacks have been a national security threat for decades, so you’d figure there would be a board that analyzes attacks, but evidently not. However, depending on the competence of those assigned to this committee, it could help with future incidents.

Standardize cyber incident response across agencies

The Administration wants to unify the response guidelines for federal agencies to provide a coherent interdepartmental plan. This would result in a more coordinated response with standardized incident logging procedures, making analysis and cooperation easier.

AXEL Commentary: Theoretically, this change could be beneficial. It depends on how different the systems of individual agencies are, however. If one department’s specific network requires a significantly different and more tailored response, making it a ‘one-size-fits-all’ situation could hamper remediation efforts. Unified logging procedures are a good idea in any case.

Improve vulnerability detection capabilities

0-day, or previously unknown, exploits are a common way hackers breach sensitive networks. The executive action looks to deploy more resources toward vulnerability detection.

AXEL Commentary: The specifics of the ‘how’ here aren’t detailed. Is the government going to employ teams of penetration testers who search out a systems’ weak points? Hopefully, because that’s the best way to find exploits. Of course, this assumes there are people in federal agencies that have the skills to tackle the task. If not, the lag between finding, clearing, hiring, and deploying the necessary white hat hackers could be considerable.

And, those are the main points of the executive action. There are a few other sections, but they piggyback and expand upon these goals. If you’d like to read the entire document for yourself, visit whitehouse.gov and do so. Let us know if you think we left out anything important! Overall, it’s an interesting plan that sounds great on paper. It’s hard to argue that the United States doesn’t need to overhaul its cybersecurity practices.

As always, the devil is in the details. How exactly will the plan’s implementation go? Will it be funded adequately? What problems will agencies run into along the way? Only time will tell, but we hope for a resounding success.

AXEL: Secure solutions for your organization

Most software products aren’t geared toward robust cybersecurity, and the United States government agrees. AXEL provides an alternate path that provides high-tech security without sacrificing usability. The secure, private file-sharing and cloud storage platform, AXEL Go, embodies this philosophy. Developed with integrated blockchain technology, InterPlanetary File System integration, and 256-bit encryption capabilities, AXEL Go is the best way to share and store files online safely. Try it out today and receive a 14-day free trial of our premium service. You’ll see how easy cybersecurity can be. So, stop waiting for a data breach and protect your organization with AXEL Go.