Archive for month: March, 2023

Most business owners today remember when the big computer concern for their businesses was antivirus software. Then came phishing and those strange links in your email you weren’t supposed to click. But what is coming now is a perfect storm of ransomware and difficult-to-trace cryptocurrency. Before you become one of the many business owners who say, “I didn’t think it could happen to me,” you should take the time to make sure your business is secure… or you might end up losing it entirely.

What is Ransomware?

Ransomware is what it sounds like. Various vectors that can be used to trigger an attack often encrypt all or almost all of a company’s vital systems, making them inaccessible unless unlocked by a decrypt key. Threat actors offer the decrypt key in exchange for a ransom, usually to be paid in cryptocurrencies like bitcoin which are difficult, but not impossible, to trace. As companies without other resorts fold to the pressure, even if they do pay a ransom and get a decrypt key, they face a possible exodus of customers who have lost confidence after an attack.

Why Me?

So often cybersecurity experts will lead off a talk by referencing some Main Street business, say an accounting firm in Idaho with five employees, sharing that the first reaction from the ownership of that business after they got ransomwared was, “I didn’t think it would happen to me.” This is due in part to sensational news stories of high-profile breaches. But those stories should set alarms off, not make business owners complacent.

If large companies, with entire departments dedicated to cybersecurity, can still get breached, how likely is it that you could too? Even LastPass, a company who knew it had a target on its back (because it stores passwords) was breached recently. The threat actors want the same things from these big companies as they want from the smaller ones:

1. Data: if you have proprietary technology, state-backed threat actors may come to take it to give their country’s industries a nudge forward.
2. Money: since most people are ill-prepared to deal with a ransomware situation, they are willing to pay up to receive a decrypt key and stop the pain.
3. Customers: if the threat actor can get their hands on the information of your clients, they have even more opportunities for ransom. Threat actors know that that Idaho accounting firm, even if it only had 50 clients, was an opportunity for multiple hits, especially if they went after the clients of the clients, and so on.

Basic Security Measures

The same cybersecurity experts who talk about the attack on the Main Street business that never expected it also note that even the most basic cybersecurity measures were not in place. Weak passwords were permitted, or weren’t regularly forced to be changed, or were written on post-it notes on the computer. All because people were “irritated” at security measures.

No one wants friction between tasks, or wants to verify a login with a text message code, but these are measures that were not dreamt up by the nerds in IT, but are basic responses to ever-escalating attacks from threat actors who want to exploit basic societal norms of trust. Here are some basic cybersecurity measures all businesses need to take:

• Keep clean machines: make sure your computers are using the latest security software, browsers, and operating systems and that they are consistently patched for software updates.
• Have a firewall in place for your Internet connection.
• Make regular backups of important business data and information and store them in physical and cloud locations.
• Train your team in cybersecurity principles and establish penalties for violations of company cybersecurity policies. These policies should include the use of unique passwords that should change every 90 days, however annoying that is to everyone. Multi-factor authentication (MFA) is also a must, which requires additional verification beyond a password.

Finally, the “when, not if” plan involves having a cybersecurity action plan, which is a written (printed-out, in case it gets encrypted along with the rest of your data) document outlining how a company responds to incidents. A key partner for creating this action plan, beyond your IT team, will be a cyberinsurance company, like Datastream, who has had experience drafting cybersecurity action plans and keeps up with industry best practices.

Need some help getting your cybersecurity house in order? We know some nerds who can help! Give us a call.

For those who don’t know, a red team is a group that plays the role of an adversary to provide security feedback from the perspective of an antagonist. While such an idea can be traced as far back as the “devil’s advocate” position created in the Middle Ages for canonizations of saints by the Roman Catholic Church, more modern applications have been seen by national security agencies post 9/11, and most recently, by companies looking to test their cybersecurity vulnerabilities.

So the security angle of a red team is obvious: have someone friendly to you try to find your weaknesses and then give you a report and recommendations afterwards. But there’s no reason to limit the red team concept to security only. Why not red team your business as a whole?

Challenge Assumptions

One of the challenges any business faces is the momentum of “we’ve always done it that way.” And, in some ways, that’s a good thing. If something works, there’s no need to be constantly messing with it. But on the other hands, technology and trends changes, pandemics happen, and while “we’ve always done it that way” has its merits, it can also be an excuse holding up necessary change. You can keep saying you’ve always done it that way as long as you add: “but we’re open to doing it better.”

A red team can help you challenge assumptions all across your business:

• Products/Services: what are the best products/services we have and how could they be better? What are weaknesses that competitors are exploiting? Could our back office run better? How?
• Workforce: what are similar businesses offering to their team members that we are not offering? What are the most important things for your team members in long-term retention? What would happen if my most important staff were to quit tomorrow?
• Customers: Is the customer mix you have now what will carry the company into the future, or do you need to develop an entirely different customer base?
• Industry: what are the larger trends in your industry and are you taking any of those on, or are you zagging the other way?

