It is very likely that in the past week you have received at least one, if not multiple, phishing emails containing malicious attachments or requesting large-scale wire transfers. As cyberattacks evolve and hackers become more sophisticated, cybersecurity is now more important than ever.
Reaching the highest figures to date, the Identity Theft Resource Center reported 1,579 data breaches and 179 million records compromised nationwide in 2017. Hacking (which includes phishing, ransomware/malware, and skimming) continues to rank as the highest attack method, accounting for 59.4 percent of the breaches.
As cyberattacks become more frequent, they are also becoming more costly. Just a few years ago, the cost associated with cybercrimes was in the hundreds of millions. According to a recent study by Juniper Research, the cost of data breaches will reach 2.1 trillion dollars globally by 2019. So why, despite our increased awareness, do these numbers continue to grow?
The answer lies in the digitization of currencies, transactions, relationships, experiences, enterprise records, and assets. This trend is transforming all industries, including automotive, and is past the point of return. The fact of the matter is that your dealership is vulnerable to both ransomware attacks and hijacking. Potential threats include theft of property, customer service privacy infringement, dealership reputation damage, financial penalties, and lost customer trust.
Cash and customer information are popular targets; even small or medium-sized dealerships who outsource their IT functions are targets for cyber fraud or external hacking. Hackers are increasingly targeting dealerships accounting and F&I departments using spear phishing attacks. Through deceitful emails, designed to appear as if sent from within the organization, hackers attempt to trick employees into downloading an attachment. Because the emails originate from the employee’s email, security software and firewalls are not be able to stop the attack. On
Establish Formal Policies
Since the hackers break into a dealerships network, they have access to private customer information. Training your employees to identify phishing emails is more important than ever.
While you can never be 100 percent safe, there are steps you can take to strengthen your cybersecurity initiatives. We have put together the following step-by-step guide to help you assess your dealerships incident response capabilities and vulnerabilities.
Determine Your Security Risks
Identifying, categorizing, and prioritizing potential cybersecurity threats can help protect critical assets. Begin this process by making a list of your security risks to pinpoint your vulnerabilities. What controls, if any, are already in place and what steps do you need to take?
Risk management can also help develop proactive measures for protecting your assets. Dealerships can implement risk management by having an official process for reporting risk to the appropriate person.
Another method of determining vulnerabilities is making a list of who has access to your information. How many ways can the outside world access your network? Have you considered third-party vendors? Are responsibilities equally distributed? We highly recommend dividing access to systems and facilities so that no one employee has complete and total access.
How often do you change your passwords? Do you have a separate wi-fi for guests? How do employees access the network outside the office? Do you verbally verify wire transfer requests? We advise having multiple policies in place to address these questions. At a bare minimum, your dealership should establish password, encryption, retention, email, mobile device, and anti-virus policies.
Awareness and Training
Are your employees trained to identify suspicious patterns and inquiries? Do they know how to report their suspicions? Through training and awareness programs, dealerships can strengthen an employee’s understanding of cybersecurity. Providing education to internal stakeholders on security awareness, roles, and responsibilities is one way to accomplish this.
Incident Response Plan
Dealerships should also have a plan in place that clearly defines the protocol for responding to and recovering from a cybersecurity incident. Your plan should identify an incident response team that will be responsible for coordinating stabilization efforts. Performing incident simulations periodically can be beneficial in measuring your response team’s preparedness.
Collaborate with Third Parties
Engaging and collaborating with third parties such as peer organizations, suppliers, cybersecurity researchers, government agencies, and the Auto-ISAC can enhance cyber threat awareness within your dealership. The AICPA has a reporting framework you can use to share information about your cybersecurity initiatives with stakeholders.
Be Proactive
Conduct random tests to determine your dealership’s vulnerability. We recommend regularly reviewing and updating your policies and procedures to keep up with evolving strategies used by hackers. Another proactive measure to take is investing in a cyber insurance policy. Standard insurance policies do not typically cover security breaches.
Did You Know?
- When dealers provide financing services, customers supply personally identifiable financial information. Under the Payment Card Industry’s Data Security Standard (PCI DSS), the dealership is responsible for protecting cardholder data.
- According to the Graham Leach-Bliley Act (GLBA), dealerships are considered financial institutions when they collect and store consumer financial information in their databases. Therefore, dealers must follow the legislation’s requirements for securing client data.
- Under individual state breach notification laws, dealerships must notify government agencies and consumers when their data is compromised.
Councilor, Buchanan & Mitchell (CBM) is a professional services firm delivering tax, accounting and business advisory expertise throughout the Mid-Atlantic region from offices in Bethesda, MD and Washington, DC.
