Be proactive, not reactive: 5 steps to a cyber security prevention plan
James Healey, Managing Director at Air IT, explains the five main steps that a company should take in preventing a cyber attack.
Cyber security news, such as the Marriott hack in November, is dominating headlines, and becoming a serious headache for business leaders.
This article offers CTOs, businesses and tech leaders the advice and actionable information they need to implement a solid cyber prevention plan. And, make sure that their business is not tomorrow’s headline.
A new report has found that nearly two-thirds of respondents lack confidence in their organisations’ ability to prevent serious damage from a cyber attack.
As technology grows more sophisticated, so to do hackers as they constantly work on new threats and software. Only this month, hotel giant Marriott was found to have suffered one of the world’s biggest hacks ever reported following a string of security breaches, leading to the theft of data from its 500-million customer database.
Hackers are using valid credentials and connections to make it substantially more difficult for businesses to detect them. But at a time when we are increasingly relying on connected devices which store and utilise vast pools of valuable information, organisations must take the time to develop a sound security strategy to prevent their data from falling into the wrong hands.
Over 70% of all data breaches in SMEs are due to internal vulnerabilities, such as failure to follow policies and procedures and lack of expertise — 36% of these breaches are caused by misuse of data by employees. There has to be more done, and there must be a prevention plan in place, not a hasty reactive motion when an attack hits which may get rid of the current problem, but not prevent other, more advanced attacks. Prevention is better than cure — you take steps to prevent viruses and infections from your body, so why not your network?
1. Assess your current cyber hygiene
The UK Government backs an innovative scheme called Cyber Essentialswhich is designed to help all companies improve their cyber hygiene. It’s an essential requirement for any business bidding on government contracts, but it’s beneficial for any company, as it’s believed to reduce the risk of an attack by up to 80%. It results in a certification which demonstrates a commitment to protecting business and stakeholder data from threats – crucial for building customer trust. The scheme covers all essential controls such as firewalls, malware prevention and up-to-date software.
Businesses can self-assess, or go through a Cyber Essentials or Cyber Essentials Plus certifying body, which can manage the whole process from initial audit to actions needed, right through to completing your assessment and issuing your certificate. This gives the business a practical framework to measure itself against, and reassures customers that it takes security seriously as well as proving your commitment to good cyber security practices.
2. Good housekeeping
There’s no replacement for the basics. Updates and patching should be performed regularly — WannaCry, the ransomware that caused chaos across the world, exploited unpatched Windows systems to spread malware. Businesses should steer away from legacy systems like Windows XP, as these no longer receive updates and are especially vulnerable to attack.
Get in the habit of conducting regular routine maintenance and audits, and seek a service provider if necessary, which can use specialist software to block ransomware strains.
Other admin that businesses can do is limiting user privileges for employees, by making sure they only have access to the servers and drives that they need to complete work. For example, most staff do not need access to any HR files. Along with being a possible breach of GDPR standards, the more people that have access to personal information, the less chance you have of preventing the spread of an attack if you’re compromised.
3. Raise awareness, stay vigilant
Awareness should always underpin your prevention plan. SMEs are often targeted as the way in for financial attacks through phishing or impersonation with the aim to extract financial data or currency. This is often due to it being easier to take advantage of human behaviour to target specific individuals who may not have had the right training. Whether it’s lack of awareness or just lazy decisions, they need to be properly trained on the risks and repercussions, along with potential hacking tricks as the majority of malware still requires a human action to initiate it.
Build on their education, raise their awareness of cybercrime, and make sure that they stay vigilant. Signs like grammatical errors and email addresses that don’t match the sender are common signs of a malicious email, for example. Also, implement a mandatory strong password rule, and ensure that all employees have access to the incident response policy. No defence strategy is watertight, but with the right prevention methods in place, you can reduce the risk of the human factor.
4. Layered prevention approach
Proactive technology must be in place to help you to identify and mitigate threats. Managed security packages and dark web monitoring solutions can proactively monitor for threats and compromised user credentials so you can stop an attack before it happens or minimise the damage. By using human and artificial threat intelligence, monitoring services can find your vulnerabilities and any compromised or exposed credentials.
