Cyber Attacks: 9 Takeaways to Keep Your Dealership Safe

3. Online and off, your dealership may be inadvertently exposing sensitive data to those who know where to look.

Jeff told our audience that it’s important to secure not only electronic forms of sensitive information, but hard copies as well. First, however, he said it’s important to “understand what information you really have”:

“You have customer data, which includes names, addresses, emails. That typically includes a driver’s license, Social Security number, credit card—all associated with a customer. You also have personnel data, so W-2 information, employee Social Security numbers. And then, we have the business’s or the dealership’s financial data: banking information, ACH information. All of this does need to be protected, and I don’t believe that everyone fully appreciates how we’re protecting it.

“I was in a dealership the other day. An employee was doing an application for a credit card. And they were filling out the form and they handed back the copy that belongs to the customer and the customer said, ‘Oh, I don’t need this. You can just get rid of it for me.’ Well, what this guy did was take form and put it in an unsecured trash bin. And so, anyone who wants to do any type of dumpster diving may be able to get that information.”

4. Hackers are frequently after more than a quick buck.

“Attackers are not always after just money,” said Mary. “Sometimes, they’re after information. We’ve heard stories or HR folks being hit. The owner of the dealership purportedly sends a message to the HR folks saying, ‘Hey, we need all of our W-2s to be sent to an audit at our accounting firm.’ Well, they’ve been hacked, and so off you go with the entire staff’s W-2 forms. 

5. Attacks have grown more sophisticated—and targeted.

“Think about how much information you have about your principals, your executives, and even your teammates online,” said Mary. “Think about LinkedIn. These bad actors will infiltrate LinkedIn profiles, match it up to a Google search on a name, and then go to the dealership’s website, look at pictures, email addresses, contact information—all of those sources together. 
I challenge everyone to do a Google search on yourself to find out how much really pops up, because that’s exactly what folks are doing to make spear phishing that much more believable, that much more real.”

She shared a story about an attacker disguising themselves as a member of a local athletic booster organization in which a principal executive was involved:

“They were reaching out on behalf of XYZ organization. They’ve done their homework. And that’s where we are all vulnerable. It’s easy to dismiss some of these things, but know that it’s just like check fraud, where they’re still going to go to the path of least resistance. It’s not always in the highest IT levels that they’re going to hit us; it’s in those very rudimentary areas where we are oversharing as a society.”

6. Don’t assume that your vendors have their vulnerabilities under control.

Jeff commented on the fact that many dealerships take advantage of software as a service and use dealer management and CRM systems in the cloud. These dealerships, he told us, “have a tendency to make the assumptions that “well, we’re using a vendor in the cloud and we really don’t have to worry about it—it’s their problem.’”

“I think you need to worry about it,” he said. “I think you need to understand if that cloud vendor is secure, and I think you also need to ask yourself some questions: If there is or if they do have a breach, who’s responsible? Is it you, the organization or the dealership that’s using their system, or is it the service provider themselves? Who’s going to be paying the fines? Who’s going to be paying for the identity theft protection, assuming that you have to pay for it? Who’s going to report it to state and federal authorities that require it? And I do believe those are questions that we should be asking those vendors who are supporting our key systems.”

7. Organizational culture plays a major role in data protection.

One key point in any good cybersecurity strategy is communication. Starting with your dealership’s tone from the top—down through mid-level and operation-level employees—every member of your organization needs to take cybersecurity seriously.

“Many dealerships have long-standing, very closely held cultures,” said Mary. “And if there’s not a culture in which you can ask questions, or where the entry-level folks at the front of the dealership don’t feel like they can raise their hand as you go up the executive chain, that’s where you really find you’ve got the most challenges. This is a shared responsibility. Every single individual you employ at the dealership is a possible target, and if they have any kind of online access whatsoever, they can be hacked and they can be tricked into clicking on a link.”

She added: “It really gets back to employees not knowing, not recognizing, and not being comfortable, necessarily, questioning when something doesn’t seem right.”

8. Small steps are (much) better than no steps at all.

Mary acknowledged that although many dealerships have limited resources, “to the extent that you have any discretionary ability to beef up those security strategies, I think your return on that investment would be incredible.”

“Think about any internet-connected device,” she said. “Be very vigilant about any of your financial dealings, and limit any machines that have financial implications in your organization to an intranet, or only allow certain sites to be accessed by those machine.”

9. The best approach is a multi-layered approach.

“One of the things I recommend to many of our clients is having multiple layers,” said Jeff. “If you have antivirus on desktop computers, maybe you have a different type of antivirus software on your servers and then, going one step further, maybe you having a different type of antivirus software on your firewall.

Mary agreed about the power of a multi-layered approach:

“It’s just a game that we’re all playing. With antivirus as an example, for every type of solution that’s out there, it seems like the bad actors stay one step ahead. So, varying that coverage is really important. It all gets back to having that formal strategy—something that you have to answer to—and formally documenting the strategy.”