Island Hopping: Not Always a Good Thing
The phrase โisland hoppingโ conjures up positive images. You might think of cruising beautiful sandy beaches on a tour of tropical islands. Too bad cybercriminals have given the term a new, less pleasant spin.
Island hopping is an increasingly popular method of attacking businesses. In this approach, the cybercriminal targets a business indirectly. The bad actors first go after the targetโs smaller strategic partners. So, vendors or affiliates, who might not have the same level of cybersecurity, become stepping stones to hop.
Attackers might hack into smaller businesses handling the targetโs HR, payroll, accounting, healthcare, or marketing. Then, they take advantage of the pre-existing relationship to access the final destination.
Humans are trusting. Cybercriminals exploit that. With island hopping, attackers leverage the trust established between strategic partners.
Itโs quite simple: attackers gain access to Company A and send a counterfeit business communication to Company B. Company B, knowing the sender, is less likely to question a download link or opening an attachment.
After all, itโs not coming from a stranger; itโs a message from perfectly pleasant Jenny at Company A. You may have in the past already shared logins to various sites/portals, or passwords to unlock zip files.
The Rise of Island Hopping
This is not a brand-new form of attack. In fact, itโs named after a military strategy which the United States used in World War II to establish a stronghold in the Pacific Islands.
Perhaps the best-known island-hopping cyberattack was seen in the United States in 2013. Retail giant Target was the aptly named target of a point-of-sale system breach. Hackers stole payment information from 40 million customers. The first โislandโ in the planned attack was Fazio Mechanical Services. The heating and refrigeration firm suffered a malware attack shortly before Targetโs breach. Fazioโs hackers stole email credentials needed to access the retailerโs networks.
As enterprises continue to strengthen their cybersecurity, itโs predicted that island hopping will gain momentum. According to Accentureโs Technology Vision 2019 report, less than a third of businesses globally know how strategic partners secure their networks. A majority (56%) rely on trust that business partners would uphold security standards.
Preventing Island Hopping
You may be one of the islands to hop or the attackersโ final destination. It depends on your business size and industry. Either way, your business is vulnerable to malware attack, infected systems, or a data breach. Plus, if youโre the stepping stone, youโre likely to lose the target companyโs business, too.
How do you prevent island hopping? First, secure your own networks and systems:
- Follow best practices to detect and identify vulnerabilities and reduce risk.
- Educate your employees about the dangers of business communication scams.
- Raise awareness of phishing schemes and social engineering.
- Require two-factor user authentication.
- Change all default, generic, or predictable passwords.
- Keep security up to date (patching and system upgrades are mandatory).
- Control who can access your networks and servers.
- Protect all endpoints (including employee devices in a Bring Your Own Device workplace).
When it comes to cyber island hopping, your business doesnโt want to be a layover or the final destination. Keep your cybersecurity borders tight to avoid unwanted visitors.
Want to make your business inhospitable to island hoppers? Work with Safe Network Solutions. We can help assess cybersecurity, provide a plan to reduce risk, and upgrade technology. Let us support your efforts to fend off unwanted tourists.
Give us a call at (615) 522-0080.
Safe Network Solutions is a technology consulting firm located in Nashville, TN. We are focused on reducing our Clientsโ stress and the time they spend handling IT related issues. As technology has become more integrated with daily business tasks, downtime is not an option. Whether your systems reside on-premise, in the cloud, or in a hybrid setup, you need a partner with expertise in a wide array of technologies, with a security focus.
