Be proactive, not reactive: 5 steps to a cyber security prevention plan
James Healey, Managing Director at Air IT, explains the five main steps that a company should take in preventing a cyber attack.
Cyber security news, such as the Marriott hack in November, is dominating headlines, and becoming a serious headache for business leaders.
This article offers CTOs, businesses and tech leaders the advice and actionable information they need to implement a solid cyber prevention plan. And, make sure that their business is not tomorrow’s headline.
A new report has found that nearly two-thirds of respondents lack confidence in their organisations’ ability to prevent serious damage from a cyber attack.
As technology grows more sophisticated, so to do hackers as they constantly work on new threats and software. Only this month, hotel giant Marriott was found to have suffered one of the world’s biggest hacks ever reported following a string of security breaches, leading to the theft of data from its 500-million customer database.
Hackers are using valid credentials and connections to make it substantially more difficult for businesses to detect them. But at a time when we are increasingly relying on connected devices which store and utilise vast pools of valuable information, organisations must take the time to develop a sound security strategy to prevent their data from falling into the wrong hands.
Over 70% of all data breaches in SMEs are due to internal vulnerabilities, such as failure to follow policies and procedures and lack of expertise — 36% of these breaches are caused by misuse of data by employees. There has to be more done, and there must be a prevention plan in place, not a hasty reactive motion when an attack hits which may get rid of the current problem, but not prevent other, more advanced attacks. Prevention is better than cure — you take steps to prevent viruses and infections from your body, so why not your network?
1. Assess your current cyber hygiene
The UK Government backs an innovative scheme called Cyber Essentialswhich is designed to help all companies improve their cyber hygiene. It’s an essential requirement for any business bidding on government contracts, but it’s beneficial for any company, as it’s believed to reduce the risk of an attack by up to 80%. It results in a certification which demonstrates a commitment to protecting business and stakeholder data from threats – crucial for building customer trust. The scheme covers all essential controls such as firewalls, malware prevention and up-to-date software.
Businesses can self-assess, or go through a Cyber Essentials or Cyber Essentials Plus certifying body, which can manage the whole process from initial audit to actions needed, right through to completing your assessment and issuing your certificate. This gives the business a practical framework to measure itself against, and reassures customers that it takes security seriously as well as proving your commitment to good cyber security practices.
2. Good housekeeping
There’s no replacement for the basics. Updates and patching should be performed regularly — WannaCry, the ransomware that caused chaos across the world, exploited unpatched Windows systems to spread malware. Businesses should steer away from legacy systems like Windows XP, as these no longer receive updates and are especially vulnerable to attack.
Get in the habit of conducting regular routine maintenance and audits, and seek a service provider if necessary, which can use specialist software to block ransomware strains.
Other admin that businesses can do is limiting user privileges for employees, by making sure they only have access to the servers and drives that they need to complete work. For example, most staff do not need access to any HR files. Along with being a possible breach of GDPR standards, the more people that have access to personal information, the less chance you have of preventing the spread of an attack if you’re compromised.
3. Raise awareness, stay vigilant
Awareness should always underpin your prevention plan. SMEs are often targeted as the way in for financial attacks through phishing or impersonation with the aim to extract financial data or currency. This is often due to it being easier to take advantage of human behaviour to target specific individuals who may not have had the right training. Whether it’s lack of awareness or just lazy decisions, they need to be properly trained on the risks and repercussions, along with potential hacking tricks as the majority of malware still requires a human action to initiate it.
Build on their education, raise their awareness of cybercrime, and make sure that they stay vigilant. Signs like grammatical errors and email addresses that don’t match the sender are common signs of a malicious email, for example. Also, implement a mandatory strong password rule, and ensure that all employees have access to the incident response policy. No defence strategy is watertight, but with the right prevention methods in place, you can reduce the risk of the human factor.
4. Layered prevention approach
Proactive technology must be in place to help you to identify and mitigate threats. Managed security packages and dark web monitoring solutions can proactively monitor for threats and compromised user credentials so you can stop an attack before it happens or minimise the damage. By using human and artificial threat intelligence, monitoring services can find your vulnerabilities and any compromised or exposed credentials.
There are also business-grade security solutions that can help protect the network and users from would be attacks such as anti-virus, anti-spam and business grade firewalls. Businesses should always invest in a layered defence strategy, as the more comprehensive the set up is, the less chance an attack will succeed as it has to pass through the various layers.
Avoid free products and solutions which claim that they can keep malware off your PC. Windows Defender, for instance, doesn’t stop adware or Potentially Unwanted Programs (PUP) and doesn’t possess the accuracy and effectiveness that more sophisticated prevention tools do.
Paid-for prevention tools are a small price to pay for the reassurance of digital safety. The cost of a hack to a business would be much more than the cost of the prevention technology.
