By LNS Solutions | 5 min read

How to Review Your IT Budget and Prepare for 2025

With the end of 2024 upon us, now is a good time to take stock of what worked in your business this year and what didn’t.

This is particularly important in the realm of IT. Shifting business priorities and new technologies can mean that what worked just last year or a few years ago could be out of step with your needs, especially if you plan on taking advantage of new technologies in the coming year.

While all small business IT budgets will involve trade-offs to some extent, here are some tips that you can use to make wise choices and position yourself for higher productivity and more efficient budgets in the new year.

Review Products: Have Your IT Investments Delivered Results?

Before setting your plan for 2025, it's crucial to look back at the purchases you made over the past year. The software you bought to streamline operations, and the hardware you replace to keep things running smoothly. Were these investments worth the cost?

Did they help you meet your operational goals? It’s time to ask hard questions, be honest about underperforming systems, and focus on high-impact areas.

Software Review: Over the past year, you may have upgraded your servers, subscribed to new software, or rolled out cloud services. For many businesses, these software costs can consume up to 34% of their IT budget, yet a significant portion of those licenses go unused.

About 30% of software licenses are never used, and another 8% are rarely used. Add up all these costs and you’re looking at a significant chunk of your IT budget that could be better spent elsewhere.

Hardware Review: Just as with software, your hardware infrastructure requires a thorough review. In the past year, your hardware mix has likely expanded to include more laptops, routers, workstations, printers, and other critical equipment.

Try to understand the costs holistically. Is the total cost of ownership (TCO), which includes operational and maintenance costs, affecting your budget the way you planned? It’s often the case that older hardware seems cheaper on the surface but impacts your budget in unexpected ways.

Here are some things to look out for when analyzing your current IT budget:

• Identify Unused Licenses and Subscriptions Small businesses often fall into the trap of purchasing software licenses in bulk but using only a fraction of them. Maybe you bought ten licenses for a project management tool but only five team members are using it. Perhaps you subscribed to a service you no longer need. In fact, according to G2, nearly two-thirds of companies over-license their software to avoid penalties from audits, leading to unnecessary expenses.
• Training costs: As your technology stack evolves, so must your workforce. This presents additional costs in terms of training. According to TechTarget, CIOs allocated nearly 35% of their IT budgets toward personnel costs, particularly in upskilling and reskilling initiatives.
• Eliminate Redundant Tools and Streamline Your Toolset: It’s easy to overlook and add new software without realizing they’re duplicating a functionality you already possess! Here’s a common example: you have both an email marketing platform and a CRM system that overlap in features like email campaign tracking. Consolidation can lead to quick wins.
• Overlooking Total Cost of Ownership (TCO): While many focus solely on the initial cost of hardware, it's crucial to consider the entire lifespan of the equipment. With ongoing maintenance, repairs, upgrades, and energy consumption, costs can pile up quickly.
• Ignoring Future Scalability: Many businesses focus on addressing their immediate needs when investing in hardware. While this approach might seem cost-effective in the short term, it can quickly turn into a scramble to upgrade or replace outdated equipment.

Review Users: What Do Your Employees Say?

Your employees' firsthand experiences offer the most valuable insights into your IT investments. As the primary users of these tools, they interact with them daily.

Before preparing your IT budget, take the time to gather feedback from them to ensure that your investments align with their actual needs. This way, you'll know if your current stack enhances or hinders productivity, which tools are truly essential, which are underperforming, and where there might be opportunities for cost-effective improvements.

Network Performance: Even minor network downtimes can have a significant impact on your bottom line.

Findings indicate that the average cost of downtime per minute for small businesses is $427. Now think about how many network outages or slowdowns your organization experienced this year, and how those disruptions correlated with lost productivity or sales. Improving network reliability and performance are low-hanging fruit that can visibly make an impact on your ROI.

Help Desk Support: It’s essential to assess how well your help desk setup supports your employees throughout the year. Key metrics like First-Time Resolution (FTR) rates and Mean Time to Resolution (MTTR) offer insights into your support’s effectiveness. If issues recur, it could indicate deeper system problems or gaps in training.

You'll need to roll up your sleeves and investigate further to identify the root causes.

If you discover that your current setup is lacking, it may be time to consider alternative options. You might want to switch vendors or reflect on your team's skills. You’ll need to ask yourself if your internal team has the necessary expertise to address your support challenges effectively. If there are gaps, consider the costs and overheads of hiring internally against outsourcing to a specialized provider.

Addressing Business Continuity

With hurricanes Milton and Helene striking Florida back-to-back, they've left a trail of destruction in their wake and impacted thousands of businesses. The Small Business Administration is nearly running out of funding for disaster relief loans.

Events like these serve as stark reminders. The necessity of having a solid business continuity plan is unmistakably clear. After all, you never know what next year holds.

Small businesses are vulnerable to operational disruptions from both natural disasters and cyberattacks. And both threats are on the rise.

Assess Threats: Start by conducting a thorough risk assessment of your IT infrastructure. Whether you're up against hurricanes or cybercriminals, it's crucial to protect your operations and data. Your strategy should be comprehensive to ensure you're fully prepared.

Ensure Reliable Data Backups: Now that you understand your risks, implement an automated system for regular cloud backups.

After you’ve laid out a business continuity plan, allocate a portion of your budget for your IT towards this crucial function and prioritize it to ensure your company can continue functioning smoothly after any crisis.

Planning Your IT Budget for Next Year

Once you’ve reviewed your IT investments, gathered user feedback, and established a continuity plan, it’s time to align your IT spending with your business goals. As you look ahead to next year, consider your business goals. What do you hope to achieve, and do you have the right tools in place to make those ambitions a reality?

Building a budget is more than just a financial exercise; it’s the foundation for ensuring key projects get completed on time and provide the desired outcomes.

By aligning your business objectives with your IT resources, you can make the most of your investment and position your business for success in 2025. Whether it is cutting down on unnecessary tools, strengthening your network, or aligning IT with your growth strategy, smart investments now will pay dividends in the year ahead.

LNS Solutions Can Help Streamline Your 2025 IT Budget

For decades, we’ve had businesses in Tampa take control of their IT budget and optimize network uptime. If you’re struggling with budgeting questions, contact us any time at (813) 393-1626 or info@lnssolutions.com. We look forward to speaking with you!

 

By LNS Solutions | 5 min read

Windows 10 End of Life: Why Upgrading to Windows 11 is Essential

As Windows 10 approaches its End of Life, businesses face critical decisions about system security, software compatibility, and productivity. The upgrade to Windows 11 is more than a simple update—it’s a strategic move to protect your business from security threats, boost operational efficiency, and prepare for the future. This guide will help you navigate the transition, from assessing your current infrastructure to securing your data, with expert support from a Microsoft Certified Solutions Partner.

Windows 10 to Windows 11 Upgrade Checklist

Upgrading your systems doesn’t have to be complicated. By following this checklist, you can make the transition to Windows 11 smoothly, minimizing risks and maximizing productivity with each step. Let’s dive in!

1. Assess Your Current Infrastructure

Before upgrading, take a close look at your current setup. This helps you plan effectively and prioritize the upgrade of key systems.

