Auto dealerships represent ideal “soft targets” for cybercriminals: as valuable and data-rich as banks or financial firms, but potentially less cyber-secure. The customer financial information they handle from credit and purchase financing makes them highly attractive, and recent trends in interconnection and reliance on external service providers significantly increase their attack surface.

To defend against increasingly sophisticated threats, auto dealerships must take a strong, proactive cybersecurity stance. Here are five ways to get started.

1. Conduct a cybersecurity risk assessment to increase awareness of risks. This assessment should identify cybersecurity risks (i.e., potential threats, vulnerabilities, and impacts, and their likelihood) and review the controls implemented to reduce those risks for any gaps.
2. Implement training programs, such as security awareness training for all employees and incident response training for executives and IT. All employees need to know how to identify and defend against phishing or social engineering attacks, and executives and IT staff need to know how to respond should a successful attack occur.
3. Separate IT operations from IT security. Organizations should make sure they understand exactly which needs are being addressed by their IT department or outsourced IT provider. As most IT teams are focused on operations – making sure that systems stay up and services remain available – additional resources may be needed to proactively stay on top of cyber threats and needs, even if portions of the environment are in the cloud.
4. Pay attention to third-party risks. Given their increased interconnection and reliance on external service providers, auto dealers need to establish a thorough third-party risk management program, conduct vendor due diligence, and address any potential threats introduced by their providers and collaborators.
5. Maintain a cybersecurity insurance policy. Sooner or later, a cyber attack will be successful. Proactive measures help reduce the cost and impact of such an attack, and a cyber insurance policy can further reduce financial uncertainty and make accidental loss manageable.