6 Tips to Strengthen your Defences Against Cyberattacks in 2018
CYBERATTACKS ARE ON THE RISE!
Experts and analysts agree: 50% of businesses will likely be the victims of cyberattacks in 2018.
The headlines will continue to be captured by high-profile data breaches affecting enterprise organizations. Nevertheless, it is the small and medium-sized businesses that will suffer most. Firstly, up to 70% of cyberattacks target SMBs and, lacking enterprise-size resources, and pockets deep enough to mitigate losses incurred from comprised data, a single attack could be enough to force many smaller organizations to close their doors for good.
It is well-nigh impossible to budget for the types of expenses incurred by a successful cyberattack. From legal expenses and ransomware payouts to literal theft from company accounts, and more, the costs can be, and often are, catastrophic. This is the reason that 60 percent of hacked SMBs go out of business within six months of the attack.
The threats are real, but so too are the solutions. While hiring a cybersecurity firm to manage your data is one invaluable step, there are some do-it-yourself tips and tricks that you can apply to company protocol and policies that will buttress your company’s defences in this age of cybercrime.
The team at INTECH has compiled top tips in this blog post “6 Tips to Strengthen Your Defences against Cyberattacks in 2018.” Don't forget to subscribe!
1. Train your employees
First and foremost, every organization, regardless of size, should establish basic security policies and train employees to both protect sensitive business information, and avoid dangerous practices that subject your company to cyberattacks.
If you are able to implement only one of the suggestions in this document, then make it the training of your employees. Make sure your people understand how to use the Internet safely, which means:
They understand the risks of opening email attachments from unknown or suspicious sources
A link clicked is not the same as a link typed! Typing URLs into the search bar instead of clicking links is significantly safer
The importance and etiquette of unique and complex passwords for each account (and why your company is now adopting and enforcing a complex passwords policy)
Also, make sure the importance of cybersecurity is an ongoing discussion, and ensure everyone has easy and quick access to the policies governing it, including an acceptable use policy. Reward positive behaviours; outline and enforce consequences for breaches of your cybersecurity policies.
With all successful company-wide strategies, senior leadership should be the first to model and champion a new cybersecurity paradigm. If leadership demonstrates and follows the best-practices, then the rest of the company will follow—embrace security as part of your company culture.
2. Know your soft spots
Properly protecting your company from cyberattacks begins with a well-rounded, comprehensive understanding of the internal and external vulnerabilities your business faces. You’ll want to know the ways in which a hacker can gain entry to your system by identifying weak points. Known vulnerabilities can be addressed and mitigated. The best way to do this is by getting informed about the various cyber fraud schemes and threats -- phishing, malware and system hacking -- that businesses face, and by conducting regular IT Infrastructure Vulnerability Tests.
3. Secure your networks
Safeguard your Internet connection by using firewalls to secure and control traffic, and by encrypting information. Protect the integrity of your WAN by using well designed, properly configured network segregation.
Recognize the necessity to distinguish between Wi-Fi needs:
If Wi-Fi is provided as a courtesy to employees for personal devices keep this separate from your corporate LAN, and consider using MAC address filtering to allow only known devices on the network.
If your people use Wi-Fi connected devices to conduct company business, recognize this as a corporate network—no unsecured or unmanaged personal device should ever touch it. Use the most secure authentication protocols available to you, and consider MAC address filtering as a secondary layer of defence.
Keep your Wi-Fi networks secure and hidden. There is no need to broadcast the network name, known as the Service Set Identifier (SSID) unless you are providing a separate and segregated Wi-Fi network for guest access.
Password protect access to the routers and access points and limit admin access to this infrastructure.
Many companies allow their employees to use personal devices and phones to conduct business. This is great for business to increase productivity and efficiency while lowering costs, but it leaves businesses vulnerable to cyberattacks as these devices can be hacked and used to compromise your corporate network. A Bring Your Own Device (BYOD) policy will help to educate employees on the use of mobile technology, provide guidelines to mitigate the risk of attacks due to dangerous behaviours and establish systems to secure and control the corporate record and data stored on these devices.
4. Backup & Disaster Recovery
There are only two types of individuals and organizations: those that have lost data, and those that will.
Data, be it corporate record, intellectual property, personal or customer information, etc., is the lifeblood of your company. The loss of that data can have catastrophic effects on the life of an organization. A properly implemented and regularly tested Backup and Disaster Recovery plan is imperative. Too many organizations pay too little mind to this fact. In addition to knowing, without doubt, that your data is backed up and that these backups are accessible and viable, it is of paramount importance to understand exactly how long it takes to restore the data you need and the granularity capabilities of the restoration process. If the answers to these seldom asked questions do not meet the requirements of business continuity, then your BDR solution is, in fact, another catastrophe waiting in the wings. A properly configured, well implemented, tested-and-proven-viable BDR solutions is your best and the most comprehensive path to recovery from data loss, regardless of the cause of that data loss. If your IT team responds, “Yes, sir we’ve got backups!” then put it to the test—on a regular basis. Once these tests are passed, the follow-up question should be, “and what if that backup target goes down? What are the Return-to-operation targets offered by our redundant data store?” If you are unsatisfied with the second set of answers, then you are not done creating a viable Backup and Disaster Recovery Solution!
5. Updates and Patches
Vulnerabilities will continue to be discovered. Patches and updates serve to mitigate these flaws by plugging the holes otherwise exploited by the bad guys and their malicious code. Hardware exploits are patched, usually through a combination of firmware updates and software patches. Software and operating system vulnerabilities are addressed via regular updates. In some case critical, out-of-cycle updates are released to address immediate and active threats. It is vitally important to apply all firmware, software and OS updates and patches that do not conflict with your company’s core business activities, as soon as they are made available. The same applies to any BYOD devices used within your corporate IT infrastructure, and the software installed on them.
6. Detection, Prevention and Mitigation
Cyberattacks will occur—this is a fact of life in this digital age. Once your organization has identified the weak points in your defences, it is imperative to implement systems and services to secure them. In addition to the points listed above, active and updated antivirus and anti-malware software is another vital piece of this security puzzle. No AV solution is perfect, but it is foolhardy to go without. An updated antivirus/anti-malware solution will detect, prevent and mitigate most know threats. Some solutions even offer a modicum of protection versus zero-day threats. Lastly, it is wise to monitor your organization’s network traffic, inbound and outgoing. Network traffic anomalies are relatively easy to spot and often point to other issues that need immediate attention.
All 6 of these points are important to implement immediately. Please do not hesitate to contact us at INTECH Computer Solutions Inc. should you have any questions, or require any assistance shoring up your company's defences.
Please comment below, join our mailing list and feel free to share this little gem of wit and wisdom.
Comments