[June 16, 2013] Businesses feeling the bite of cyber crime Tweet Jun 16, 2013 (Richmond Times-Dispatch - McClatchy-Tribune Information Services via COMTEX) -- Cyber crime is growing at the speed of light. And the light is pointed at businesses. Information hacks increased 117 percent from 2011 to 2012, cyber security expert Rob S. Hegedus said, with 267 million records successfully breached. Nearly two-thirds -- 60.6 percent -- of those successful attacks occurred in businesses, said Hegedus, speaking at a cyber security seminar at the Williams Mullen law firm in Richmond last week. "At least a third of breach events are caused by employee negligence," said attorney Monica McCarroll with Williams Mullen. And, she said, "We're all vulnerable." Cyber attacks on small and medium-size businesses are burgeoning, with 62.5 percent reporting their IT systems were hacked into in 2012, Hegedus said. "They are more attractive targets than large enterprises." At the same time, the legal penalties and pitfalls also are increasing for organizations failing to properly protect customers and investors from cyber crime, said Williams Mullen attorney William R. Poynter from Norfolk. For instance, in Virginia, the attorney general can levy a civil penalty of up to $150,000 for a system's security breach, Poynter said, and individuals can recover direct economic damages from a violation of the law. "If you get breached and it's obvious you didn't take any preventative action prior to the breach, you will be penalized," said Hegedus, CEO of Sera-Brynn LLC, a cyber security firm based in Chesapeake. More states are enacting laws requiring that people be notified when personal information held by an organization has been compromised -- Virginia already has such a law in place -- and the federal government is moving in the same direction, Poynter said. But encrypting data, he said, could shield an affected company from some notification requirements. Class-action lawsuits against organizations that have suffered information breaches also are proliferating, Hegedus said, with payments in such mass actions averaging $2,500 per plaintiff in 2012. Cyber attackers run from decentralized "hacktivists" to well-organized cyber criminals -- they stole $20 billion from consumers in 2012 -- to large state-sponsored operations, primarily originating in East Asia, Hegedus said. To protect themselves, companies need to: --Prioritize cyber risk: Cyber risk is the likely harm to an organization from an attacker exploiting vulnerability in an IT system, explained Ted Enright, vice president with S.L. Nusbaum Insurance Agency in Norfolk. To figure out where they should start in prioritization, firms should know what kind of attacks they've experienced, whether they comply with IT security rules and what information they hold that's most at risk. Hiring outside consultants to identify threats and weaknesses can help, Enright said, as well as contractually shifting the consequences of loss to another party. --Meet regulatory compliance requirements: Companies need to adhere and comply with standards such as those of the Payment Card Industry Security Standards Council, the federal Health Insurance Portability and Accountability Act for health information privacy, the Gramm-Leach-Bliley Act for financial institutions and the Sarbanes-Oxley rules for investor protection. More than half of retail merchants are unaware of payment card industry security requirements, Hegedus said, with non-compliant businesses suffering the majority of data loss. "Compliance is not a get-out-of-jail-free card," Enright said, "but that's going be first." --Don't rely solely on technology solutions: Businesses have to establish solid policies and procedures -- and then follow them. "You really need to start thinking about these things now," McCarroll said. For example, firms should have clear administrative responsibilities for management and employees, require account passwords, control personnel access to systems and the Internet, and provide appropriate physical security measures. And, when you are selecting a password, don't make it "Password," she said: Make them complex, and change them frequently. --Assume you have already been breached: Among the steps companies should take are scrubbing their entire network and computer infrastructure, ensuring firewalls are properly configured, considering segmenting their networks and ensuring they have a robust incident response plan for cyber breaches. --Buy cyber insurance: Organizations should consider insuring themselves for cyber costs, such as replacing lost or stolen data, electronic fraud or theft of money, extortion, notifications to affected individuals, intellectual property loss, legal fees and loss of business income, Enright said. The Chubb Group of Insurance Cos. offers cyber liability insurance for as little as $5,000 for $1 million worth of coverage a year, said Reanetta Hunley, a Chubb practice leader for specialty insurance, though insurance policies can cost much more, for instance, for larger firms with greater exposure. [email protected] (804) 649-6813 ___ (c)2013 the Richmond Times-Dispatch (Richmond, Va.) Visit the Richmond Times-Dispatch (Richmond, Va.) at www.timesdispatch.com Distributed by MCT Information Services [ Back To TMCnet.com's Homepage ]