NewsBeat

6 NewsBeat June 2016 Daily Miracle 2.0: Beware the Hacktivists ournalists, be afraid. Be very afraid. You are targets for cyber criminals who want to steal your personal identities. In fact, you are the prime access points for these so- called hacktivists, who will use your compromised account information to infiltrate your network and attempt to control your media company's editorial voice. A recent PricewaterhouseCoopers (PwC) report on security and the media industry states that, "Employees pose the single greatest cybersecurity risk through malware, phishing, weak passwords and social engineering attacks." At the same time, an independent study by software research group Kaspersky Lab found that 42 percent of media companies were hacked in 2015. And, our own study of 110 global news media company executives found that 53 percent were attacked since the beginning of 2014. Everyone at a digital media company should be responsible for cybersecurity. Journalists are particularly at risk because much of your work is done outside the office, away from the watchful eyes of the IT shepherds who safeguard your internal network infrastructure. The same could be said for ad salespeople, dealer managers and others in your organization who conduct business in the community. With this in mind, here are three key steps that every news media employee can take to guard against cyber-attacks while at work, on the road, and at home. Get Serious About $7RONG P@55WORDS The PwC media industry report notes that, "Most cyberattacks against this industry involve previously targeted vulnerabilities or weak passwords." Recent breaches against news media companies in the United States, Canada, Brazil and the United Kingdom were all traced back to compromised email addresses and passwords of registered users. At the risk of over-generalizing, Carnegie Mellon University found that college graduates with degrees in computer science, engineering and technology use considerably stronger passwords than graduates with degrees in business, humanities, communications and arts. As a result, an experienced hacker could decipher 124 business passwords for every 68 computer science passwords. So, avoid passwords with your pet's name, your child's name, significant dates (birthday or anniversary), your birthplace, or even your favorite sports team. All these can be determined from information that's publicly available or gleaned from your blog postings and social media profiles. Of course, you should also avoid "12345", "123456", "password", and "qwerty", which rank among the top ten most common user passwords. Software companies like Google, Microsoft and Adobe recommend that strong passwords should be constructed from phrases that are easy for you to recall. Substitute numbers and symbols for letters or words in an easy-to-remember phrase. Examples might be "ILuv2PlayB@seb@ll" or "1Forrest1" or some derivative of your favorite song lyrics. Finally, Google offers this common sense advice on how to remember your password while also keeping it secure: "Don't leave notes with your passwords to various sites on your computer or desk. People can easily steal this information and use it to compromise your account. If you decide to save your passwords in a file on your computer, create a unique name for the file — not 'my password '— so people don't know what's inside." No Five-Second Rule for USB Drives In October 2015, researchers from IT industry association CompTIA conducted a "USB Drop" social experiment across several major US cities. A total of 200 unbranded USB drives were dropped in high-traffic public spaces such as airports, coffee shops and business districts. Each USB stick was preprogrammed with a trackable link, enabling the researchers to determine that a whopping 18 percent of people who picked up the USB drives plugged them into their devices and clicked on the link. In other words, according to Infosecurity Magazine, "Nearly one in five people who found a random USB stick in a public setting proceeded to use the drive in ways that posed cybersecurity risks to their personal devices and information and potentially, that of their employer." USB drives are ideal vehicles for malware and hacktivists. Because most anti-virus programs do not scan the actual firmware of a USB device, malware payloads cannot be easily detected. When you plug an infected USB drive J By PETER MARSH

• Cover