With more and more businesses incorporating technology into their model, cyber security is a primary focus. Cyber criminals are searching for opportunities to exploit businesses for sensitive data, and it’s up to the organization to protect themselves.
Despite this focus on cyber security, many organizations don’t even realize they have a breach for over 200 days. This time frame has a lot of potential issues, including giving cyber criminals a chance to hide out and wait for an opportunity or increasing the damage the breach may cause.
Most organizations know that cyber security is important, but they may be lost on how to go about it or how to detect a breach when it happens. Here are 7 steps to combat cyber crime in your business.
Education and Awareness
Employees are a top target in your organization’s security, but with training, they can be a strong asset. Your entire company culture should be built around a cyber culture and awareness that puts employees in a position to seek help when they notice suspicious activity. Employees also need to be taught to protect themselves and engage in safe behavior online. This does not mean they must become cybersecurity professionals but be aware of the common techniques that attackers will use to try and abuse their trust and steal their credentials.
This may include:
- Flagging suspicious emails from unknown senders with links or attachments
- Identifying suspicious applications
- Avoiding links or ads from untrusted sources
- Being careful on insecure Wi-Fi networks
Empowering employees helps them not only avoid and detect breaches but teaches them how to be vigilant with their own personal data outside of work and even extend security awareness to their family and friends.
There needs to be a top-down strategy, however. Leadership must be accountable for implementation and maintenance of cyber security measures, which is then included in employee training.
Use Strong Passwords and Protect Privileged Accounts
Passwords are often a source of weakness in organizations. Employees may use old or weak passwords that are easy to exploit, and apps and programs don’t alert them if their passwords aren’t as strong as they could be.
Employees with multiple accounts and associated passwords have a higher risk of a breach from reusing passwords for different sites. An enterprise password and account vault can be used to manage credentials across your organization, limiting this risk.
The same goes for privileged accounts. Employees with privileged access are a top target on your network. Just one of those privileged accounts being compromised by a cyber criminal gives them the opportunity to move about the network.
Remember to remove administrator rights if they’re not needed, and implement two-factor authentication throughout your organization not only on access to your network but also within your network. It is best practice to go beyond two-factor authentication and use multifactor authentication everywhere.
Implement and Enforce App Security
Apps may seem innocuous, but they can be a big weakness for cyber security. Apps can expose your organization’s sensitive customer and business data to cyber criminals.
Apps have security measures in place to help developers design more secure products, but at the end of the day, the responsibility to protect data falls on the user – your employees.
The risks with apps may include:
- Data leaks that could be accessed by malicious applications
- Transmitting data without encryption
- Poor authentication and authorization checks that can be exploited
- Using weak data encryption methods
Despite these risks, you can take steps to enhance your app security:
- Avoid storing sensitive information in an app
- Only allow the minimal permissions to allow the app to operate effectively
- Use certificate pinning to limit intermediary attacks on unsecured networks
- Implement guidelines and policies for cyber security pertaining to mobile apps
- Never save passwords or other credentials on apps
- Enforce consistent session logouts after use
- Always use multi-factor authentication to add an extra layer of security against weak passwords
Don’t Allow Installation of Unapproved or Untrusted Applications
Privileged access gives users the power to install and execute applications. If they’re not careful about where these applications were sourced, they can allow a cyber criminal into your network with ransomware or malware. A malicious hacker can install tools to access the network to maintain persistent access.
Users don’t have to do this intentionally or carelessly. Simple tasks like clicking on a link, reading an email from an unfamiliar source, or opening a document can give a cybercriminal an “in” to install tools and return at a later time. Then, the criminal has access to attack.
Keep Systems Patched and Updated
Regular patches for systems and applications prevents cyber criminals from using the system’s vulnerabilities to access them. Patches also showcase any weaknesses that could make a cyber attack easier.
But those aren’t the only reasons to keep up with updates and patches. These important tasks can improve features, fix bugs or glitches, and help the app operate as it should. You can’t prevent all cyber crime with patches and updates, but they can make your organization stronger and more resilient.
Analyze Logs for Suspicious Activity
Security logs can hold a wealth of information about suspicious or unusual activity. Review security logs on a regular basis to find unusual behaviors or activities, such as users signing in or executing applications outside of regular business hours.
This is an important practice to identify breaches and limit cyber criminal activities, but it’s also helpful if a breach does happen. Using the security logs can offer forensic clues to determine the cause of the breach and help you draft a defense plan.
Be Deceptive
Criminals of all types use predictability and routine against their victims, and cyber criminals are no different. Just like staking out a home for theft and seeing when the residents come and go, cyber criminals rely on routine behaviors like scans and patches that happen at the same time every month.
It’s best to be unpredictable, random, and deceptive. Use an ad-hoc approach to scans, patches, updates, and assessments. Attackers won’t know when they’re safe to attack, and if they do breach, they can’t hide out and wait for an opportunity without detection.
Protect Your Organization from Cyber Criminals
Cyber threats are a reality for modern businesses. With more technology comes more risk, and cyber criminals know the opportunities they have. You should take a proactive approach with your organization to protect yourself from cyber threats and criminals.
