The NCAA Men’s Basketball tournament is underway, and with it the annual prediction brackets. Guessing the brackets right usually means a nice chunk of change. The outcome of over 60 games is wagered on through shared files or online services.
Unfortunately, brackets create opportunities for a wide array of phishing and hacking campaigns, particularly in workplaces where a lot of brackets are distributed.
Phishing emails are the most common vector for attacks on corporate networks, especially in ransomware and business email compromise (BEC) campaigns; anything that involves large groups of employees to continuously send updated file attachments or links to a reply-all list or an individual, creates cybersecurity issues. March Madness brackets are a reliable delivery method for hackers to deliver malware.
The potential for hacks and scams is limited to the imagination of the person or group performing them. A single malware-infected file attachment can compromise several devices or an entire network. Sensitive information including passwords and financial information can be exfiltrated and ransomware can be deployed to block access to critical data. A cloned website to an external service can capture login credentials, which can be used in credential stuffing attacks and more.
What Businesses and Organizations Can (and Should) Do to Mitigate the Threat:
- Provide passwords to employees that are strong and difficult to guess, and to protect them via multi-factor authentication. A single compromised account is usually the point of entry for hacking campaigns. Change passwords regularly.
- Create a culture of cybersecurity and data hygiene. Educating employees and colleagues about the risks of phishing emails, cloned websites, and other common vectors for cyberattacks, especially during annual events like March Madness or the Superbowl can help prevent a data incident.
- Use online or cloud-based office software for non-sensitive documents. It’s just as easy to access a brackets spreadsheet or document through Google Docs or Microsoft Office as it is to send an email attachment, and it poses less of a cyber risk. Discouraging the use of file attachments when they’re not strictly necessary helps prevent downloaded malware.
- Invest in security-based products. Anti-malware security software can identify and block malicious links and file attachments. Data that is backed up regularly renders ransomware less of a threat. Investing in these and other services can be instrumental in preventing hacking campaigns or mitigating the damage when they occur.
- Keep employee email accounts up to date. Abandoned or inactive email accounts within an organization provide an easy way into workplace emails for hackers, because unusual activity will go unnoticed. Delete or archive employee emails when they leave the company.