• Inventory Devices: Start by making a list of all devices still running Windows 10.
• Check System Requirements: Confirm that each device meets Windows 11’s hardware requirements to avoid compatibility issues.
• Identify Critical Systems: Prioritize upgrading devices that handle sensitive data or are essential to daily operations.

Pro Tip: Collaborate with a Microsoft Certified Solutions Partner to evaluate your infrastructure and ensure each device is ready for Windows 11.

2. Ensure Software Compatibility

The last thing you want is to upgrade only to find that your business-critical software is incompatible. Running a software compatibility check helps prevent disruptions.

• Run Compatibility Tests: Check essential applications to ensure they work seamlessly on Windows 11.
• Update Line of Business Software: Ensure critical applications are updated to their latest versions to avoid potential issues.
• Partner Assistance: A certified partner can help validate software compatibility and recommend any necessary updates.

3. Plan for Data Backup and Recovery

Data security is vital, especially during a system upgrade. Protect your data by implementing a solid backup and recovery plan.

• Back Up Important Data: Save essential files and configurations to prevent data loss during the upgrade.
• Create a Recovery Plan: Ensure quick data restoration if needed.
• Certified Partner Support: Work with a certified partner to manage data backup and recovery, ensuring no critical data is left behind.

4. Establish a Security Baseline

With security threats constantly evolving, upgrading to Windows 11 provides a robust foundation of security features that Windows 10 no longer supports.

• Review Security Policies: Update policies to reflect new system security standards.
• Implement Microsoft Security Features: Enable Windows 11’s hardware-based encryption and threat detection features to keep your systems safe.
• Consult a Certified Partner for Security: A certified partner can help configure security settings to maximize protection and meet industry compliance requirements.

5. Develop an Upgrade Timeline

A structured, phased rollout ensures a smooth upgrade process and minimizes business disruptions.

• Create a Phased Rollout Plan: Schedule upgrades by device priority and user needs.
• Communicate with Your Team: Inform employees about the upgrade process and offer support resources.
• Certified Partner Engagement: Collaborate with a to create an efficient timeline and receive guidance on scheduling and technical support.

6. Test and Optimize Post-Upgrade

Once the upgrade is complete, testing is essential to confirm everything is working as expected.

• System Testing: Test upgraded systems for stability, performance, and compatibility.
• Monitor Productivity Tools: Check that tools and applications are functioning efficiently post-upgrade.
• Continuous Support from a Partner: Keep a certified partner on standby for any ongoing support, troubleshooting, and performance optimization.

Why Partner with a Microsoft Certified Solutions Partner?

Upgrading from Windows 10 to Windows 11 is an opportunity to improve your business’s security, efficiency, and overall technology experience. Partnering with a Microsoft Certified Solutions Partner provides added support, expertise, and peace of mind.

Benefits of Working with a Certified Partner:

• Enhanced Security: Certified partners configure Windows 11’s advanced security features, ensuring your systems stay protected.
• Improved Productivity: With expert setup, compatibility issues are minimized, allowing your team to work without interruptions.
• Streamlined Transition: Professional planning and device preparation lead to a smooth, risk-free upgrade, reducing downtime and disruptions.

Ready to Make the Transition? Schedule Your Windows 11 Assessment Today!

With Windows 10’s End of Life approaching, the time to upgrade is now. Ensure a secure, productive, and efficient transition by working with a Microsoft Certified Solutions Partner. Click below to schedule your Windows 11 upgrade assessment.

 

By LNS Solutions | 5 min read

Accounting Firm Year in Review: How Did Your IT Perform?

The chaos of tax season has passed, and you’re finally able to catch your breath. How did your firm manage the stress? Did you notice any workflows or systems in your firm that didn’t perform at the standards you’d need to truly thrive?

Though we hope you’re enjoying some well-deserved downtime, this period is also a good time to take stock of your technology and take note of what processes and workflows worked and which didn’t, so you can start planning for greater efficiency and less stress in the next tax season.

Based on our decades of experience helping guide the IT strategy at accounting firms, here are some areas that we feel firms should focus on.

Modernize Your Accounting Firm with Cloud-Based Technology

The incentive for modernizing your firm with cloud-based technology is simple and compelling. Accounting is already hard; coordinating communication, gathering invoices, and settling tax issues is complicated and tedious, and your technology shouldn’t add to that complexity.

Adopting cloud technology streamlines all those processes by automatically updating your line of business software to the latest version, centralizing workflows into platforms, and improving the security of your technology. An overwhelming 91% of accounting professionals state that these new technologies enable them to focus on clients or enhance overall productivity, according to a study by Sage.

Let’s look at each of those in greater depth.

Standardize Workflows and Reduce Errors

When your software systems are complex, with each tool and application requiring a separate workflow, it slows down your organization and introduces significant room for error. It’s easy to get caught up in the mix.

Adopting cloud-based accounting solutions allows you to standardize workflows and even automate routine tasks like data entry, invoice processing, and reporting, bringing consistency and uniformity to your processes.

The cloud connects various functions within the firm—such as bookkeeping, tax preparation, and auditing—into a cohesive workflow, minimizing the risk of errors. Powerful automation features can also reduce the burden on your CPAs and help them focus on more complex and value-added services, such as strategic advisory and financial planning. This also helps in complying with the FTC Safeguards rule, which mandates financial institutions to implement secure and standardized procedures.

Centralize Data

According to a McKinsey report, office workers spend 1.8 hours every day—9.3 hours per week, on average—searching for and gathering information. In the middle of the tax season, with deadlines looming, you don’t want your employees scrambling for data.

Centralizing your data on a cloud platform makes it easier to manage, handle, and retrieve data. This improves your firm’s processes by providing a single point of contact for all data and ensures that your accountants have access to the most up-to-date and accurate information, which eliminates confusion and discrepancies that arise from multiple versions of data being stored across different systems.

With centralized data storage, data management and security also become a great deal simpler, as it’s easier to implement and maintain robust security measures when data is housed in a single, controlled environment, rather than securing each PC individually.

Give Remote Employees Timely Access to Data

There's no debate as to how we work has changed dramatically over the past few years, especially with the rise of remote working. As an accounting firm, if you harness remote working properly, you can satisfy your staff’s need for work–life balance, attract top talent, and empower staff to collaborate more effectively.

But to securely embrace mobility, your team needs hassle-free and secure access to data and documents no matter where they are.

With the right tools and a tech setup that fully bolsters remote working, your firm can unlock seamless cooperation by enabling multiple users to work on the same documents and financial records simultaneously. In doing so, removing friction and bottlenecks hinders productivity. Whether working with clients or within their teams, better coordination helps everywhere. According to Wolters Kluwer, there is a reduction in the number that are being prepared without in-office contact with taxpayers.

Improve Customer Experience

Today, CPAs are increasingly recognized as strategic advisors, a role that extends far beyond traditional accounting and tax services. With advanced financial tools and analytics, businesses look to CPAs to guide their business strategies.

To meet this new role, CPA firms are elevating their services and focusing on providing a superior customer experience that distinguishes them from the competition.

