How to Take Your Cyber Security from Good to Great

Cyber security can be an unsatisfying experience. While there are certainly good, better, and best cyber security methods, there is no solution or practice that will be able to prevent all cyber attacks.

At Arraya, we’ve found that our clients often look for reassurance or confirmation that they’re protected from the various cyber threats we hear about every day. Like many things in life, there will always be uncertainty.

The good news is enterprise security does have an impact and is working. In general, cyber criminals are after one thing: rapid monetization. As more businesses prioritize cyber security in their investments, it’s getting more challenging for these malicious actors to reach their objectives.

The threat landscape constantly evolves and the way we interact with technology changes, making cyber security a never-ending journey. However, know that your security efforts are making a significant impact in reducing risk for your organization.

Our advice? Stay the course! Here are some steps you can implement to take your cyber security posture from good to great.  

4 Steps to Improve Your Organization’s Cyber Security

Not all security methods and practices were created equal, and it can be difficult to keep up with the latest standards.

If you haven’t implemented them already, here are four security practices that will help keep your business secure:

1. Implement a Zero Trust Foundation

Without a Zero Trust model, your business won’t have the necessary foundation and framework to implement fundamental security controls. A Zero Trust model always authenticates, uses least privileged access, and always assumes breach.

This model embraces the hybrid workplace and protects people, devices, apps, and data wherever they’re located by authenticating who is using the endpoint.

2. Separate Your Online Identities

Malicious actors can source an overwhelming amount of information on both businesses and individuals through your online presence. This information is then pieced together to guess your username/email and password combinations and access various online accounts.

Users can better secure these accounts in two ways:

• Use multiple email addresses

Most online accounts require an email address or username, password, and hopefully, a second layer of authentication. While most know to keep their passwords confidential, emails are readily available within your online presence. Using a separate email for your most confidential accounts, such as finances, will make it more difficult for malicious actors to access those accounts.

• Never reuse passwords

If an account is compromised, a password that has been reused could lead to multiple compromised accounts. While reusing a password on multiple accounts can be easier on your memory, this can lead to significantly more damage. Each login should have it’s own, unique password.

3. Adopt Biometric Authentication

At this point, we’re assuming you’ve already implemented multi-factor authentication. If not, it’s time that you do.

As a step beyond MFA, biometric authentication is a form of authentication that uses a person’s unique biological characteristics to verify their identity. This could be facial recognition, a fingerprint scan, and more.

A relatively new and more advanced form of biometric authentication is composable identity. This type of authentication learns the way the user interacts with their device. This could be how the device is held or the normal pattern in which the user interacts with an application. If the interaction is out of the ordinary, access can be denied. However, composable identity also requires an enormous amount of data to provide these capabilities.

4. Encourage Training & Awareness

The ever-evolving nature of cyber threats make them uniquely difficult to protect against. As human error continues to be an enormous vulnerability, keeping your employees up to date should be an ongoing priority. The risk of human error is like building the strongest door possible, only to have an employee accidently open it for the wrong person.

As cyber attacks continue to make headlines, awareness of cyber threats has drastically improved in recent years. However, there will always be new ways in which these threats are carried out. Consistent training will help employees stay vigilant, know when to be suspicious, and what steps to take should they identify an attack.

While even the most robust cyber security practices can’t guarantee complete protection from cyber attacks, they can significantly reduce your risk. Just like wearing a seatbelt won’t always save a life, you’re going to take the extra precaution.

Threats Your Business Should Know

One of the main differences between good security and great security is understanding the threat landscape and how it’s shifting. Recognizing the motivations and techniques of your adversaries is key. To recap, a cyber criminal’s goal is almost always rapid monetization, and they generally don’t want to waste time on things they can’t monetize quickly.

The more your executives and your employees know, the better you can anticipate and plan ahead.

Here are some of the latest threats and techniques your business should know:

1. Insider Threats

This type of threat can be particularly concerning, especially as the workforce endures the “great resignation.” Insider threats can come in two forms:

• The disgruntled employee who may “go rogue” and want to disrupt their employer. The recent sale of Twitter to Elon Musk has led to reports of Twitter locking down its source code to prevent upset employees from sabotaging the platform.

• Cybercriminals who recruit employees to provide them with network access through their VPN and RDP credentials in exchange for money. These aren’t always disgruntled employees but individuals looking to make extra cash.

2. SIM Swapping

While it’s known that MFA is highly effective as an additional layer of security, SIM swapping is a tactic that malicious actors use to bypass this. This technique literally takes over your phone, allowing the cyber criminal to control it for a period of time. They do this by stealing your phone number and assigning it to a new SIM card, which is then inserted into a different phone. Many mobile carriers are working to implement controls to stop this.

If your phone ever stops responding or working, this could be a sign that a SIM swap attack is underway.

3. Endpoint Targeting

Because MFA is making cyber criminal activity much more difficult and most employees are still logging in remotely, endpoints have become the most popular target for attacks. However, focusing on authentication, use of a VPN, and a VDI solution can increase endpoint visibility and security.

Next Steps: Stay Vigilant in Your Security Efforts

While the constant bad news surrounding cyber security can be draining, the good news is that security efforts do make a difference. With the right practices in place, your business can maintain a stable environment and unlock the future growth of your organization.

For more information, check out the on-demand access to Arraya’s Director of Cyber Security, Scott Brion’s, recent presentation: All Your Eggs in One Basket. This presentation outlines how the success of enterprise security programs have made the endpoint a preferred target for attackers and user behavior has resulted in more sensitive and valuable information being at risk on these endpoints.

Contact one of our Arraya experts to start enhancing your organization’s cyber posture today.

Visit https://www.arrayasolutions.com//contact-us/ to connect with our team now.    

Comment on this and all of our posts on: LinkedIn, Twitter and Facebook.    

Follow us to stay up to date on our industry insights and unique IT learning opportunities.