This series of articles will explore cybersecurity concerns in the modern workplace. We’ll explore the myriad of potential risk factors facing today’s organization, and look at tools and solutions to help your company fend off the bad guys.

In this entry, we’ll focus on the company’s personnel and the risk factors they can encounter daily. We’ll also discuss a lesser-known hacking tool called typosquatting.

Employees and independent contractors can have a definite impact on the security of a company’s systems and network. As businesses continue to grow, so will vulnerabilities at the perimeter. Like many cybersecurity breaches, such occasions can occur because of human error. A lack of security protocols, as well as a lack of compliance with the protocols set in place, means that your company’s network and data are at risk.

As cybercriminal activity becomes more pervasive than ever before, the first line of defense is reporting suspicious activity to the IT department. Familiarizing all employees with basic cybersecurity guidelines is fundamental to minimizing hazards and risks.

Control of Information

When creating successful security protocols, one of the first steps involves educating each employee as to why they should care about the security of their company. The importance of their own sensitive information should be emphasized as it could potentially be exposed in the event of a breach. Training and compliance must become a paradigm in their work environment. It will prepare them mentally and physically, minimizing risky behavior that could lead to a compromise.

Hackers know that the easiest way to gain access to a system is via naive entry-level recruits who lack security knowledge. Hackers may employ various types of social engineering, so the goal for employees is to consistently practice good “cyber hygiene,” scrutinizing the emails being sent to them to look for malicious links, attachments, ads, and pop-ups. Cybercriminals can also make strategically placed phone calls, posing as a member of the company’s own IT or security team, in which they sound convincing enough to gather intelligence that can be used to gain unauthorized access. Everyone within the organization must keep in mind to never give out personal or confidential information without obtaining proper authorization.

Typosquatting

Typosquatting, also known as URL hijacking or brandjacking, is another pernicious threat that employees must be made aware of. This emerging hacking method involves registering domain names that are (mis)spelled similarly to the domain names of trusted companies and brands. Hackers use the typosquatting domains to build websites with malicious purposes, such as distributing malware or viruses, capturing your security credentials, and so on.

An example scenario: you type a domain in your browser, but accidentally misspell it, or use the wrong top-level domain (.com, .net, .co, etc.). In most cases, the mistake is harmless, and sometimes a misspelled domain will lead you to the correct site, only if the company has specific registered domain names. In other cases, the user is taken to a malicious, fake website that is designed to download malware on your device automatically (a method that is extremely difficult to combat). Users can also be directed to typosquatting websites by phishing emails. The unexpected victim may receive an official-looking email that contains a link to a malicious website that has been designed to look and feel just like the real website it mimics – including login forms that are designed to steal personal credentials.

To combat typosquatting, always double-check the spelling of the web address you typed before hitting enter. Rather than typing the URL of the website in the browser’s location bar, search for the website using Google or other major search engines. These search engines will usually identify and de-rank phony websites, suppressing them in search results in favor of the authentic website. If you are following a link from an email to a website, read the URL carefully. If in doubt, search for the website in a separate browser tab, then compare the URL of the found site to the link you were sent in the email for any discrepancies.

Your company will likely own one or more domain names. Purchasing these extra “typosquatting” domain names will be a big part of preventing such breaches, as it will limit the number of domains that can impersonate your company’s brand, and might even help improve the company’s digital footprint. Using domain name permutation tools such as DNS Twist is an excellent way to monitor registration and hosting activity, as well as generating domain permutations.

Coming Up Next

This concludes part one of this series. In our next entry, we’ll discuss the dangers of unauthorized software downloads, bad password management, and multi-factor authentication.