Remember that a red team is antagonistic. They aren’t looking to find out what’s good or right about your business. They are looking for what’s bad, what’s weak, and what can lead to a loss of market share or value.

Who Will Run the Red Team?

There are business coaches and consultants who have experience running red team analyses. If you can’t find one that you feel comfortable using for this exercise, consider putting together an internal team. The only drawback to an internal team is that they may find it difficult to think creatively, outside of the normal constraints of the company and the assumptions they are themselves trapped in, but as long as they treat it like the exercise that it is, stepping outside of their regular environment into one where there are no limiting beliefs, they can be effective as a red team as well.

Remember that like any exercise, you want clear KPIs. Examples, related to the questions we asked above, include:

• What are aspects of our products and services that can be improved, and how much might those improvements cost?
• How long would it take to replace the three most important employees at the company? And how much would it cost?
• Which of our customers is most likely to leave us? Least likely? Why?
• What are our competitors doing better and faster than we are?

Business owners don’t red team their businesses because they are afraid of something happening tomorrow or the day after. They do so because they have the long-term future (and value) of their business in mind and are willing to do the unusual and unexpected to keep their company and team operating at the highest level. A red team exercise is one of the more simple ways to do that.

Need some help coming up with a red team plan? We can help with that. Give us a call.

Over the past three years we’ve talked about the rise of remote work and questioned the future of office space. Those questions have accompanied disruptions in business, including companies insisting they would never go remote (until they did) and that they would always retain office space (until they didn’t). Still, as old-school managers insisted on a 100% return-to-office policy, and employees with newfound leverage refused, hybrid work has emerged as a compromise of the moment. But can it last?

Pain Points

One of the reasons people don’t like coming into the office is a commute. Long commutes have been shown to lead to lower job satisfaction and productivity and a recent study showed that up to a third of employees would be willing to take a pay cut in exchange for a shorter commute (or no commute at all). Of that third, almost 90% would take a cut as high as 20% of their salaries.

But apart from the downside of a commute, aren’t there positives to in-person working? Definitely.

One of the challenges many companies shared, particularly those who did not previously have remote work as part of their organizations, was the difficulty of imparting culture, particularly in the onboarding process. Many were used to activities like job shadowing or the informal interactions that build trust and camaraderie that happen in hallways or at water coolers that just can’t happen in things like “virtual happy hours,” however well-intentioned such cringe events are.

Factors in Considering Hybrid

So what do companies need to consider if they aren’t fully committed to remote work as the no-turning-back future but also know something big has happened and demands of “everyone back to the office” are falling on deaf ears and leading to resignations of some of their top talent? While each company has different needs, these four factors are common considerations when deciding if hybrid work makes sense:

1. Productivity — are your team members more productive at the office or working remotely? There’s been plenty of time to accrue data on this question.
2. Physical Space — do you need the same level of physical space that you did prior to the pandemic? If a large amount of your team is now remote, they don’t need permanent work stations.
3. Client Wants — are clients expecting to see you in person, and if so, are they expecting the sort of space that you had prior to the pandemic?
4. Talent Acquisition — what are the employees you are currently recruiting asking for? Do they want to come into an office, or are they expecting at least some kind of remote arrangement?

The answers to these questions will determine whether a company should use a hybrid work environment to bridge differences in their staff, or fully commit to one form of work or another. While some advocates of hybrid work seem to point to this as a wave of the future, others see it as an uneasy compromise or necessary phase for companies to use in order to find their future path, which may lie in remote or traditional working.

How Does Hybrid Work?

Many companies are requiring 2-3 coordinated days in the office, usually in the middle of the week to offer people maximum flexibility with their weekends. The rest of the week is remote. On the in-person days leadership knows everyone will be together so certain meetings are prioritized on these days. With the emphasis on collaboration, often these days will not be times for the focused, deep work that remote work can empower, but for the sorts of casual drop-in interactions that can help drive team cohesion and understanding.

Companies are also offering more social interactions on these days, whether that’s lunches together or drinks after work, to maximize the shorter amount of in-person time people have, giving them some time with their colleagues that can help power the rest of the week and give them something to look forward to the week after.

There are no “rules” for hybrid work. Many companies are writing those rules now, for however long hybrid work remains a phenomenon. But perhaps what business owners should most consider is not so much what they want or prefer, but what their team members want. 

If they are building a business to sell, they need to look forward to how things will be done in the future, not on “how things have always been done.” A seller wants to take over a business in which the issues of how the company works have already been settled — whether by experimentation or practice — not something he/she is going to have to figure out after you leave.

Are you thinking about your work environment and how to prepare it for a future sale? We’d love to talk to you about it. Give us a call today.