Be it real-time updates or seamless communication, clients today expect personalized services and quicker service delivery than in the past. By leaning on centralized data and the latest generation of analytics tools, CPAs can gain deeper insights into their clients’ financial situations, allowing for more personalized services, as CPAs can tailor their advice and strategies to the specific needs and goals of each client.

Another example of how the cloud can help improve the customer experience is client portals. Allow a client to log into their secure online portal to view the status of their tax return preparation or audit process. They can see which documents have been reviewed, which are pending, and any immediate actions they need to take. This transparency keeps clients informed and engaged while facilitating quick, hassle-free communication.

As a whole, modernization with the cloud improves service delivery, turnaround times, and response times across the board.

Get Vigilant About Your Cybersecurity Defenses

As an accounting firm, you deal with some of your client’s most sensitive data. This makes your firm an alluring target for cyberattacks. According to Accounting Today, since the COVID-19 pandemic, accounting firms have seen a 300% increase in cyberattacks as an industry. Protecting your firm’s and clients’ sensitive data is critical. Be it the trust of your clients, stakeholders, or regulatory concerns.

Hardened Network Exterior

The first step in safeguarding your network is to harden its exterior, or “perimeter,” which means the defenses that protect people inside your organization from external threats.

Cybercriminals tend to target CPA firms using a few different methods. The first is with phishing emails designed to steal credentials or deliver malware, exploiting employees’ access to sensitive financial data. The second is to attempt to gain entry via unsecured remote access points that allow unauthorized users to infiltrate the network.

To harden those defenses, you should focus on building out and configuring robust firewalls, intrusion detection systems, and multifactor authentication (MFA). A secure network perimeter is the foundation of a strong cybersecurity strategy.

Internal Security Controls

Internal threats are some of the most challenging tasks to tackle in cybersecurity. Whether malicious or unintentional, the risk posed by your own staff (intentionally or not) is immense. That’s why it’s crucial to implement internet information controls to monitor and regulate data flow within your network.

Easy steps you can take to improve internal security include setting up user permissions. Well-defined roles and permissions for each user in your network help safeguard sensitive information to authorized personnel. It’s a good idea to conduct an annual audit to identify and address vulnerabilities, stay compliant with the latest regulatory updates, and quickly respond to any security incidents.

Going deeper into internal security, you can consider adding internal controls, such as mandatory two-factor authentication (2FA), for access to client financial data. You can also segment your network and workflows to ensure that no single employee has control over all aspects of a critical financial transaction.

Cybersecurity Training

While companies, industries, and employees may differ in their approaches to cybersecurity, one constant remains: Employees are the weakest link in any cybersecurity chain. For CPA firms, this vulnerability is especially critical, given the sensitive financial data they handle.

Even the best technology cannot protect your firm if your employees are not well trained in cybersecurity practices. To mitigate this risk, fostering a security-centric culture from the top down is essential. Conduct regular training sessions to educate your staff on the latest threats and best practices for preventing breaches.

Data Backups

Despite your best efforts, data breaches and malware attacks can still occur, posing significant risks to CPA firms that handle sensitive financial information. Be prepared by implementing robust data backup strategies tailored to your firm’s unique needs. There are a range of solutions that can cater specifically to CPA firms that offer automated backup options. Have a question? Reach out to our team for some help!

LNS Solutions – 30 Years of Experience Helping Accountants and CPAs

For decades, we’ve helped Tampa’s accounting firms take control of their IT and face cybercriminals with confidence. If you’re struggling with security concerns or the questions around your cyber insurance, contact us any time at (813) 393-1626 or info@lnssolutions.com. We look forward to speaking with you!

 

By LNS Solutions | 5 min read

Cyberattacks are an ever-growing threat to businesses of all sizes, especially with the rise in AI and automation software enabling cyber criminals to rapidly target more and more people and businesses. A recent study found that 68% of data breaches come from human error, while only 15% of companies provide ongoing cyber awareness training to their employees. And many industry experts think even that is generous, estimating human error to account for more than 90% of data loss and security incidents.

Not Providing Cybersecurity Training Is Like Leaving the Front Door Wide Open

Thieves really appreciate it when you don’t secure your valuables, and not providing cybersecurity training for your staff is like leaving your home unlocked with the front door wide open.

Of course, you wouldn't leave your home this way, so why aren’t you helping your team better understand how to protect your business? Many employees lack the knowledge and awareness to identify and avoid cyber threats. Phishing emails, social engineering tactics, and malware attacks are becoming increasingly sophisticated.

The Cost of a Cyberattack

A successful cyberattack can be devastating for your business. In fact, the average cost of a data breach in the U.S. is over $9 million, and over $4 million globally. This includes not just the cost of recovering lost data, but also the regulatory fees, legal fees, and reputational damage, and it doesn’t account for downtime, opportunity costs, and many other costs associated with a security breach.

Needless to say, you really want to avoid one. So let’s take a look at what you can do to lock the front door, close the windows, and better protect your business. 

Cybersecurity Training: An Essential Investment

Cybersecurity training is an essential investment for any business that wants to protect itself from cyberattacks. Regular, ongoing training can equip your employees with the knowledge and skills they need to:

• Identify and avoid phishing emails
• Create strong passwords and practice good password hygiene
• Recognize social engineering tactics
• Report suspicious activity

Here are a few steps you can take to help prepare your team and shore up your business’s vulnerabilities.

1. Use a cybersecurity training platform. There are several good platforms that will send a monthly short simple training video to your staff. Why monthly? Because thieves change their methods. Gits cards, bank wires, and tools like Venmo have all been compromised. New methods of stealing are created and your team needs to know about them. Talk to your MSP or IT team for their platform recommendations.
2. Test your team with phishing emails. Phishing email attempts lie to your staff and get them to divulge information or go to a bad actor’s website. Help your team understand who is knocking on the front door and simply press delete on these junk, harmful emails.  You can also report these malicious emails pretty easily to help protect the neighborhood so to speak, not just your home.
3. Checks and balances. People make mistakes—sometimes one person clicks a bad link and gets compromised. A good process to mitigate damage is to have a multi-step process to verify the intended recipient of a money transfer is legitimate. Is the vendor actually who they say they are? Is the invoice real? Did you call a number you know is real and verify it? Simple steps will save a lot of time and money.

Promoting cyber hygiene across your organization, including encouraging employees to discuss cyber safety with their families, can further strengthen your overall security posture.

Beyond Training: Implementing Other Security Practices

Cyber awareness training is really just the first step in securing your business from cyber threats. For example, implementing security measures like multi-factor authentication (MFA) can quickly add an extra layer of protection for your business.

Don't wait until it's too late. Invest cybersecurity training today to save your business time, money, and a lot of headaches down the road. Additionally, work with your IT team or MSP to discuss other measures you can take to strengthen your cybersecurity.

If you’d like to learn more about how you can bolster your business’s security, contact us for a free security consultation. We know how to help you protect your business. Or take our free cyber assessment quiz today.

For more information, visit our Cybersecurity page to learn how we can help businesses like yours.

Related Article "Is Your Business Vulnerable from a Hidden Cyber Threat?"

 

Did you know a staggering 54% of organizations face attempted cyberattacks on internet-connected devices (IoT) every single week? These aren't just your computers and servers—it’s your Wi-Fi, cameras, printers, Bluetooth speakers, Alexa devices, cell phones, access points, even fax machines. With the number of IoT devices projected to explode to over 207 billion by the end of the year, are you sure your business is properly protected?

