With Cyber Security Awareness Month almost upon us, I thought it might be helpful for executives to see an actionable list of topics to ask their techies about. Reasonable answers will build your confidence that your organization’s risk of a cyber security breach is being sensibly addressed.
The average data breach cost to Canadian firms studied hit $7 million, says IBM. As the cost of data breaches and negative reputation impacts has risen, many executives have added cyber security to their agenda. Data breaches remind us that:
- Excellent hardware and software defences are not enough.
- Operational vigilance is essential but difficult to sustain over time.
The message from prior data breaches, such as the U.S. Federal Office of Personnel Management and Target, teaches us breaches cannot be prevented entirely. Still, various actions working in consort can substantially reduce the risk.
Given the overwhelming number of cyber security articles, websites, webinars, vendor software products and vendor services, it’s difficult for executives to sift through even a tiny portion of that mountain of material. Therefore, I’ve created this summary that executives can use to collaborate with their cyber security staff. The correct answers minimize the risk of a cyber security breach.
1. Manage operating systems
 |
| Related Stories |
| Locking down your precious data
|
| Backdoor access to encryption threatens the privacy of us all
|
| Protect yourself from financial phishing |
Sadly, many organizations are not even doing the minimum to protect themselves. For example, the basic, primitive WannaCry malware created global ransomware havoc. WannaCry attacks older versions of Microsoft Windows, such as Windows XP, for which support was discontinued in 2014. WannaCry again illustrated that two basic defences significantly reduce risk:
- Don’t keep workstations and servers running with older, unsupported versions of operating systems even when it’s tempting because they’re stable and reliable devices.
- Make a reasonable effort to keep current versions of operating systems up to date by applying the available patches.
Act to replace your older machines before they fail. Upgrade the operating system on your newer machines. For additional detail on how to reduce risk by operating a comprehensive patching program, review the Patch Management article of the SANS Institute.
2. Build staff awareness
Many breaches start with a successful phishing attack that dupes one of your employees or contractors into clicking on a link that downloads malware.
Raising awareness of employees and contractors significantly reduces the risk of a cyber security breach. This article outlines a good action plan: Wake up your employees: How to reduce cyber security risks with employee training.
For additional detail on how to reduce the risk of a phishing attack, review the Anti-Phishing Working Group (APWG) resources.
3. Confirm firewall effectiveness
Firewalls are the first line of cyber security defence. No organization operates without one in the 21st century.
The biggest problem is that firewalls are sometimes viewed as impregnable. This dangerous view leads to cyber security complacency.
On the web, multiple websites offer online firewall testing. For more elaborate testing of your firewall, read this article.
4. Maintain anti-virus software
No organization operates without anti-virus software.
The biggest problem is that anti-virus software is sometimes viewed as perfect for intercepting viruses. Unfortunately, this exaggerated view leads to cyber security smugness.
Read this article for additional detail on how to test the adequacy of your anti-virus software.
5. Protect your network
Most cyber-attacks arrive through your network.
Protect your Wi-Fi or wireless networks by ensuring the WPA2 encryption is turned on. Many organizations find it helpful to offer a guest Wi-Fi network to keep visitors from plugging into your wired network. Periodically scan your premises for unauthorized Wi-Fi access points because they are easy for hackers to install on your network.
To reduce risks for your wired Ethernet networks, keep your network map up to date, and consider adding VPN, VLANs and MAC address filtering.
For additional detail on strengthening your networks’ security, read this article.
6. Confirm data backup processes
No organization operates without a data backup process.
Unfortunately, many organizations fail to test their data recovery process to ensure that the data backup process is working as expected. This failure to test can lead to a nasty surprise when the data recovery process can’t successfully recover data in the emergency of a ransomware attack or a natural disaster.
Read this article for additional details on testing your backup and recovery processes.
7. Review system access
The negative impact of a cyber security breach often multiplies because too many active accounts with excessive system access privileges exist for hackers to hijack.
Poorly developed software packages require end-users to have many system access privileges to perform their roles. Sometimes the database administrators are lazy and simplify their work by giving themselves god-like access.
Strengthen your system access controls by regularly reviewing and pruning the privileges assigned to all end-users. Delete accounts for employees that are no longer at your organization.
Read this article for additional detail on how to best review your system access risks.
8. Review physical access
A surprising number of security breaches occur due to lapses in physical security.
Sometimes doors are left open or are propped open. Too often, long-departed employees are still on the active security card list. Sometimes short-term contractors forget to return their security cards that fall into intruders’ hands.
Strengthen your physical access controls by regularly reviewing and updating the active security card list. Review which doors and loading ramps depend on staff intervention and don’t require a security card.
Read this article for additional detail on how to best review your physical access risks.
9. Strengthen passwords
Attackers increase their destructive impact by taking over end-user accounts with weak passwords. The top 10 passwords are this ridiculously easy-to-hack list: 123456, Password, 12345, 12345678, qwerty, 123456789, 1234, baseball, dragon, and football.
Implement strong passwords consisting of letters, numbers and special characters. Expire these passwords at least yearly.
Read this article for additional detail on how to implement strong passwords.
Many websites help reduce the risk of a cyber security breach. This one, Secure Computing at MIT, is comprehensive and exceptionally well written because it avoids techno-speak.
Yogi Schulz has over 40 years of information technology experience in various industries. Yogi works extensively in the petroleum industry. He manages projects that arise from changes in business requirements, the need to leverage technology opportunities, and mergers. His specialties include IT strategy, web strategy and project management.
For interview requests, click here.
The opinions expressed by our columnists and contributors are theirs alone and do not inherently or expressly reflect the views of our publication.
© Troy Media
Troy Media is an editorial content provider to media outlets and its own hosted community news outlets across Canada.
