In times of turmoil, there are always people who seek to exploit the chaos for their personal gain. That’s why cybersecurity is more important than ever, says Heather Stratford, owner and CEO of Spokane-based cybersecurity company Stronger International Inc. Stratford, who started Stronger International in 2015, says the company plays a vital role in fighting threats and attacks, as well as educating businesses on how they can protect themselves.

The Journal sat down with Stratford to discuss cybersecurity threats in the era of coronavirus, changes in the industry, and how business owners can bulk up their security measures.

Journal: How has the industry changed since you started?

Stratford: I’ve seen a big shift in the industry toward multifactor authentication. Ten years ago, nobody was using multifactor authentication except maybe the military and government. It hadn’t shifted into the private world yet. Financial institutions were really the first. It’s like having a door: everybody has a lock on their door, but some people have a deadbolt. The deadbolt is in case the lock fails. When you have dual-factor authentication, it’s creating a strength to that lock on that door.

I’ve seen a huge shift in phishing. Five or 10 years ago, you couldn’t find (anti-)phishing companies, people who come in and run phishing simulations and help train your employees. It’s a whole multimillion-dollar industry now.

How have you seen the COVID-19 pandemic affect the industry?

The pandemic has shifted the way we all do business, at least temporarily, but probably forever. We were asked to stay home, to limit to contact, and as such, many workers are working from home. Here’s the problem: your cybersecurity at home can’t be your default cybersecurity for work, because your home is generally not secure. Without thinking about that, people think they’ll take their laptop home and plug it in and just work, but that then becomes a direct vulnerability that hackers will use to get into a company.

You have to realize that cybersecurity is based on people attacking. They’re criminals. All they’re looking for is money, generally. Sometimes, they’re more actor nation-states and they have more of a political bent, but in general, most hackers are financially driven. They’ll shift to what’s happening at the time. That’s what makes cybersecurity so hard.

What is everybody searching for right now online? ‘COVID-19’ or ‘coronavirus.’ So that’s what (hackers) are spoofing—80% of the phishing attacks right now revolve around the pandemic. What happens is twofold: they can get a person’s computer at home, and it becomes a bot for them—the computer will start to get sluggish, because it’s being used on the back end. The other thing that will happen is they can see your passwords; they might be able to get into the main company. Then they sit and wait and watch to see who’s transferring money, who has senior-level passwords, who has access. They see where the crown jewels are within the organization. Then they attack. Or they just put up a ransomware attack and they shut down the system, and they say pay us $60,000 or we won’t give you the encryption code.

How has Stronger International been responding to the increase in cyber threats that have resulted from the pandemic? What are you telling clients to do?

We’re trying to get the word out there to companies that now is the time to lean in, and now is the time to take cybersecurity even more seriously than you might have. 

Don’t assume that your employees who are now working from home have secure connections. Setting up VPNs — which are (virtual) private networks — for them to come in on is critical. So is making sure that they are using a dedicated computer, so they’re not going home and working on the computer that their teenage kids also game on. 

If they can have an actual physical connection to the internet rather than a Wi-Fi connection, that’s safer. Consider what their different settings are for their router. Most routers have an option to set up a guest network on the router. If you’re working from home, you should be on that network so you’re not intermixing with everyone else in the house. There are all kinds of small things that you can do as a company to help educate and make sure your employees are safe.

Who is most at risk of a cyberattack at the moment? Who should be most alert right now?

I would say three places: medical facilities and hospitals, which is awful, but the truth. Local government, because they’ve seen increased activity and they’re also sending employees home. And the third is small businesses. They’re all about the same. No one is more important than the others. 

But small businesses right now have less protection. They’ve sent their workers home. They’re scrambling. They’re distracted. They’re prime targets for cyber-attacks. When small businesses get attacked, the statistics say that within six months, 50% of them haven’t recovered and have folded. It’s really life and death. And many small businesses aren’t taking it seriously.

What should small businesses be doing to try to protect themselves?

They can partner with firms like Stronger that have the knowledge to come in and help them enhance what they know. 

Our goal is to strengthen their current employees. If we can train them, that’s the best. But they might not have the right people. They might not have the capabilities, so they can bring somebody in to help consult and work with them to get their business in a place where it is secure.

There are lots of resources online, but they can be general. They’ll say, set up a VPN. Ok ... but how is that VPN connecting into your system, and is it configured correctly? A lot of that is much more technical, so ask somebody who knows, so it’s done right. One thing that all employers could do and should do, and that doesn’t require a huge amount of technical knowledge, is educate their workforce. Every single business can educate their employees and make it a priority to get them educated. It’s simple, but if you don’t do it, you’re risking the company.

What will the lasting effects of the pandemic be for the cybersecurity industry?

There will be more working from home than ever, and that will affect cybersecurity and how networks and businesses functionally operate. There will be a continued push toward cloud computing. We do trainings in Amazon Web Services, Microsoft Azure cloud services. These are the big players in the market. That’s where everybody’s headed. 

More people, more businesses, will shift to the cloud because of remote workers. From a cybersecurity perspective, that’s a big deal, because you’re now not just protecting a building, you’re protecting all the homes and all the places your people work. It increases the workload for cybersecurity. 

This interview has been edited for length and clarity.