Cybercrime costs the global economy over $575 billion each year. The U.S. economy alone accounts for something north of $100 billion each year and accounts for half of the total loss due to cybercrime of all the G-8 countries. This figure will no doubt continue to rise. No longer do companies need to worry as much about thieves breaking into offices and stealing computers, laptops, CDs and whatnot. Now, the security concerns center around cybercrime and the possibility that a data breach may strike. Following are some ways hackers can get into your network and what you can do to prevent it.
Invest in tools for defense and investigation
Yes, the integrity of the network is important and hackers will take any opportunity they can to peruse it. Invest in some tools to defend the perimeter and to watch what is going around the network. Being able to trace activity is not to be nosey, but to be able to do some investigation should something show up.
Tools for the roaming employees
Remember that users are not always sitting at a desk or station in the physical office. They work from home, coffee shops, airplanes, etc. It’s well known that hackers will sit in public places with sniffers and capture all traffic that crosses a network. Include tools in the arsenal that allow them to do that safely such as trusted VPNs. Having a connection that is secure will help prevent information getting into the wrong hands when users connect their laptops wherever they can to get work done.
Strong password policies never go out of fashion
Weak passwords are easy to crack and this is a craft that hackers continue to use over and over. Create a strong password policy. Include guidelines on what this means, so there is no ambiguity to the users. Force users to change them on a regular basis and make sure they are not using the same one repeatedly or for multiple accounts. Password reuse has been blamed for breaches of accounts at Apple, Nieman Marcus, and Uber. A strong password should be a minimum of eight characters, include upper and lower case letters, a number or more, and a special character or more.
Humans are still the weakest link
Those who use social engineering scams continue to evolve their methods and are getting better and better about making their messages seem legitimate. Recently, a whaling (phishing targeted at high level executives) scam was identified, called TA530 that used the names, titles, and company names of the executives to try to obtain sensitive information such as online banking credentials.
Teach employees how to identify social engineering of all types; particularly phishing. Then test their knowledge periodically. This will give you the opportunity to retrain or change your methods as needed.
Invest time in research
Espionage is a real threat and it should be a concern. Spend time not only investigating the tools you implement, but spend time making sure you are hiring people that are trustworthy and have integrity. However, it’s important to balance the needs for a secure environment without creating a feeling of mistrust.
Why bother writing them if you aren’t going to enforce them
It does no good to spend time writing policies and guidelines if you are not going to enforce them. Clearly define the ramifications of not abiding by the rules should they be broken and follow through with the related penalties.
People cannot be modified like machines and software. They have minds of their own and behaviors are not easily changed. Set up clear processes and procedures on how employees, contractors, and anyone who logs into your network can interact with it. Include a mobile policy and bring your own device (BYOD) policy.
Make a plan and follow it
Not only should you create cybersecurity policies, but you should have an action plan should you find your organization the center of a data breach or other cybersecurity event. Clearly state who is responsible for each task such as speaking to the media, employees, and customers. Keep all contact details current and don’t forget to include how to reach your plan actors after working hours. Review the plan at least annually and update it then or whenever the players change.
Keep your eye on the future
Vulnerabilities are found regularly. Security efforts are always trying to be a step or three ahead of the bad guys and the bad guys are always trying to outsmart good guys. New scams and tricks pop up all the time. Keep on top of the news and keep your systems up to date with the latest patches and updates.
It’s not only about money
Money is not all that can be lost in the case of an intrusion. It can also mean a hit to reputation and trust, repeat business, and may result in legal issues. For instance, class-action lawsuits were filed against Sony Pictures, 21st Century Oncology, and Anthem as a result of data breaches of their systems. Therefore, it’s well worth some time and effort to make sure your company is as prepared as it can be to avoid a data breach and respond to one if needed.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
