How To Keep Cyber-Criminals Out Of Your Network

When phishers successfully duped several business executives last month by pretending to be the Internal Revenue Service or the Better Business Bureau, it took the problem of cybercrime to a whole new level.

The criminals have gotten smarter by not only using agency logos in their fake e-mails, but also including executives' names and companies. So just how can VARs make sure their clients don't get stung by cybercriminals?

"Generally if you get an e-mail from the Better Business Bureau, and it has your name on it, you're more likely to take notice and open it," says Sam Masiello, director of threat management at MX Logic, an Englewood, Colo.-based MSP vendor that is working with VARs to stop cyber-criminals."People in any organization need to make sure they're educated on these types of scams and attacks. As time goes on, they get better. The Better Business Bureau and IRS were spear phishing attacks because they targeted specific people. They used to blast to as many people as possible and try to get fish on the hook. These are highly targeted and can be manipulated to look very legitimate."

Masiello says VARs need to be vigilant in making sure their customers are educated and use the latest security measures to avoid similar social engineering scams in the future. The key to preventing social engineering crime from spreading is to rely on multiple layers of protection, he said.

"There's really nothing specific one can key on because they've gotten so good at crafting messages. They have few if any grammatical errors and they could have the right logo," he said. "It's trying to establish trust. If it doesn't look like it came from your IT department, or eBay or the Better Business Bureau, then people won't buy into it. It's more than botnet identification. Having multiple layers of defense is key."

And, being a managed services company, MX Logic feels of course that an MSP can best provide that protection. "A managed services piece sits outside the company's corporate infrastructure. If there is a denial-of-service attack, the managed service absorbs, as opposed to a client or desktop solution. Even if you're stopping it with an appliance, you're still paying for it on bandwidth," he said.

NEXT: Six tips to stop cyber-criminals

MX Logic compiled six tips that solution providers should think about for customers and for themselves.

1.) Choose a vendor/partner that allows for rapid identification and response, as well as 24x7 threat monitoring. 2.) Ensure that your e-mail filtration service includes several layers of protection and strong anti-phishing and attachment filtering capabilities. 3.) Safeguard your business by protecting your network at the perimeter. 4.) Establish and enforce Internet usage policies to reduce the risk that web borne threats will affect your business. 5.) Educate users on general e-mail and Web security practices. 6.) Don't get comfortable. The techniques and tactics of cybercriminals are always evolving.

Do IT Smarter, a San Diego-based MSP that sells its managed services to other resellers and directly to some legacy end users, said it's been about three years since one of its customers has fallen prey to cybercrime. But it's not by accident. The company uses four levels of protection to make sure customers don't even receive scam e-mails or other threats.

"We have protection at the desktop, the server, the firewall/perimeter, and we use MX Logic for e-mail filtering," said Lane Smith, president of Do IT Smarter. "That could be the most important one nowadays. If you can keep that stuff 100 percent away from your network in the first place, you're much better off. Especially when you have to keep all your e-mail now with new compliance requirements."

Do IT Smarter also regularly reminds customers not to open suspicious e-mails, he said.

"Part of our relationship with customers is that level of training as well. We teach them not to even open spam anymore. If you do open something, never log into anything generated from an e-mail," Smith said.