The Internet is Using You

You use the Internet for work and personal reasons every day, but have you stopped to consider the Internet uses you in return? Yes, that's right, you use the Internet, and it uses you. Before you wave off the thought, take stock of the numerous internet-connected devices that populate your personal and professional life—any one of them might be hiding a cyber thief you can’t see. But they can certainly see you.

Every device connected to your network uses the Internet, and every one of these devices poses a potential risk to cyberattacks. Many companies, especially smaller businesses, might not even realize how many devices are connected to their network. This creates a hidden security blind spot that cybercriminals can exploit to steal your valuable data and disrupt your operations.

The Point of Entry for Hackers is Only Increasing

With the continual rise in remote work and learning environments, more and more IoT devices are being utilized to streamline efficient workflows. While these devices offer convenience and automation, they introduce new security vulnerabilities to your network.

These vulnerabilities can stem from weak default passwords, outdated firmware, or a lack of encryption. Hackers can exploit these weaknesses to gain access to your network, steal sensitive data, and disrupt your operations.

For instance, a relatively recent cyberattack targeted an unsecured, Internet-connected fish tank in a North American casino. Hackers gained access to the casino’s network through the fish tank and stole 10 gigabytes of data. Malicious actors can be extremely resourceful.

Your data is valuable and needs to be protected. An unsecured security camera (or fish tank!) can be exploited by hackers to gain access to your entire system, costing you downtime, lost productivity, and potentially millions in damages.

Take Steps to Secure Your Network

Set up some time with your MSP or IT partner to discuss your current network security measures in place. As the landscape of cybersecurity is constantly evolving, this is something you should be doing regularly. In the meantime, here are some tips toward securing your network and data: 

1. Remove Admin level from your standard user PC accounts. Your users might think they need it, but they don’t in a properly managed network.
2. Update device firmware regularly. Just like your computers, ensure all your IoT devices have the latest firmware updates to patch vulnerabilities. You’d be shocked to learn that many people may update their PC operating system, but forget about everything else on the network.
3. Segment your network. Isolate IoT devices from critical systems on your network to limit the potential damage if one device is compromised.
4. Deploy Advanced Security Solutions. Deploy Endpoint Detection Response (EDR), Managed Detection Response (MDR), and Security Awareness Training (SAT) for all users. If you don’t know what these acronyms are, ask your MSP provider about them. They should already have these deployed to protect your business.
5. Educate your employees. Train your employees to identify and report suspicious activity on the network, such as unexpected login attempts or unusual device behavior.
6. Enforce strong password policies. Change default passwords on all devices and enforce strong, unique passwords for each device. Also, ensure everyone is using Multi-Factor Authentication (MFA) for any of their devices and accounts.

You are not going to become a security expert from a simple blog, but our hope is to get you to challenge your internal IT staff or MSP.

Do you have the right protections in place? Are you confident in them? The crucial question then becomes, “On what grounds is your confidence based?” Relying on hope is not an effective approach for managing IT security. It’s essential to secure your network proactively before cyber intruders find certainty in their ability to compromise it.

Work with a Trusted Cybersecurity Provider

There is quite a bit you can do on your own, mostly by being vigilant and aware. But to create a truly secure network, you should work with an MSP or IT security expert to ensure the best protections and practices are in place.

Even if you already have an IT partner, it doesn’t hurt to get a second opinion on your MSP security set up. We’re glad to discuss how we can properly protect you and identify any gaps in your security protection.

Visit our Cybersecurity page to learn how we can help businesses like yours.

 

How to Get Your Law Firm’s Cybersecurity House in Order

 

This is the 2nd in a 3-part series about IT Services and Security for Law Firms. Please click here for the 1st article.

As the legal services field continues to embrace technology at an unprecedented pace, law firms worldwide are also facing increasing pressure from cyber threats.

According to Checkpoint Research, global cybercrime saw an 8% year-on-year increase in Q1 2023, with insurance and legal services experiencing the second highest year-on-year change.

On average, 1 out of 31 legal services firms faced an attack in the first quarter of this year.

From confidential client documents to legal strategies, law firms possess massive amounts of sensitive data, which makes them ideal targets for criminals. The ability to safely handle and protect sensitive client information needs to be a top concern for any law firm.

With financial stability, reputation, client trust, and the threat of severe legal consequences all hanging in the balance, it’s time for law firms to ask themselves if they are doing enough to keep hackers and cyber threats at bay.

Here are 8 important steps law firms should take to ensure their cybersecurity protections are up to standard.

Is someone currently logged into your cloud services?

Law firms have been slow but steady adopters of cloud platforms. When deployed correctly, cloud applications can help improve collaboration, streamline efficiency, and reduce network complexity.

However, the cloud can also make it hard to know who has access to your network and who doesn’t. Ensuring the security of your cloud systems requires vigilant monitoring and response mechanisms.

• Continuous Monitoring:
  To view all the activity across your organization’s cloud environments in real-time, you can use services like AWS CloudTrail, Azure Activity Log, or Google Cloud Audit Logs. These tools provide deep visibility into your cloud environments, helping your firm detect unauthorized or malicious activity across sensitive legal case files and confidential client data quickly.
• SIEM Integration
  The vast amounts of log data your cloud platforms generate are unactionable without context. By integrating those logs into a security information and event management (SIEM) system, you can monitor and analyze activity within legal software and document management systems. This allows for real-time analysis, correlation of events, and immediate alerts for suspicious activities.

Have you addressed old vendor usernames and passwords?

Old vendor usernames and ineffective password management practices can make it easy for attackers to infiltrate a law firm. Here are some of the steps you can take to ensure that account management processes aren’t creating new cybersecurity vulnerabilities.

1. Identify and Deactivate Inactive Credentials
   It’s important to regularly scan active directories and identity management systems to identify old or inactive vendor accounts and credentials across your organization. These accounts must then be disabled to prevent threat actors from misusing abandoned accounts.
2. Ensure User Management Best Practices
   After ensuring that outdated credentials can no longer be misused as an attack vector, talk with your technology vendors to ensure that new credentials meet security best practices. This may include enforcing complex, unique passwords and encouraging the use of passphrase-based authentication or multi-factor authentication. Additionally, good password policy includes alerting mechanisms, so your administrators know when hackers have launched a password-based attack.

Have you fixed old email accounts that are still active?

Inactive emails are a security concern for law firms, as they may still contain residual customer data and other sensitive information that don’t fall under the category of classic personally identifiable information (PII). They can be used by attackers to leak data, harvest credentials, or take over accounts.

• Email Account Audits
  Law firms need to implement email account auditing processes to ensure that old or inactive accounts do not become security liabilities. This process may involve regular automated scans, identifying inactive accounts, disabling login access, revoking permissions, and managing the residual data. In some cases, inactive email accounts might still contain sensitive information, confidential correspondence, or access to critical systems.
• Data Management
  Residual data can be archived or deleted, depending on your data retention policies and compliance requirements. Often, legal services firms need to retain historical email data for compliance, which might require implementing archiving solutions that allow you to preserve emails while deactivating accounts. Maintaining a log of these activities can serve as a helpful audit trail.

