“The perimeter of your network is no longer where you think it is,” according to the HPE (Hewlett Packard Enterprise) Cyber Risk Report 2016. Mobile devices and broad interconnectivity, have changed the focus of cyber attacks away from servers and operating systems to applications. Mobile devices are the latest target and the easiest route to access enterprise data. However, cyber security is a constantly shifting landscape requiring a new look at your current network security protocols.
In Symantec’s recent 2016 Internet Security Threat Report (ISTR), they discovered “430 million new unique pieces of malware,” and that was just in 2015.
Today’s threats include targeted ransomware, DDOS, zero-day attacks, and polymorphic malware, and the entry points are many and include mobile device access points, Internet of Things (IoT) vulnerabilities, cloud exposure, and privileged account exploitation (internal attacks). Cybercrime is a part of our daily lives but regardless of the headline stories about security breaches and increasingly sophisticated attacks, the reports also reveal that many companies are not properly protected.
Who is at risk?
It is not just Fortune 500 companies being attacked. Attacks targeting businesses with less than 250 employees are on the rise, with 43 percent of all attacks in 2015 targeted at small businesses. More than 75 percent of all legitimate websites have unpatched vulnerabilities. Crypto-ransomware (encrypting files) grew 35 percent in 2015. Mobile devices in the workplace and the Internet of Things has introduced new avenues into your corporate network. And, things won’t be getting better. Gartner forecasts 20.8 billion connected devices by 2020 (Gartner, Inc., press release, November 10, 2015).
As the vulnerabilities increase, so do defense strategies. Software vendors are continuing to implement new security processes and applications but the quality of exploits continues to improve as well and there are still vulnerabilities found in legacy code which present a weak entrance into your network.
Common exploits used by hackers show that organizations lack fundamental cyber security measures. For example, browser and Adobe Flash exploits are present in 99% of attacks because of software that is not up to date.
Best Practices – Prevention and Mitigation
The biggest security risks are the ones you don’t know about. Many organizations cover the basics and assume it is enough. The use of firewalls, anti-virus protection, regular backups, and enforcing strong passwords is a start, but a more comprehensive strategy is required to stop a malicious attack or a rouge insider.
Such a strategy includes intrusion detection or protection systems (IPS), website vulnerability protection, web security gateway solutions, and mobile device monitoring throughout the network. Best practices include:
- Conducting an audit to test networks, applications, and mobile devices and thoroughly assess vulnerabilities,
- Develop a strategy that fits your organizations requirements,
- Assess the security of your cloud application services,
- Implement multi-layered security technology and protocols on all your devices and end points,
- Create and enforce security policies for mobile devices,
- Educate employees about security best practices, and
- Encrypt your data.
Best Practices – Recovery and Continuity
Industry reports all state that it is not a matter of if your company will be attacked, but when. Although good prevention methods can detect and mitigate an attack in its early stage, every company should be fully prepared for a sophisticated security attack.
If a major breach occurs, a disaster recovery and business continuity plan will shorten discovery and response time, minimize disruption of business operations, provide a level of security, and assure systems will continue functioning without downtime.
Keeping up with new security technologies and mitigation and recovery methods is challenging corporate IT departments. The vulnerabilities keep changing and therefore, the solutions. It takes time and experience to defend your company against security risks, create a cyber security policy, train employees, and implement it company-wide, but the results will bring peace of mind knowing your company is thoroughly prepared for the worst case scenario.
Need more information? I know the best people in the business. Contact me.