Cyber-Awareness: First Step

The first step in cyber security defense is admitting you have a problem. Trust us we all do.

A data breach can have devastating and crippling effects to your operations and a breach affects every layer from top to bottom. The risks come from daily attacks involving non-technical criminals who push out malicious malware, from ransomware (which encrypts your data and blocks you from accessing it, shutting down your device and network until you pay a ransom by a date certain) to remote access trojans (which take control of your device and network, extracting data, uploading it) causing data to be disseminated publicly.

Impact of a Cyber Attack

The statistics are overwhelming and exacerbate daily. Not only are U.S. organizations targeted daily but the perception that most leaders have is misaligned. Cybersecurity is really not an IT-issue. Rather it’s an issue owned by everyone at the organization, since Cybersecurity goes to the very heart of the organization’s brand. So too, the culture must adapt to embrace Cybersecurity as part of the daily routines addressed by everyone. Ownership falls on leadership to drive this cultural shift.

DEFINING CYBER SECURITY

Nate Lord from the Digital Guardian recently gave an excellent definition of cybersecurity as, “the body of technologies, processes, and practices designed to protect networks, devices, programs, and data from attack, damage, or unauthorized access”. DigitalGuardian, April 26, 2019. It may also be referred to as information technology security.

Why CYBER SECURITY Matters

IT Security goes to the heart of your organization. Everything that makes you personally or professionally unique (your health, financials, family; organization's financials, intellectual property etc) has data tied to it. The reason securing your data is important is that your data, your personal data, and your professional data, is being targeted.

Why it is so relevant today, more than ever, is simple. Government, corporate, financial, and medical organizations collect more data on you than ever before. They store and often sell (to those with malicious intent) unprecedented amounts of data on you. It comes from your voluntary posts on social media, applications and subscriptions to commerce sites and storage onto computers, cloud, SAAS programs and other devices.

Here’s a short video outlining Why Your Data Matters https://youtu.be/D5iHyyJ-Qlk

As the volume of stored data and that transactied and sold globally expands and grows, the frequency and sophistication of cyber attacks simultaneously grow with it.

Those that are tasked with safeguarding information relating to national security, health, or financial records, need to take steps to protect their sensitive business and personnel information. As early as 2011 many law enforcement entities noted that digital crime and cybercrime eclipsed drug-tracking in terms of frequency and illicit activities.

Key CHALLENGES

While there is no silver bullet, many leading groups and organizations have codified their own versions of best practices you should take to ensure the safety of your organization. While nothing is guaranteed, it’s a matter of risk management. That is, the point is to take preventative measures to reduce the risk and lower the likelihood of an actual harmful breach.

Governance

Many of these best practices are formulated by vendors who, while the ideas contain virtually the same steps as others, are nevertheless somewhat biased in their order of preference. For effective cyber security, an organization needs to coordinate its efforts throughout its entire organization: from every single end-user touching the internet and the public to all the systems and transmittal devices.

We believe the most updated set of best practices can be found in the Center For Internet Security (CIS  controls can be found here: https://www.cisecurity.org/controls/) controls, since it is vendor-agnostic and is the most commonly updated set of practices.

The 20 controls are broken down and explained on their site. More articles posted separately will walk you through each step.

Best Practices

As a general rule, this end-to-end approach will evaluate and ensure that all of these sectors have security protocols and systems in place:

• Network and iNfrastructure
• Applications & Cloud  (SaaS etc)
• Endpoint & Data storage
• Identity management
• Mobile security
• Disaster recovery/business continuity planning
• End-user education

MANAGING CYBER Risk

We routinely recommend the CIS controls which include, among other things, the following:

• Cybersecurity Awareness Training for all users.
• Strong Governance (Password policies, acceptable use policies, data storage protocols etc)
• 24/7 Cybersecurity layers for your network/servers
• Next Generation Firewalls which are managed
• SEIM and 24/7 Vulnerability Management
• Compliance documented Network Assessments & Testing (PCI-DSS, HIPAA, SOX, FISMA etc)

These basic blocking-and-tackling techniques have been shown statistically to help protect in a powerful manner and are usually at low cost.

All Covered is a leading managed security service provider (MSSP) with 1500 US-based engineers services thousand of clients across the country.

For more information contact the writer at dmauro@allcovered,com