There are also business-grade security solutions that can help protect the network and users from would be attacks such as anti-virus, anti-spam and business grade firewalls. Businesses should always invest in a layered defence strategy, as the more comprehensive the set up is, the less chance an attack will succeed as it has to pass through the various layers.
Avoid free products and solutions which claim that they can keep malware off your PC. Windows Defender, for instance, doesn’t stop adware or Potentially Unwanted Programs (PUP) and doesn’t possess the accuracy and effectiveness that more sophisticated prevention tools do.
Paid-for prevention tools are a small price to pay for the reassurance of digital safety. The cost of a hack to a business would be much more than the cost of the prevention technology.
5. Better safe than sorry
While it’s important to be proactive, businesses need a recovery plan in place in the event of a disaster or any downtime. A staggering 60% of businesses that encounter an attack go out of business in their first year, because of attacks to their network and users. While the big dogs like the NHS, Sony and Equifax dominate the headlines when they suffer attacks, it’s the SMEs that are secretly suffering the worst due to factors such as the human element and not prioritising investments, as mentioned above.
Under GDPR legislation, you must have a plan in place to be able to restore data, whether it’s a cyber attack, file corruption or simple data loss, otherwise you risk non-compliance. IT continuity is the bread and butter of so many businesses, and you must make sure that you have a backup and business continuity plan to prepare, should the worst happen. Seek Disaster Recovery as a Service (DRaaS) to protect critical business data and get operational again after a disaster.
While there is not a simple, singular solution to combat hack attacks and deter criminals, a layered prevention plan is crucial. Follow these steps, and data misuse and abuse can be minimised, while still enabling your business to take advantage of the growing opportunities the internet can harness.
Industry: Cyber Security News
- IDAM, Identity and Access Management consultant
The IDAM Consultant is responsible for leading implementation and support of high quality Identity and Access Management services while adhering to standards and best practices. The ideal Candidate would have experience primarily in IAM to serve as a member of a key client engagement teams that assist clients in employing proper information systems, resources, and controls to maximize efficiencies and minimize risk. Ability to take up challenges, adapt to the business needs, and staying focused on delivering results are essential to the success of this role. Key Accountabilities: • Serve as key member of the Identity Management Implementation teams delivering projects at client locations based from Home/London. • Participate in customer work shop to gathering understanding of the customer’s business requirements as it pertains to a solution to manage information security in their organization. Liaise with organizational teams such as Audit, Enterprise Architecture, Help Desk and Application owners • Develop and present a roadmap for security and identity and access management policies • Participate in detailed design and architecture workshops that will address requirements related to people, processes and technology • Perform hands-on implementation, troubleshooting, and setup of the technical infrastructure. • Provide training and knowledge transfer to internal employees and customers on various identity management products and technologies Qualifications Must Have Requisites: Must have previous years of experience and solid knowledge of: • Any Identity Manager: • Any Single Sign On Solution: • Directory servers: Sun DS, ODIEE • Application/Web Server: Websphere, Jboss, Weblogic, Tomcat • Languages: Java, .Net, Xpress • Web Technologies : HTML, XML • Operating Systems: Windows 2003/2008/2012, Unix, Solaris • Tools: VMware Workstation, LDAP Browser, SQL Developer
- Contract Cyber Security Project Manager
Aiding in the transformation of Cyber related projects and programmes ideally with Cloud Azure experience. Experience managing multiple project workstreams including Privileged access management (PAM) projects preferred. Prince2 experience. Outside IR35 Clients based in London
- Cloud Security Application architect, Contract
CSenior Cloud Security Application Architect / Security Consultant with a Cloud Application development background is needed for a 3-6 month initial contract (which is likely to extend) to help a Global business define, design, realign , document and migrate Cloud based applications / solutions in a secure way. Experience must include; Cloud Enterprise application architecture, an application development knowledge (tools, automation / deployment solutions), a background from a development would be ideal (this is not hands on development) but it would always help, This position will help drive the review and development of their cloud security offerings. Broader knowledge security policies and compliance is highly desirable. Client based in London
- Identity & Access Management Architect Contractor
Identity & Access Management Architect Contractor London • Extensive PAM / IAM experience required, • MUST have CyberArk and or Beyondtrust. Privileged access management • Technical review, recommendation, design and hands on technical skills key. • Cloud Azure architect experience ideal. • 6 month contract • Outside IR35