Have you overlooked office devices logged into admin accounts, including copiers, scanners, and other operational technology?

Administrative accounts on copiers, scanners, and other office equipment connected to your law firm’s corporate network must be secured, but many law firms simply overlook these “dumb” devices, assuming they pose no serious threat.

In fact, they can serve as an entry point for attackers.

• Secure Device Access
  Law firms should ensure that they change the default device credentials and that they update the firmware or software on these devices regularly to close vulnerabilities. Only authorized personnel should be allowed to access administrative accounts. Additionally, you should use authentication measures, including biometric access systems or smart cards, to decisively close this back door into your network.
• Network Segmentation
  You can isolate the network that these devices are connected to minimize their exposure to more critical internal networks. Implementing robust firewalls and monitoring inbound and outbound traffic may further bolster security.

Have you implemented multi-factor authentication with conditional access?

Multi-factor authentication (MFA) enhances security by requiring multiple forms of verification, and when combined with conditional access policies, it provides dynamic and context-based security.

• MFA Implementation
  Implementing multi-factor authentication is crucial for legal firms as it provides an additional layer of security. This additional layer of authentication can include OTPs (one-time passwords), biometrics (fingerprint, facial recognition), smart cards, push notifications, or even hardware tokens.
• Conditional Access Policies
  Leveraging conditional access policies allows firms to dynamically adjust security requirements based on user attributes, device health, location, and other risk factors. This minimizes friction and allows you to deploy security measures based on dynamic, real-time intelligence, for example, requiring remote access, but not for in-office access.

Have you restricted access to high-risk countries and zones?

Limiting access to specific geographic regions can significantly reduce the attack surface of your law firm’s network.

• Restricting High-risk Zones
  Assessing the risk-reward ratio is essential when considering access restrictions to high-risk countries or other cybersecurity threat hotspots. For most legal firms, configuring your firewall and content delivery networks (CDNs) to limit access from Russia, Iran, or other high-risk zones is an effective way to mitigate the unknown threat.

Has your firm already been compromised?

With hackers moving quietly through your network, many law firms don’t even know that they’ve been infiltrated. Proactively monitoring the dark web can help you detect compromised credentials and information quickly, take corrective action, and prevent unauthorized access.

• Dark Web Monitoring Services
  It’s worthwhile to invest in dark web monitoring services that search for compromised credentials or leaked data associated with your organization. These services continuously scan underground forums and marketplaces for stolen data and alert you promptly. This can greatly reduce the impact of cyberattacks.
• Documented Response Procedures
  Upon discovering a compromised credential and alert, do you know how to swiftly respond, change the affected passwords, and notify the affected users. If you discover that sensitive or confidential information has been leaked, how will you learn about the exfiltrated data? It pays enormous dividends to have a plan.

Are your employees pasting sensitive information into ChatGPT?

The use of AI-driven chatbots introduces unique security and ethical considerations, especially in the legal context. As more law firms turn to templatized documents created by ChatGPT and other large language models, now is the time to get proactive about ensuring that those applications are always deployed with security as a priority.

• Data Loss Prevention (DLP)
  DLP software helps intercept and prevent data leaks in real time by preventing the pasting of sensitive information into chatbots and other AI software. As a legal firm bound by professional attorney–client privilege and client confidentiality, implementing DLP helps prevent sensitive information from being leaked into ChatGPT and other AI chatbots.
• Chatbot Security Measures
  If your firm does decide to utilize chatbots to improve efficiency and streamline workloads. It’s necessary to analyze potential chatbot solutions in terms of the data encryption, secure storage, and access controls they offer. Inform your staff on the ethical implications of AI chatbots, emphasizing the importance of safeguarding client confidentiality and adhering to professional codes of conduct.

A Cybersecurity Partner with Deep Commitment to the Legal Service Community

Cybersecurity can’t be disregarded as an afterthought anymore. LNS Solution has been helping Tampa’s legal services community with cybersecurity consulting and services for decades. If your firm wants a guide to bring clarity and focus to your cybersecurity efforts, contact us any time at (813) 393-1626 or info@lnssolutions.com.

Law Firm Cybersecurity: Insurance Questionnaires

 

This is the 1st in a 3-part series about IT Services and Security for Law Firms. Please click here for the next article.

Law firms are struggling with next-generation malware threats, social engineering attacks, and other forms of cybercrime that disproportionately target the legal services industry. To protect themselves against potentially catastrophic data loss or major downtime, many firms in the Tampa area have turned to cybersecurity insurance.

However, picking the right insurance plan and navigating the application process are often stressful for law firms, especially when it comes time to self-report on your cybersecurity defenses with the questionnaire they provide.

Those forms are filled with technical terms, such as multi-factor authentication (MFA), end-point detection and response (EDR), and “ransomware control.” Is your firm struggling to understand the boxes that your insurance questionnaire is asking you to check? Let’s take a deeper look.

Question 1: Can your users access e-mail through a web application or a non-corporate device? If “Yes,” do you enforce MFA?

All users accessing email should be required to use what’s known as multi-factor authentication (MFA).

MFA is a multistep account login process that requires users to enter more information than just a password. After entering a password, users might be asked to enter a temporary code, answer a secret question, or scan a fingerprint. A second form of authentication is one of the most effective ways to prevent email breaches, with Microsoft finding that it can help reduce password-based attacks by up to 99%.

Question 2: Do you allow remote access to your network? If “Yes,” do you use MFA to secure all remote access to your network?

MFA is extremely effective in preventing ransomware attacks, as well as traditional hacks. A ransomware attack begins when an attacker acquires account credentials. However, with MFA, the attackers lack the additional information required to gain access to the target account. This prevents the attack and keeps it from entering the system.

It’s worth noting that not all MFA systems are built the same in terms of the practical level of protection that they offer.

In recent years, there’s been a spate of attacks specifically targeting MFA solutions, including a very high-profile breach at hardware company Cisco. In that attack, criminals flooded users with requests to verify their identities on a mobile security application (in this case, Duo) until the overwhelmed party verifies the access out of sheer frustration. In other cases, hackers can use fraudulent landing pages or social engineering attacks to undermine an MFA system.

This makes it important to understand that MFA should be complemented by a robust cybersecurity awareness training program, but more on that topic later.

Question 3: Do you use an endpoint detection and response (EDR) tool that includes centralized monitoring and logging of all endpoint activities across your enterprise?

Endpoint detection and response (EDR) is an integrated security solution that combines real-time continuous monitoring and collection of data from your endpoints (PCs, laptops, and tablets) with rules-based automation to respond and analyze threats.

There are 4 primary functions of an EDR security system:

1. Continuously monitor and collect data from your network endpoints
2. Analyze data to identify anomalies or threat patterns, not just known malware or attacks
3. Automatically respond to or remove those threats, then notify your security team
4. Perform forensics analysis to research threats and understand their impact and reach

Having an EDR system is something we strongly recommend for our clients in the legal services field, though it’s worth noting that there are new concepts in detection and response technology that complicate answering this question.