5. Better safe than sorry
While it’s important to be proactive, businesses need a recovery plan in place in the event of a disaster or any downtime. A staggering 60% of businesses that encounter an attack go out of business in their first year, because of attacks to their network and users. While the big dogs like the NHS, Sony and Equifax dominate the headlines when they suffer attacks, it’s the SMEs that are secretly suffering the worst due to factors such as the human element and not prioritising investments, as mentioned above.
Under GDPR legislation, you must have a plan in place to be able to restore data, whether it’s a cyber attack, file corruption or simple data loss, otherwise you risk non-compliance. IT continuity is the bread and butter of so many businesses, and you must make sure that you have a backup and business continuity plan to prepare, should the worst happen. Seek Disaster Recovery as a Service (DRaaS) to protect critical business data and get operational again after a disaster.
While there is not a simple, singular solution to combat hack attacks and deter criminals, a layered prevention plan is crucial. Follow these steps, and data misuse and abuse can be minimised, while still enabling your business to take advantage of the growing opportunities the internet can harness.
Industry: Cyber Security News
- Head of CSOC (Cyber Security Operations Centre), London. Greenfield opportunity
CH7928 Identifier Project Head of CSOC (Cyber Security Operations Centre), London. Greenfield UNIQUE opportunity to establish, manage and grow a world class CSOC. Headquartered in the UK, the CSOC will grow and deliver cyber services into an international and underdeveloped market. As a greenfield site the Head of CSOC will be the first person on the ground to build a capability and team around them. The role will include, but not be limited to; Setting up and establishing a CSOC monitoring service using IBM QRadar and Palo Alto CORTEX XSOAR. Develop roadmap for future CSOC capabilities. Establish, develop processes, playbooks and use cases. Recruit, Build and train a specialist team. Build relationships with key clients- onboard and scale. The successful candidate must have experience working within / leading a technical Cyber Security monitoring capability. Technical experience working with IBM QRadar and Palo Alto CORTEX XSOAR will be highly beneficial, although other SIEM / Security Orchestration, Automation and Response tools are welcome as the skillset is transferable. This brings significant opportunity and welcomes creativity / best practice. Frequent travel to London office will be required. Chris.email@example.com 07884666351
- Aruba Data Centre Network Engineer
- Upto £500 a day
**Outside of IR35 contract** Aruba Data Centre Network engineer is required to start ASAP. You will be responsible for Data Center and Campus Network - Design and implementation of Aruba CX Switches, We are looking for an experienced data centre engineer who is happy to work remotely and autonomously Experience you will need to have, Solid Networking experience with good knowledge of -Routing & Switching - MP-BGP EVPN VXLAN, MPLS/VPLS, EIGRP, BGP, OSPF and Multicast, Experience with Aruba switches ideally the CX range Ideally SC cleared or able to become SC Cleared. This will be a 3 month rolling contract
- Network Engineer-
- 65000 plus bonus
An exciting opportunity has arisen with a global financal business that are looking for an experienced Network engineer with strong Firewall experience in particular Checkpoint You will be responsible for help to support and manage the network infrastructure both LAN/ WAN And VPNs and will have a focus on network secuirty (Checkpoint firewall and Security controls) This is a multi-Site environment with few thousand end users, As the business is growing so is the network so great opportunity to join an expanding business that will help cross-train you in both cloud and onsite solutions. They are looking for a strong network engineer with a mix of expereience o Experience with Azure networking managing VNETs, ExpressRoute, VPNs and other Azure network features such as NSG/MS loadbalancer is required. Working with Check Point firewalls in Azure is desirable. o In-Depth understanding of networking fundamentals including: Network topology, Data Centre Infrastructure systems, Layer 2/Layer 3 Switching, VLANs, Routing, VPNs, High availability protocols. o Demonstrable hands-on experience with Meraki Switches and wireless infrastructure, Arista software, Forcepoint Proxy (would be a strongly desirable), Citrix Netscaler, and Forescout CounterACT Location can be flexible, they are looking for someone who would be happy to do a hybrid working model 3 days at home 2 days in the office.
- Technical Cyber Trainer, United Kingdom
Technical Cyber Trainer, United Kingdom Cyber trainer needed to build a new cyber training capability to develop a team of international security analysts. Technical Cyber training experience is a MUST. Any experience delivering technical Blue team based training is highly desired. This is a UK based role. Able to travel to London on occasion- when required. Agile, flexible working. A technical background is highly desirable and prefered. The role Aid in the setup, fine tuning and on-going customisation of Technical Cyber Security’s training platform. CyberBit experience desirable. Design, develop and deliver the internal syllabus to train employees with low cybersecurity knowledge to become analysts. Manage, monitor, support and assess learners. Fine tuning training and bespoke development. Manage, monitor and assess SOC analysts. Support employees through their career. The ability to deliver remote training is essential. This is a UK based role. Able to travel to London on occasion- when required. Agile working. Apply today to find out more information. Chris.Holt@dclsearch.com +447884666351