As the holiday season approaches, it’s not just Santa Claus and jingle bells we need to watch out for—there’s also a growing threat called SMishing, or SMS phishing. While phishing through emails has been around for years, SMishing operates through text messages, attempting to deceive you into providing sensitive personal information.

What is SMishing?

SMishing is a form of phishing that targets your mobile phone through text messages. Just like phishing emails, these messages aim to trick you into clicking on links or answering questions that divulge personally identifiable information (PII). Once scammers obtain this information, they can use it for fraudulent activities, potentially ruining your holiday cheer.

How Does SMishing Work?

One of the most common SMishing tactics involves fake delivery notifications. You might receive a text claiming that your package is on its way, with a request to confirm your address or answer a few questions. These messages often include a link that, when clicked, leads to a site designed to collect your personal details.

These scams are particularly effective during the holiday season when many of us are expecting packages and might not think twice about a message from a delivery service.

How to Spot a SMishing Attempt

To avoid falling victim to SMishing, keep an eye out for these red flags:

1. Unknown Numbers: If you receive a text from a number you don’t recognize, especially one with a foreign area code, proceed with caution. SMishing messages often originate from unfamiliar numbers.
2. Poor Grammar: Pay close attention to the grammar and formatting of the message. SMishing texts frequently contain typos, unusual capitalizations, or improper sentence structure, signaling their fraudulent nature.
3. Unsolicited Links: Never click on links from unknown senders. If you receive a suspicious message, delete it immediately. Clicking on these links could expose your personal information or infect your device with malware.

Stay Safe This Holiday Season

The holidays should be a time of joy, not stress. By staying vigilant and recognizing the signs of SMishing, you can protect yourself and your loved ones from falling victim to these scams.

If you’re unsure about a text, it’s better to err on the side of caution. Reach out to the purported sender through a trusted method, such as their official website or customer service line, to verify the message’s legitimacy.

Enjoy the holidays, stay safe, and don’t let SMishing spoil your festive spirit. Remember, protecting your personal information is one of the best gifts you can give yourself this season!

As Cybersecurity Awareness Month comes to a close, we’re reflecting on the importance of keeping your digital space secure—both at work and at home. This October, we’ve spotlighted essential strategies to ward off potential cyber threats that can haunt any business. From scam emails to weak passwords, each topic tackled a vital piece of the cybersecurity puzzle.

Imagine standing in front of a graveyard filled with goblins and skeletons, each one representing the digital threats that lurk online: ransomware, phishing scams, and weak passwords, to name a few. Just like these ghouls and goblins, cyber threats may seem harmless until they slip through the cracks. But don’t fear; there are simple ways to keep them at bay. Here’s a quick recap of the strategies we covered and how each one can help strengthen your defense:

1. Don’t Let Scam Emails Breach Your Defense – Phishing Protection
   • Phishing remains one of the most common forms of cyberattacks, often arriving in the form of emails that look legitimate but are crafted to steal your personal information. Read more about recognizing phishing scams and protecting your inbox from these sneaky threats.
2. Unique Passwords Are Key – Strengthening Your Password Security
   • Weak passwords are an easy way in for attackers. Using unique and complex passwords, along with a password manager, can make it harder for hackers to break into your accounts. Learn more about creating strong, unique passwords.
3. Strengthen Your Cyber Defense with Fresh Updates – The Importance of Regular Software Updates
   • Outdated software is one of the easiest ways for attackers to exploit your system. Keeping your devices updated not only enhances functionality but also patches vulnerabilities. See how regular updates can boost your cybersecurity.
4. Multi-Factor Authentication – An Added Layer of Security
   • Multi-factor authentication (MFA) is one of the most effective ways to protect your accounts. By requiring more than just a password, MFA can stop unauthorized users from accessing your information, even if they know your password. Discover the advantages of multi-factor authentication here.

For those looking to add even more robust protection, consider adding a cyber liability insurance policy. This added layer of security can provide peace of mind in the event of a cyber incident, covering potential financial damages.

If you have any questions or would like to learn more about cyber liability insurance, feel free to reach out. Cybersecurity threats may be spooky, but with these strategies and a proactive approach, you can keep them at bay year-round.

In today’s rapidly evolving digital landscape, cybersecurity requires constant vigilance. One critical step that’s often overlooked is keeping your software up to date. As we enter Week 3 of Cybersecurity Awareness Month, let’s shine a light on why software updates are essential for maintaining a strong digital defense.

Why Software Updates Matter for Your Security

Software updates are like fresh defenses in the ever-changing battlefield of cybersecurity. Much like a lawyer reviewing the latest case files to stay sharp, updating your software ensures that your security strategies are current. These updates contain patches that protect against newly discovered vulnerabilities. Without them, your system becomes an open target for cybercriminals looking to exploit any weaknesses.

