[BreachExchange] How to protect your company from digital attackers

[Audrey McNeil]

https://www.bizjournals.com/houston/news/2019/05/16/how-to-protect-your-company-from-digital-attackers.html

Technology benefits for business have substantially increased over the past
few years. Expanding internet access, cloud services and new features
enable greater productivity. Unfortunately, not all technological
development is driven by good intentions. Information security problems
have grown. The need to protect your organization continues to increase at
a pace greater than the development of technological benefits. Today’s top
two organizational technology tools —  email and web — are also the top
weapons.

One in every 131 emails sent in 2016 was malicious, according to a recent
SANS Cyber Attack article. Email continues to thrive as a threat actor’s
digital shotgun with a variety of ammunition, including a spray of spam
comprising 53 percent of email. Websites rank a close second in the threat
actor’s arsenal with 76 percent of scanned websites containing
vulnerabilities turning them into cyber guns that shoot virus and trojan
bullets.

The internet today is analogous to walking alone through the streets of a
big city. If you are not prepared, you may find yourself missing money,
identity information or the ability to function. Computer systems today
require information security tools, software and services to maintain a
healthy operational state and to protect the information they transmit,
store and process.

Many national and international standards exist that describe well over 100
important risk reducing information security controls. This top five list
is a practical, minimum subset of these standards:

User education

A user trained on today’s cyber risks and how to best avoid risky
situations is one of the least expensive and most productive ways to
protect the organization. Online cybersecurity user training is one of the
most popular and economical solutions you can consider.

Safe browsing

Allowing your employees to visit sites that are for business needs only —
and sites with a good reputation — minimizes company risk tremendously. Web
filtering is a service that can be configured on most reputable commercial
firewall appliances. Web filters persistently categorize websites onto
white and black lists to aid in protecting your employees from getting to
websites with malicious content. There are new security features built into
web browsers that keep web browsing isolated from the operating system, so
malware and viruses cannot infect the system itself.

Email security

Email is probably your most important business communication tool, so it is
a highly targeted attack surface. For example, well-crafted phishing emails
designed to exploit human nature is a common tactic for attackers to commit
bank fraud or deploy advanced malware that requires payment to unlock
systems called ransomware. These techniques potentially lead to your
company shelling out money directly into the hands of criminals. Adopting a
modern email protection software suite can help protect you by using
“sandboxing” analysis to test files and links before your employees even
have a chance to make a costly mistake.

Advanced end-point protection

Most commonly referred to as “anti-virus,” it is critical that all devices
that access business systems are properly protected, including mobile
devices. Relying on the solution that comes with your operating system or
downloading free anti-virus is not providing the right protection. Your
company should adopt an endpoint protection standard that is a
business-grade and centrally managed.

Multifactor authentication (MFA)

Credential records are being compromised by the millions in major data
breaches. Last summer, MyHeritage reported 92 million records compromised,
MyFitnessPal reported 152 million and Exactus reported 340 million. This
means that bad actors are stealing usernames and passwords that can be sold
and potentially used against your company in a targeted attack. In most
cases, the same credentials are used to access personal and business
systems, bad actors may now have the keys into your systems through any one
of the recent major breaches.

Multifactor authentication is a solution that can be applied to any
software you use for your business to mitigate bad actors using stolen
credentials to access your systems. With MFA, entering a password is just
one security check point. MFA requires additional steps which may include a
text or email verification, or even biometric security. Many of your
current software applications have MFA built in and simply needs to be
turned on. There are also third-party MFA solutions.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20190517/2614cf19/attachment.html>