The Basics of Cybersecurity: Part 2

Based on what you learned about cybersecurity basics and understanding data breaches in Part 1 of this series, is the world coming to an end? Not at all. There are steps you can take for protection. Some steps will vary, depending on which system you are taking strides to protect: personal or corporate.

Security Audits

Conducting security audits on corporate networks are critical. Security is an ongoing process that should be managed and invested in on a continual basis. Your security audit should have a layered approach, creating a maze of obstacles that a hacker must navigate to successfully gain access to your network. The first step in a security audit is understanding where you are in terms of security and how you can put a strategy in place to correct issues and harden your network. As you harden your system from external threats, you also have to harden your system from internal threats. Don’t forget the biggest threat to your company’s data: your employees.

Employee Training

Part of having a solid security initiative involves doing employee training and educating them about their roles in managing and maintaining a solid security methodology. Corporations need to have strong policies and procedures in place to help protect the overall business. However, employees will do what employees do, which can potentially put the business at risk. Should this situation arise, how you react and how you manage a security violation from a human resources perspective can make all the difference. Without solid training and policies in place, your business could suffer. Employee training should include instructions on how to identify and react to a potential risk, along with education about password policies, the importance of changing passwords on a regular basis and applying complex passwords. Employees play a critical role in security, and their understanding of why processes are in place and steps the company must take to protect itself are critical to the overall security initiative.

Corporations have a much higher burden and a lot more to think about to employ a security methodology that will effectively protect the business. It is interesting to watch companies go through the evolution of developing a security protocol. On one hand, employees might blame an IT department if the company gets a virus, intrusion or some kind of data loss. But it is often the employees who are not practicing industry standard security protocols. On the other hand, management sometimes won’t enforce the policies or develop with other practices to circumvent the security protocols that are designed to protect them, such as the use of outside email addresses for business purposes or online file-sharing systems. Employees and corporate executives have to understand that once you open that door to cyberrisk, it can be a very slippery slope, and repairing the system is much more complicated and costly than properly protecting it in the first place.

A Solid Plan

A solid security plan always starts with having a good backup—an electronic off-site backup is now considered the industry standard. Other key components are complex passwords, rotated or changed  on a regular basis. With the high rate of adoption of mobile devices, using encryption software and locking these devices has increasingly become a necessity in the business world. Have a layered approach to protect your system and your data, with hardware-based web filters, SPAM and Malware filters, and having a good corporate antivirus running on all devices, such as laptops, desktops, mobile devices and servers. Make sure to have good, corporate-level firewalls with intrusion detection and web filtering protection, along with a good corporate-level router. It is just as important to have strong management of your network, too, which includes eliminating old users from your domain and email systems, limiting attachments and executable files through your email systems, eliminating network shares, limiting employee’s access to network resources and having proper data retention and archiving practices. Limit or eliminate the practice of B.Y.O.D (bring your own device) plans. There are legal questions to the amount of security a company can push onto a device they don’t own, along with some questions around the ownership of intellectual property once it is downloaded to a personal device.             

What the Future Holds

What do the future of security and the next generation of viruses, spyware and malware mean to corporations? Typically, viruses utilized by hackers will fall into two categories: polymorphic and metamorphic.

Polymorphic viruses have a consistent virus body, which makes them easier to detect and decrypt. This also makes the design of countermeasures possible. Metamorphic viruses do not decrypt with a consistent virus body; it will change its shape, but, typically, it will not change its behavior. These behaviors make them very difficult to detect until the virus has already been activated, which leaves you dealing with the behavior aspect of the virus. Over the last few years, viruses have been more metamorphic, and have reached a point where they are learning on their own. This allows them to change based on the countermeasures that you might have running on your network.

Because of this intelligence, viruses now probe for weaknesses and then change either their body or their behavior in order to execute and infect your network, which can provide hacking opportunities. Factors to consider now include what they are looking for and what the next evolution of viruses may look like in the near future. Pay attention to “always on” connectivity, such as smartphones, tablets and other mobile devices. You have to keep in mind that these are actually computers that will connect to networks, which may and may not be protected. Due to the overall lack of security, these mobile devices have become prime targets.

Keep in mind the sources to which you are connecting. Don’t use public Wi-Fi, implement a two-factor authentication processes and utilize https protocols as often as you can. Along with mobile devices come the apps we love so much. They track everything from heart rate to weight loss to passwords. Are you encrypting that data, or just running the app?

There are currently over 600,000 apps and that market continues to grow daily. Apps have become a favorite target for hackers because they know that sooner or later you will connect to a network for data, email or something else. All they need is that connection using your username and password. Combine all these factors with the overall lack of security in corporations around the world, and you can see the future for computer hacking is very opportunistic.

There has been a rise in hacking and identity theft, and the black market for stolen corporate data is in the billion-dollar range. The real underlying problem is not the security countermeasures that often fail us, but the humans who use the technology but don’t want the inconvenience of security. There is no such thing as 100-percent secure, because the human factor will always influence security, as will the lack of leadership to implement and stick with approved policies, procedures. Start building a plan to enforce strong security cultures within your organization today.

This article is the second in a two-part series on hacking and cybersecurity. Click here to read Part 1, which discusses cybersecurity basics and tips for understanding data breaches.