The Risks of Outdated Software

Cybercriminals are always on the lookout for outdated software, which is more vulnerable to attacks. When you neglect to update, you’re essentially leaving the door open for hackers. Whether it’s your operating system, browser, or any application, outdated software creates gaps in your defenses that can easily be breached. By keeping everything up to date, you close those gaps and ensure your system is fortified against the latest threats.

The Importance of Trusted Sources for Updates

Not all software updates are created equal, and it’s crucial to download them from legitimate, trusted sources. Using unlicensed or hacked versions can introduce malware into your system, creating more problems than they solve. Always ensure you’re updating from official websites or platforms to avoid unintentionally weakening your cybersecurity.

How to Stay Ahead: Enable Automatic Updates

A simple way to never miss an important update is by enabling automatic updates. This feature ensures your software is always running the latest version, equipped with all necessary security patches. With automatic updates enabled, you won’t have to worry about remembering to manually update your software, and your system will stay protected.

Final Thoughts: Keep Your Defenses Strong with Regular Updates

In the world of cybersecurity, staying up to date is a key part of maintaining a strong system defense. Think of software updates as a routine check-up for your digital health. By making them a priority, you’ll ensure your defenses are ready to face any new threats. Stay vigilant, stay updated, and stay secure.

As October unfolds, it’s time to focus on a crucial aspect of our digital lives: cybersecurity. October is Cybersecurity Awareness Month, a perfect reminder to fortify our defenses against cyber threats. Whether you’re working in the office or remotely, the security of your personal and your firm’s data is paramount.

Just as you would build a solid legal case, constructing strong cybersecurity defenses is essential. Throughout this month, we’ll delve into strategies to keep you ahead of cybercriminals. Our focus areas include recognizing phishing attempts, using robust passwords, keeping software updated, and enabling multi-factor authentication (MFA).

Phishing emails are a prevalent method used by cybercriminals to infiltrate your inbox. Alarmingly, almost half of social engineering attacks are phishing-related, and a staggering 98% occur through email. However, these emails often carry signs that make them detectable.

Here’s how to spot a phishing email:

1. Too Good to Be True Offers: If an email offers something unbelievable, like winning a contest you never entered, be skeptical.
2. Urgent or Threatening Language: Emails that use alarmist language might be phishing attempts.
3. Suspicious Email Addresses: Verify if the sender’s email matches the company it claims to be from.
4. Requests for Personal Information: Never send personal information or click on unfamiliar links.

When in doubt, report suspicious emails to your IT team immediately. Your swift action could prevent a severe data breach, much like stopping an argument before it escalates.

Stay vigilant, and remember, your proactive defense is crucial to your firm’s security. Let’s work together to make this Cybersecurity Awareness Month a success!

Passwords – it’s a topic that gets discussed a lot, but surprisingly, many people still don’t use effective methods to manage their passwords.

A Common Mistake: The Post-It Note Dilemma

Let me tell you about an experience I had recently. I was at a client’s office, helping him complete an application that required access to his bank account. He turned around, grabbed a yellow Post-It note from his credenza, and handed it to me. I was taken aback. He had his banking password scribbled on that little piece of paper!

I didn’t say anything at first; we completed the application without a hitch. But before I left, I couldn’t help but bring it up. “You know,” I said, “there’s a much better way to keep track of your passwords.” He shrugged it off, saying it was no big deal and that he only wrote down the passwords he used the most.

The Risks of Traditional Password Storage

Storing passwords on Post-It notes or in a notebook in your desk might seem harmless, but it’s fraught with risks:

• Easy Access for Intruders: Anyone who gains access to your office can easily find your passwords.
• Loss or Damage: A Post-It note can fall off, get thrown away, or simply be misplaced, leaving you locked out of your accounts.
• Lack of Security: Physical notes don’t offer any encryption or security features, making it easy for anyone to steal your information.

The Solution: Password Managers

That’s where password managers come in. A password manager is a digital tool that securely stores and organizes your passwords. Here’s why you should consider using one:

Benefits of Password Managers

1. Security: Password managers use strong encryption to keep your passwords safe.
2. Convenience: You only need to remember one master password to access all your accounts.
3. Password Generation: Many password managers can generate strong, unique passwords for each of your accounts.
4. Accessibility: Access your passwords from any device, anywhere.

How It Works

You enter all your accounts and passwords into the password manager, and it keeps them securely stored. The best part? It can create complex passwords for you, significantly enhancing your security. All you need to remember is one master password, and the password manager does the rest.

My Personal Experience

I use a password manager myself, and it has been a game-changer. No more scribbling passwords on sticky notes or worrying about losing access to my accounts. It’s a great tool, and I genuinely believe everyone should look into it.