If you have a managed detection and response (MDR) solution—like the kind we offer here at LNS Solutions—then you have greater protection than a standard EDR, which means you can confidently answer yes to the question above. MDR solutions add the vigilant support of human personnel to weave the EDR system into a larger security plan and analyze the data.

Question 4: Do you prescreen emails for potentially malicious attachments and links?

If “Yes" to the above question, do you have the capability to automatically detonate and evaluate attachments in a sandbox to determine if they are malicious prior to delivery to the end user?

Another security tool that we strongly recommend law firms adopt is advanced email scanning, which offers protection against malicious URLs and weaponized attachments. The latest generation of email security tools are tuned to help mitigate not just phishing, but also account-based takeover (ATO), impersonation, and business email compromise attacks.

The second part of that statement, “malicious links,” is equally important. In recent years, hackers have started to get creative about the ways in which they leverage fake domains to trick people into clicking on malicious links. Lookalike domain names are one such strategy that is designed to look like legitimate domains, but in fact provide a way for hackers to enter your systems.

Examples

• bannkofamerica.com vs. bankofamerica.com
• amazoon.com vs. amazon.com
• Gooogle.com vs. Google.com

Are you confident that your staff is going to notice the differences above while they’re busy working?

Cybercriminals are banking on the idea that they won’t, and statistics show that they’re often right. To mitigate this problem, there are tools you can employ, but your security team should also be vigilant about identifying high-risk domains, scanning for lookalikes during regular security maintenance, and training your staff on how to watch out for this form of attack as they work.

Cybersecurity Insurance Questions You Might See

The above are the questions that our legal services clients ask us about most often, but there are several other confusing questions that you may encounter during the cybersecurity insurance process. Here are some of the other common questions that give our legal services clients trouble:

• How many personally identifiable information (PII) records is your business storing?
  Many firms are confused about what constitutes PII, or don’t have an inventory of exactly how much PII they’re storing.
• Do you provide anti-fraud training to employees?
  Is fraud training the same as cybersecurity training? It can be. To check this off with confidence, you’ll want to ensure that cyber awareness training includes all the necessary modules.
• How long does it take you to install critical network patches and updates?
  Without closely tracking the efficiency of your network management efforts, many law firms don’t’ have a clear answer to this question.

When in doubt, the best way to shop for and purchase cyber insurance is with the help of a trusted cybersecurity partner, who can help you navigate all the ambiguity.

LNS Solutions – 30 Years of Legal IT and Cybersecurity Expertise

For decades, we’ve helped Tampa’s legal services firms take control of their IT and face cybercriminals with confidence. If you’re struggling with security concerns or the questions around your cyber insurance, contact us any time at (813) 393-1626 or info@LNSSolutions.com. We look forward to speaking with you!

 

Small Business Cybersecurity: The 5 Most Common Mistakes

There was a period long ago when small businesses could (partly) rely on their size to hide them from hackers. But the time for “security through obscurity” has long passed, and cyber criminals are now targeting small-and midsize businesses at almost the same rate as enterprises.

According to statistics from penetration testing company Astra Security, approximately 43% of cyberattacks target small businesses annually, with an alarming 46% of these attacks being directed at companies with 1,000, or fewer employees. The average attack costs $25,000 per incident.

While designing and building a comprehensive cybersecurity strategy takes high level expertise, there are some relatively simple cybersecurity issues that we find routinely contribute to a high number of hacks here in Tampa.

 

Here’s what businesses can look out for, and some tips for keeping yourself safe.

1 - Weak Passwords and Poor Password Management

Here’s a terrifying security factoid: the password “123456” has been consistently at the top of the list of commonly used passwords for several years in a row. Even in 2023, after decades of articles, training sessions, and face-to-face advice, poor password practices continue to cause massive trouble for many small and medium businesses.

Why? Weak passwords contribute to a host of serious security issues, such as increased vulnerability to “brute-force” attacks in which hackers simply try to guess your password to gain system access, phishing attacks, internal unauthorized access to sensitive data, and compliance problems.

One way to overcome this problem is multifactor authentication (MFA) and password managers.

MFA adds an extra protection layer beyond the password by requiring users to provide two or more forms of identification other than a password before being able to access an account. This may include biometric data (facial recognition, fingerprints, etc.) or a one-time password (OTP) on a trusted mobile device.

MFA is the single most effective cybersecurity step you can take, as it solves over 99.9% of authentication-based attacks, according to Microsoft.

It is also never advisable to use the same password for multiple accounts, a fact that you should make clear to your staff on a regular basis. Password managers help create and manage multiple passwords for different accounts helping automatically enforce password best practices.

2 - Not Preparing your Staff for Cybersecurity Success

Employees are considered the weakest link in an organization and the number one cause of infiltration and data loss.

In light of this statistical fact, it becomes critical that you have a cybersecurity training program in place that makes them aware of potential threats and prepares them to counter those dangers.

This is especially true as ChatGPT and other AI models enable attackers to gather and analyze vast amounts of data about potential targets from various sources, such as social media, public databases, or previous breaches. This information is then used to craft highly personalized and convincing phishing messages.

By allowing criminals to tailor the content of their attacks at scale, hackers increase their chances of success and dramatically raise the bar for security training programs. Businesses must implement regular cyber awareness training, which includes testing their employees’ abilities, tracking progress, and making targeted improvements to proactively stay ahead of those threats.

3 - Poor Patching and Updating Procedure

Unpatched software and hardware are a common source of cybersecurity attacks, although most businesses without internal security staff don’t fully realize what that means or how vital this security measure is.

The SolarWinds attack in December 2020 that made national headlines was the result of unpatched software, which allowed hackers to insert malicious code into unpatched software. That infected software was then distributed onto SolarWinds customers.

In this case, hackers used that access to gain unauthorized access to both private and government organizations, resulting in several massive data breaches that did millions in damage.

Another high-profile, infamous attack that resulted from unpatched software was the WannaCry Ransomware Attack in May 2017. This highly successful ransomware exploited a vulnerability in Microsoft’s Windows operating system, which the company had already released a patch a few months before the attack.

Because organizations had not installed the security updates, they left their systems vulnerable, and the ransomware spread across the globe with amazing speed, causing up to $4 billion in damages.

4 - Neglecting Disaster Recovery Maintenance

Your business needs to have a plan for responding to disasters of all kinds, including natural disasters such as an earthquake or a flood (which are happening with greater frequency), or a man-made disaster such as a cyber-attack.

According to Accenture’s Cost of Cybercrime Study, small businesses are targets of 43% of cyberattacks, yet only 14% are prepared to protect themselves and recover.

Having a disaster recovery plan (DRP) is more than just backup. It’s being able to use well-maintained backups to restore services after an attack to minimize disruption and contain financial damage. It’s a combination of IT systems, people, processes, and careful planning.

Testing is an area of particular weakness for many organizations.

To properly test your DRP, you must define a clear set of objectives and create a comprehensive test plan that outlines the scope, methods, roles, and timelines for the test. Then isolate the test environment to avoid impact on live systems and simulate all the disaster scenarios that you’re trying to prepare for.

Monitoring and documenting the recovery process, then evaluating the results against predefined objectives, will give you a clear picture if you’re as ready for cyberattack as you feel you are.

