Harry Potter’s teacher, Alastor “Mad-Eye” Moody, had a continual refrain of “constant vigilance,” and his advice is particularly apt for cybersecurity. However, with the endless news announcements about what seems like daily massive server breaches, thinking about your own organization’s security can be overwhelming. How much security is really necessary to protect yourself? Read on for tips on how to best protect your organization and avoid becoming a headline.
1. Prioritize enterprise security.
It may seem like an obvious point, but it’s one that still needs making. When faced with a bombardment of security risks and a barrage of potential solutions, it’s easy to succumb to decision paralysis and do nothing. Additionally, it’s hard to spend so much time making these decisions and implementing these solutions when a breach remains a ‘what-if’ scenario.
However, it’s imperative to keep the statistics in mind. According to the Identity Theft Resource Center, October 2018 alone saw 88 breaches, with over 11 million records exposed. The risk is higher than ever. Additionally, the price of a data breach must also be considered. The fallout can cost thousands to millions of dollars, not to mention the damage to productivity and reputation. Taking preventative steps to bolster your security portfolio before an attack will ultimately save an organization time and money.
2. Perform regular scans.
Antivirus solutions are often the starting point of an organization’s security portfolio. Although important, simply having antivirus installed is not enough. According to the Verizon Data Breach Report, 68 percent of breaches took several months or longer to discover, giving malicious agents plenty of time to propagate and access sensitive information.
Administrators must run regular scans on the entire system – not just workstations. Servers – be they on premise or in the cloud, also need routine scanning. This is typically not only a best practice, but a regulatory mandate.
3. Practice least privilege.
Employees can cause just as much harm as an outside attack. Negligence can lead to accidental misconfiguration, or malicious intent can lead to data theft. Least privilege prevents both intentional and accidental insider attacks.
The principle of least privilege maintains that unless otherwise specified, a role will be assigned the least amount of access possible to a system. As a role is more defined, the necessary access becomes clearer and is assigned accordingly. For instance, a web administrator would only need access to web servers and a select number of privileged commands. Identity and access management solutions can help enforce least privilege by defining who is granted elevated privileges, as well as when and how they can use them.
4. Maintain consistent policies.
An organization’s infrastructure can grow incredibly quickly, and with the introduction of cloud and hybrid environments, it’s only getting faster. Unfortunately, this can just as speedily lead to misconfiguration, which is a major catalyst to security issues. Even with a mixture of environments, consistency is key. Ensuring proper configuration across all your systems is critical to ensure your environment’s safety. Doing this manually is a daunting task that leaves your organization open to the risk of breaches.
Security auditing software can help by centralizing and automating security administration across all environments. It documents your security policy and can implement or make changes to your configurations across multiple servers at the same time.
5. Increase organizational awareness.
With the right protection in place, hopefully a single click on a suspicious email will no longer lead to disaster. However, there are other ways employees can inadvertently add unnecessary risk to an organization. For example, many employees are guilty of installing an application on their workstation or using a web service that has not been approved or distributed by the IT Team. It seems harmless, but this practice, known as Shadow IT, can be dangerous.
If an employee was using a web service or application for transferring files to a coworker, for instance, this means that organizational data is now flowing through channels that have not been vetted by the experts within the organization. There’s no guarantee that the data is safe to transfer. Additionally, these unapproved apps can open back doors for attackers seeking to access the entire network.
Making sure all employees are aware of the role they play in day to day cybersecurity, and how they can help, will further ensure that enterprise security is a priority.
Ultimately, the best thing an organization can do when approaching cybersecurity is to stay watchful and informed. While the headlines can be overwhelming, learning about the latest risks and solutions can help you see patterns emerging. This will help you figure out which solutions are critical, and which ones can be put into next year’s budget. Additionally, experts are always available to consult. Fortra specialists are always just a phone call, email, or live chat away.
Want to make sure you're following best practices?
Find out how Fortra cybersecurity solutions can give your business an edge.