So, if you’re still using Post-It notes or notebooks to store your passwords, it’s time to make a change. A password manager is a small investment for a huge payoff in security and peace of mind.

Stay safe online, and remember, I’m Don Ivol, your insurance guy.

In the past 4 weeks, we have covered multiple cyber security exposures that are common to law firms, including:

• Ransomware attacks
• Wire fraud
• Password hacks
• No multifactor authentication

We have also covered how to minimize the risk associated with them.

However, they all have one thing in common…a human element, which is almost impossible to safeguard 100%.  About half of all data breaches happen due to some type of human error.

This is why we recommend purchasing cyber liability insurance.

Cyber liability insurance provides a combination of coverage options and services to help protect businesses against data breaches and other cyber events as well as help to recover quickly if an attack does take place.

This insurance can help cover the costs associated with an attack or breach, such as:

• Lost income due to cyber event
• Customer notification 
• Data recovery
• Damaged computer repair
• And more!

Law firms use multiple types of technology that face cyber risk.  As this tech becomes more complex, so does the risk that comes with it.  This is why every business should be prepared with a cyber security plan/training as well as cyber liability insurance to help mitigate the risk.

Let INF help place you with the best cyber liability carrier for your firm’s needs.  To get started, give us a call at 412.563.2106 today.

Because October is Cyber Security Awareness Month, we thought that we would take the next few weeks to highlight cyber security exposures that are common to law firms.

Did you know that 44% of businesses don’t use multifactor authentication?

Your question back to me might be – What is multifactor authentication and why would I need it?

Multi Factor authentication or MFA is a security method that needs a user to use two or more authentication factors to prove who they are before they can use an organization’s network, check their email from a remote location, or use privileged or administrative accounts.  It helps make sure that you are who you say you are.

The most common use of MFA is when banks or credit cards require you to input a password as well as a code that they email/text/call you with.

MFA should be used by law firms with email accounts as well as accessing any network remotely.

In fact, according to Microsoft, 99.9% of account compromise attacks can be blocked by MFA!

Most email products as well as system access software have MFA built in, so be sure to enable and protect your data!

Questions about risk mitigation for this exposure?  Call us at 412.563.2106.

Next week, we will talk about how to protect your firm against multiple exposures!

Because October is Cyber Security Awareness Month, we thought that we would take the next few weeks to highlight cyber security exposures that are common to law firms.

This week’s topic – Passwords!

Did you know that there is a website that you can go to check to see if your email/password combination has been a part of a data breach?  It’s called “Have I Been Pwned?” and you can access it here: https://haveibeenpwned.com/

It contains over 12 BILLION username/password combos that have been exposed in recent hacks.

Go to the site and enter your email address to see if you have been exposed.  If so – change your password immediately for the account that was hacked.

Want to create a good password?

Try using these 7 criteria:

• 12 characters or more in length
• Contains an uppercase letter
• Contains a lowercase letter
• Contains a number
• Contains a symbol
• Does not contain real words that could easily guessed by a dictionary attack
• Hasn’t been used before as a password by your email address

Need help remembering each unique password?  Invest in a password manager, like 1Password or KeePass.

Questions about risk mitigation for this exposure? Call us at 412.563.2106

Next week, we will discuss multi factor authentication!

Because October is Cyber Security Awareness Month, we thought that we would take the next few weeks to highlight cyber security exposures that are common to law firms.

A common question that we hear from our insureds is – What is ransomware and can it affect me?

Ransomware is a type of harmful software (also known as “malware”) that online thieves use to access a victim’s network. Typically, this happens via a download by an employee that was tricked.  Once they are into the system, they’ll encrypt it so you can no longer access anything.

Finally, the thieves will demand a ransom, generally in bitcoin, in exchange for the decryption key.

Attackers using ransomware have recently increased their aggressivity, requesting six-, seven-, and even eight-figure ransom payments from organizations. It is more difficult for organizations to recover from such an attack as a result of these criminals deleting backups and, in some circumstances, issuing threats to reveal critical or confidential material.

Can it affect law firms? YES!  In fact, here is a link to an article discussing a ransomware attack that is common to the legal industry: https://www.logikcull.com/blog/maze-ransomware-law-firms

One way to prevent ransomware affecting you is to make sure that your employees are well-trained on spotting suspicious emails and attachments.  This way, they won’t download malicious files.

Another way to prevent ransomware is to make sure that you have a complete backup of your system that can be restored within 24-48 hours.  This will enable you to put your system back up and lose minimal time without needing to deal with the criminals.

Questions about risk mitigation for this exposure?  Call us at 412.563.2106

Stay tuned for next week where we will discuss wire fraud.