5 - Not having an Incident Response Plan

A cybersecurity incident response plan is a documented set of procedures and guidelines that enable you to efficiently handle and mitigate cybersecurity incidents within your organization.

What happens if your network gets infected with malware? Or, if an employee steals a password as they leave your company? What if someone loses a cell phone? These are just some of the scenarios that a properly designed incident response plan (ICP) will prepare you for.

Building an incident response plan can be a complex process, but here are the steps you can build a viable ICP:

• Start by auditing and documenting your network. Understanding your entire IT infrastructure and potential threats allows you to define the objectives and scope of the plan.
• Assemble a response team with predefined responsibilities to ease communication and decision-making.
• Identify which incidents you want to be able to respond to and classify them based on the likelihood of them happening and the severity of their impact.
• Develop and document response procedures for detecting, assessing, containing, eradicating, and recovering from each of the incidents you’ve just identified.
• Regularly test the incident response plan with the help of simulations and tabletop exercises, ensuring that the measures you’ve chosen function as you hoped.
• When an incident occurs, analyze both the incident itself and your response to understand what happened, how it was handled, and what can be improved.
• Regularly review and update the incident response plan to adapt to new threats, address changes in your IT infrastructure, or lessons learned from past incidents.

 If that process feels overwhelming to you, we encourage you to reach out to the friendly LNS Solutions team for help. In our 20 years of cybersecurity service to Tampa businesses, we’ve developed a streamlined process for incident response planning that takes all the guesswork and uncertainty out of the process.

Tampa’s Trusted Cybersecurity Expert

For 30 years, the LNS Solutions team has been helping businesses in Tampa defend themselves against cyber criminals, malware, ransomware attacks, and more. If your business is struggling to achieve the resiliency and confidence you need, contact our helpful team any time at (813) 393-1626 or info@LNSSolutions.com. We look forward to speaking with you!

 

Why is Cybersecurity Awareness Training So Important?

All it takes for a hacker to breach your company’s network is one of your employees opening a phishing email and clicking a link.

This means that before your IT team focuses on advanced measures like vulnerability testing and encryption, they need to strengthen their first line of defense by training your employees to identify, prevent, and combat cyberattacks.

This is why cybersecurity awareness training is so important. Security awareness training helps to educate employees in your organization on the different types of attacks, how hackers launch them, and what they can do to detect a threat. Making all your employees aware of cyberattacks significantly reduces the chances of hackers taking advantage of human errors.

Let’s explore the importance of cybersecurity training for employees, the direct benefits it provides, and the topics you should make sure to cover in your training program.

Benefits of Cybersecurity Awareness Training

Conducting comprehensive cyber security awareness training for employees will significantly reinforce your organization’s cybersecurity posture. Here are some of its key benefits:

• Prevent Data Breaches
  In regular, online training cybersecurity awareness training from a reputable provider, your team will learn about the latest techniques that hackers are using to attack businesses, including infiltration techniques attackers use, such as phishing and social engineering, and even more complex attacks like brute force attacks and business email compromise. The goal isn’t to make everyone an expert on complex cyber threats; it’s to arm them with the skills to detect the telltale signs of infiltration like suspicious email addresses and awkward phraseology, while also teaching them how to prevent disclosing confidential info to outsiders. By arming them with that knowledge, you enable them to play a major frontline role in preventing data breaches, 85% of which have a human element.
• Minimize Damage from Attacks
  If an outsider breaches the company’s system, the top priority is to contain the breach swiftly and minimize its impact. Cybersecurity awareness training teaches employees what they can do to contain the damage of an attack. By allowing them to practice how to communicate with senior leaders, how to report unauthorized personnel or access within the organization, how to log out of their systems, and following advanced instructions from your security provider, you empower them to be more than just defensive actors but play a proactive role in your security.
• Build a Culture of Security
  A quality cybersecurity awareness training program will go beyond imparting knowledge, it instills a culture of security preparedness in the organization. Regular education and discussion among employees about the importance of cybersecurity and their role in safeguarding sensitive data helps them stay an alert and ingrain a more conscious mindset about company security. Over time, your staff gradually develop a collective sense of responsibility toward keeping their workplace safe, which helps keep morale and teamwork high.
• Meet Cyber Insurance Requirements
  Organizations now rely on cyber insurance policies to them protect themselves against the direct financial losses from cyberattacks and recover from data loss events without huge expense. To mitigate the rising payout of insurance claims, most cyber insurance providers now require your businesses to demonstrate a commitment to cybersecurity best practices, which includes cybersecurity awareness training. Conducting training regularly not only assures your insurers that you’re doing everything to minimize risk, it may also reduce the insurance premium and ensure your claim is paid out as expected when an attack occurs.

What Topics Should Cybersecurity Awareness Training Cover?

A security awareness training program must be specialized and even a bit enjoyable to be effective. Thankfully, that no longer means dry, day-long training seminars that ask your teams to memorize and retain dense information all year.

Instead, businesses should be looking for regular, engaging online sessions that explain advanced technical topics in simple terms that everyone can understand, regardless of their technical expertise.

The focus should be on practical, specific measures for employees to put into action and periodic testing to test their real-world ability to manage various threats. Here are the essential topics that must be covered in a security awareness program:

Phishing Training

Because phishing attacks are so commonplace, this is one of the most important aspects of any training program. Employees must be trained to identify phishing emails and spoofed domains in the training. Misspellings and poor grammar used to be dead giveaways for phishing emails, but with ChatGPT, hackers can easily create grammar-proof emails.

Still, there are other ways that employees can be taught to detect signs of phishing, such as generic greetings, fake sense of urgency, analyzing the overall tone of the email, and avoiding clicking any links from unknown senders. As mentioned, it’s not just education but practical phishing simulation with company-wide reporting that will move your needle here.

Social Media Hygiene

Despite the fact that nearly half of U.S. employers block access to social media sites, most people still use social media while at work, either on company-owned or personal devices. This has major implications for your business’s security.

You must not only set clear guidelines for employees on what they should publicly on social media, then train them on how to use social media responsibly. Even if no one shares confidential information or user credentials on social media, seemingly harmless information can become useful for hackers.

Hackers can easily use the name of new software your company is using, or casual mention about their company’s technology, into leverage to gain access to your network.

Data Handling

Most industries are now struggling with compliance standards on data handling, which makes it a must-have feature of your cybersecurity awareness training. Staff must be informed of the rules and practices laid down by the regulatory bodies governing your industry and thoroughly trained on the best and safest practices for handling, storing, and sharing data within your organization.

Malware and Attack Response

All cybersecurity awareness training must instruct your team on what to do when malware strikes. There are crucial moments right after an attack that can make the difference between a few PCs being affected and a company-wide infection.

Training in this area teaches them specific actions to take an attack, such as how to properly disconnect a device from a network, safely shut down an affected computer, and how to preserve all the evidence of an attack, such as phishing emails, for future forensic work.

Mobile Device Security

Mobile devices have become a major part of many businesses, but they are are also a common target for attackers. All employees (especially those working from home) should be trained on proper mobile device usage, including safeguarding devices with strong passwords, utilizing encryption and two-factor authentication, and being cautious of public Wi-Fi networks.

