In the past few years, the cyber landscape has been anything but quiet. Dealerships have seen exponential growth in attacks on their systems, and it doesn’t appear to be slowing down anytime soon.
All the noise around cyberattacks and dealerships’ risk has inevitably led to misinformation and myths about cybersecurity in the industry. Even dealerships with crucial security tools in place may still have vulnerabilities if they’re relying on outdated assumptions.
Let’s explore five common cybersecurity myths and the steps your dealership can take to combat them.
Myth #1: Cybercriminals only target large dealer groups.
It may seem like cybercriminals focus solely on large dealer groups, but dealerships of every size can be targeted. The bad guys are after money, so they target anyone they can trick into giving them access to the dealership’s system. Size really doesn’t matter; if they think they have a shot at gaining system access and stealing data, they’ll take it.
The key takeaway is: Every dealership needs a proactive security strategy, regardless of size.
Myth #2: If I have MFA, my information is secure.
Multi-Factor Authentication (MFA) is an important security measure for your dealership, but it’s only one layer of protection. In fact,
reporting shows that when compromised credentials were used to access a system, experts found MFA was deployed 97 percent of the time as a security measure.
Because MFA has been adopted more broadly,
cybercriminals have evolved to exploit it. Some attackers have begun tricking users into logging in to a fake login page, where they collect information such as usernames, passwords, and MFA credentials. Then they enter that information on the real login page, where they can gain system access and start collecting valuable data.
MFA may strengthen security, but it can’t protect against every attack on its own. Phishing-resistant authentication and continuous monitoring are your best bet to combat convincing phishing pages and other ongoing threats.
Myth #3: It’s easy to tell when an email is a phishing attempt.
Unfortunately, this is no longer true. Gone are the days of phishing emails riddled with grammar mistakes and obvious markers — cybercriminals can now create polished, personalized emails that are hard to distinguish from legitimate messages.
With the help of AI, the bad guys can even mimic the writing style of trusted co-workers, clone voices, or manipulate video to make phishing emails much more convincing. These tactics make it harder to rely on traditional warning signs. So don’t rely on spelling mistakes or unfamiliar senders to identify phishing attempts. Email filtering, employee awareness training, and careful evaluation of unexpected requests are the best methods for reducing risk.
Myth #4: We’d immediately know if our dealership was compromised.
This myth may seem true, but the reality is, cybercriminals are counting on you not noticing your dealership is compromised. Attackers often breach systems using stolen credentials, then remain undetected as they gather as much information as possible. Their goal is simple: steal sensitive information and use it for extortion.
Security tools are vital, but they can only do so much. 24/7 monitoring by cybersecurity experts can help identify suspicious activity across endpoints, cloud services, and user accounts.
Myth #5: We’re compliant, so we’re secure.
Threats don’t care if you’re compliant. Meeting regulatory requirements doesn’t automatically protect you against current threats. The cyber landscape is constantly changing, and attackers continually adapt their tactics. New threats may emerge before regulators can put requirements in place.
Compliance is only a baseline. The most secure dealerships are the ones with a comprehensive approach that includes access controls, employee training, vendor risk management, and 24/7 monitoring.
Separating fact from fiction is only half of the battle when it comes to lowering your cyber risk. By reevaluating your cybersecurity assumptions and practices, you can identify potential gaps and start building a more proactive cybersecurity strategy.
