Knowledge & Insights

How to Protect Your Business from a Cyber Attack (Part 2)

Cyber attacks have become more prevalent than ever before, and cyber security specialists anticipate that the frequency will only become more rampant as time progresses. In “How to Protect Your Business from a Cyber Attack (Part 1)”, the Enlightened, Inc. cybersecurity team addressed how businesses can protect against cyber-attacks and mitigate the consequences of experiencing one. The team continued their assessment of the current cyber landscape as it correlates to businesses in the second part of the Q&A included below.

How do you foresee the field of cyber security evolving in the upcoming years?

1. The threat landscape will increase with innovation.

Everything connects back to the Internet of things (IoT). Any object such as a lightbulb, TV, or thermostat that is described as “smart” is classified as an IoT object. While this “smart” technology is new, exciting, and convenient, it also provides hackers with the opportunity to breach yet another object which by default increases the threat landscape. Smart technology is being designed and sold at such a fast rate that cybersecurity professionals are struggling to keep up and secure the technology being released. Therefore, it is only a matter of time before hackers start using IoT devices as an entry point into the wireless networks that they are connected to.

2. Critical Infrastructure could be the next target.

Critical infrastructure comprises of the technologies, networks, assets, and services essential to the health, safety, security, and economic well-being of a country. There are 16 sectors which include transportation, water, energy, nuclear, chemical, emergency communication, and more. With political climates across the world becoming more tumultuous, critical infrastructure may exist as a targeted because of the potential for political or financial gain. When Iran’s nuclear program fell victim to a computer virus known as Stuxnet in 2010, the program experienced severe damages that went beyond the standard hijacking and stealing of information. In fact, the equipment controlled by the computers that were breached experienced physical destruction. Iran’s encounter with Stuxnet is merely an example as to how critical infrastructure may become the new frontier in cyber-attacks.

3. Cyber Insurance could be the next big industry.

As more and more companies are falling victim to cyber-attacks, cyber insurance is becoming a viable option. Much like how we have insurance to cover automobile accidents, health scares, and asset protection in the event of some act of nature, companies need protection from all the cyber threats in existence. According to Nationwide Insurance, policies can be tailored to cover legal and notification fees, the restoration of the person identities of the affected customers, recovery of the compromised data, and repair of the damaged computer systems. Ultimately, a company should consider the purchase of cyber insurance so that they are not liable in the event of a cyber breach and as other organizations realize this, the cyber insurance industry will skyrocket.

4. Cybercrime will continue to expand.

According to Harvard Business Review, cybercrime is already a $445 billion-dollar industry.

What are some key characteristics of a secure network/organization?

1. Strong Upper-Level Management Support

Cyber security cannot only be deemed important by cyber and IT staff. Cyber security must matter to company executives and the upper-level management. They are ultimately the decision makers that will approve security purchases and the hiring of appropriate personnel. When the leadership of the company values cyber security, it is easier for the cyber and IT staff to access the resources necessary to maintain the company security posture.

2. Proper IT Budget

The more resources a company can devote to cybersecurity, the better the security posture will be as long as funds are spent wisely and properly.

3. Knowledgeable Staff

It’s important to hire IT and cyber staff that have expertise with the implementation of cyber security in networks and information systems. They should also be good at following company policies and procedures. It is a good practice for a company to invest in their staff by sending them to different trainings and conferences so that they can expand their knowledge of the newest and latest cyber techniques and attacks. This helps ensure that the company’s networks are in good hands.

4. Defense-in-Depth

Defense-in-depth is a cyber security strategy that incorporates technical, organizational, and operational controls to create a company culture of security practices. Consider the layers of defense-in-depth like those of an onion. Starting at the surface layer and moving inwards toward the center, the layers are as follows:

• Policies, procedures, and awareness

These are policies and procedures approved by management that allow cyber security to be a part of the culture. Establishing written policies and procedures that directly deal with cyber security enhances enforcement. Additionally, it is easier to assess how well the company is in line with the policy and make the corresponding adjustments.

• Physical

Physical security includes controlled access to buildings, security, and having offices and file cabinets that can be locked for the storage of sensitive documents and tools.

• Network

This layer encompasses the security of a company’s networks. This includes ensuring that all public-facing company website pages are secured with https and are not subject to attacks such as cross-scripting or SQL injection. This can also include monitoring activities such as using network tools to analyze the traffic to ensure that there are no unauthorized connections occurring.

• Computer

This layer deals with securing computers, mobile devices, servers, and other devices. Tools used for the protection of devices include antivirus and antimalware.

• Application

All applications that come from the internet are not safe to download and use.  Some applications masquerade as legitimate and familiar applications when in fact, they hide malware that can lead to a security breach. When it comes to applications, it is best to follow the practice of least privilege. This is when an employee only has access to the applications they need to do their job. If the use of a new application is desired, they must receive permission before they can download it to mitigate the potential risks.

• People

People are the core of the defense-in-depth strategy. With the proper training and cyber awareness of employees, all the different layers can work together to provide a comprehensive protection strategy that helps the company be cyber secure.

If you could give one piece of advice to a company executive, what would it be?

1. Prioritize cyber security.

Once cyber security is a top priority of your company, customers will feel more safe conducting business with you. The commitment to protecting information through educated investment will become more than apparent, it will be sincere.