This includes familiarizing your staff with which mobile device management (MDM) you’ve deployed in your network, so they know what data is safe to store on their mobile devices and how.

Remote Work Security

More and more companies are adopting the remote work culture and its many benefits without having fully accounted for the unique security risks it poses. Businesses with remote workers must provide cybersecurity awareness training that touches on these topics.

This includes how to avoid connecting to public Wi-Fi, how to properly use virtual private network (VPNs), ensuring that security software antivirus is up to date, working with multi-factor authentication systems (MFA), and a wide range of other critical security topics.

How Often Should I Conduct Cybersecurity Training?

In the past, cybersecurity training programs were infrequent and in-person, conducted a few times each year for days at a time. That approach simply doesn’t meet the needs of businesses now, who face attacks that change and evolve on a daily basis.

The most effective approach to security awareness training is to conduct regular online training all year round in short and targeted modules. Not only does this approach give your employees information on the latest cyber threats, conducting sessions online also gives your leadership access to metrics and dashboards that quantify your cyber readiness into improvable metrics.

Florida’s Cybersecurity Team

For over 30 years, the LNS Solutions team has been helping companies in Tampa defend themselves against cyber criminals and malware. If your business is struggling to achieve the resiliency and confidence you need, contact our helpful team any time at 813 393 1626 or info@LNSSolutions.com. We look forward to speaking with you!

 

How ChatGPT and AI are Changing Cybersecurity

Heated discussion about artificial intelligence (AI) has been a feature of the business media since ChatGPT was first released in late 2022.

While most of the media discussion revolves around which jobs ChatGPT is going to eliminate, there’s been a quieter but equally important discussion in the cybersecurity community about how AI is going to affect business security.

We’ve written this article to provide businesses in Tampa with everything they need to know about the coming generation of AI, how it’s going to make achieving lasting cybersecurity harder, and what you can do about it.

Hackers Leverage AI to Generate a New Breed of Malware Attack

One of the most discussed use cases for ChatGPT is in computer programming. Even in this relatively immature state, ChatGPT is already pretty good at generating simple code snippets for simple functions, allowing programmers to focus on more complex aspects of software development.

This means a more efficient development process and lower costs for companies. However, there are also nefarious uses for automatically generated code that business owners must familiarize themselves with.

Bypassing the Security Features of AI Models
In its current state, ChatGPT (and specialist AI models like AlphaCode) are designed not to generate code that could be used for malicious purposes. However, in just the few months since the software was released to the public, hackers have devised multiple ways to bypass those protections.

One hacking group has used ChatGPT’s application programming interface (API), in particular one called davinci-003, which’s specifically designed for chatbot applications. It turns out that the API doesn’t enforce the same restrictions on malicious content as the web version, meaning that hackers can bypass ChatGPT’s protections and generate any code.

The price of this service? A mere $5.50 for every malicious 100 queries on ChatGPT.

AI models that can generate malware code at basically no cost will likely lead to a rapid expansion in the number of threats, just as the commodification of Ransomware on the dark web did in 2019 and 2020.

“Polymorphic” Malware Threats
Hackers have already started to use the power of AI to create new and intelligent forms of malware as well, by embedding specialized forms of “polymorphic,” or mutating, code into their viruses. By changing its composition or “signature,” smart malware avoids endpoint detection and response (EDR) systems and is thus much harder for businesses to detect and isolate.

Polymorphic malware has existed for decades, but the new strains powered by ChatGPT are more dangerous and harder to detect.

In addition to a model that uses the API listed above, another recent proof of concept from Jeff Sims, principal security engineer at threat detection company HYAS InfoSec, demonstrates another possible approach. His software, called BlackMambo, logs keyboard strokes on a host computer, changing its shape every time it runs to avoid detection. According to the HYAS blog:

“BlackMamba utilizes a benign executable that reaches out to a high-reputation API (OpenAI) at runtime, so it can return synthesized, malicious code needed to steal an infected user’s keystrokes… Every time BlackMamba executes, it re-synthesizes its keylogging capability, making the malicious component of this malware truly polymorphic. BlackMamba was tested against an industry leading EDR which will remain nameless, many times, resulting in zero alerts or detections.”

Criminals Upgrade Phishing Attacks with the Power of AI

According to the  FBI’s 2022 Internet Crime Report, email attacks are the most common IT threat in America.

People are already falling for today’s email phishing scams, which are notorious for poor grammar and misspellings. As hackers adopt ChatGPT and other large language models (LLMs), criminals in Russia, India, and other countries will be able to create error-free emails on demand, making them harder to detect and more impactful.

As phishing emails become more impactful, and that impact is extrapolated out over millions of attacks that take place each day, we can expect to see a significant impact on the number and efficiency of phishing attacks.

But AI doesn’t just help with email writing; hackers have also started ChatGPT and other AI models to develop new phishing strategies, scan attack surfaces, and alter their cybersecurity attacks to respond to your phishing defenses in real time.

Businesses in Tampa must be ready to adjust their security to compensate.

What Can Tampa Businesses Do About It?

The good news is that generative AI has as many applications for cyber defenders as it does for attackers.

Arm Yourself with the Right Tools
IT services firms like LNS Solutions are using tools with built-in machine learning and artificial intelligence to find network vulnerabilities and proactively address the threat of malicious AI.

To reap the benefits of those tools, it’s important to work with an IT services firm with a track record of cybersecurity success. If you’re not partnered with a cybersecurity firm, then it’s critical that you keep your security software up to date. The cybersecurity arms race is always intensifying, and we’re facing a situation in which ChatGPT and other AI models will create malware that only other AI systems can detect.

Use AI to Extend Your Cybersecurity Team
There’s a well-documented lack of cybersecurity talent in the U.S. The country is estimated to lack about 1 million people in the cybersecurity field, putting countless companies in the U.S. at risk. By arming themselves with AI tools, businesses can extend the capabilities of human cybersecurity staff and enhance the efficiency and sophistication of their defenses.

For example, the cybersecurity company Sophos found that spam filters using ChatGPT, compared with other machine learning models, were more accurate, enabling them to catch far more threats than without. Integrating next-generation spam filters with other “ChatGPT” detection capabilities could help your business not just mitigate the rise in AI-powered attacks but also to win a competitive edge and reduce overall attacks.

Similarly, AI is now being used by a variety of LNS Solutions’ cybersecurity vendors to reduce false notifications and detections, speed up the security forensics process, and eliminate labor intensive security tasks.

Improve Your Cybersecurity Awareness Training
The largest source of cybersecurity vulnerability is an unprepared staff. Now is the time to double down on your cybersecurity awareness training and bring your entire team—from cleaning people and front desk staff to executives and boards of directors—up to task on the changing AI landscape.

Proactively facing the threat of AI head-on is the best way to establish a confident foundation for what’s sure to be a turbulent future full of dynamic AI-powered attacks.

Florida’s Cybersecurity Team

For over 30 years, the LNS Solutions team has been helping companies in Tampa defend themselves against cyber criminals and malware. If your business is struggling to achieve the resiliency and confidence you need, contact our helpful team any time at (813) 393-1626 or info@LNSSolutions.com. We look forward to speaking with you!