How state-of-the-art defences get even better
Proper security begins before detection, as the saying goes, prevention is better than cure, however, several enterprises concentrate there to begin with. Mature security units understand the criticality of protection and identification. Setting up good cyber hygiene and initiating proactive steps to safeguard themselves against the ever-evolving threat situation is a vital first stage in a holistic security program. How should enterprises develop a holistic security program and in what sequence?
The National Institute of Standards and Technologies (NIST) as produced the ideal guide for developing a holistic security program, referred to as the CyberSecurity Framework (CSF). The NIST CSF determines the five foundational domains with regards to a security program:
- Identify: Produce an enterprise-wide understanding on how to go about managing cybersecurity risk to systems, individuals, resources, information, and capacities.
- Protect: Produce and go about implementing relevant protection to make sure delivery to critical services occurs
- Detect: Produce and go about implementing relevant tasks to identify the happening of a cybersecurity event.
- Respond: Produce and go about implementing relevant tasks to initiate action with regards to a identified security event.
- Recover: Produce and go about implementing relevant tasks to maintain plans for resilience and to reinstate any capabilities or services that were impacted owing to a cybersecurity event.
Observe that Identify and Protect come prior to Detect and Respond, as this also happens to be the logical order for producing and implementing your security program. Through implementation your most robust defence initially, you can identify and respond in a better way.
To demonstrate this approach, Russell From, Enterprise Services Integration Lead, at Tanium joined Enterprise Security Weekly to speak through a holistic strategy to security leveraging the Tanium platform strategy. Typically viewed of as an operational or cybersecurity vendor, Tanium has developed an integrated platform that encompasses identify, safeguard, detect, and respond that distinguishes itself by being able to perform both discover issues and initiate action to find solutions to problems.
Ten cybersecurity advice/best practices
1.Keep your software updated
As we are observing from the information with regards to compromises and breaches, ransomware attacks were consistently featured as a dominating attack vector for both enterprises and customers. One of the most critical cyber security advice to mitigate ransomware is fixing outdated software, both operating system, and applications. This assists in removing hazardous vulnerabilities that hackers leverage to access your gadgets. Here are a few quick and dirty tips to get you down the right road:
- Switch on automated system updates for your device
- Ensure your desktop web browser leverages automated security updates
- Retain your web browser plug-ins such as Java, Flash, etc., and ensure to keep them updated
2.Leverage Anti-Virus Protection and Firewalls
Anti-virus (AV) security software has been the most relevant solution to combat malicious actors. Anti-virus software blocks malware and other malevolent viruses from getting into your device and putting your data under compromise. Leverage anti-virus software from vendors you trust and only execute on anti-virus utility on your device.
Leveraging a firewall is also critical when safeguarding your information against malicious actors. A firewall assists in screening out hackers, viruses and other malevolent activity that happens on the world wide web and decides what traffic is allowed to make entry into your machine. Mac OS X and Windows come with their own built-in proprietary firewalls, not surprisingly referred to as Mac Firewall and Windows Firewall respectively. Your router should also possess a firewall built-in to avert compromises on your networks.
3.Leverage robust passwords and leverage a password management tool
You’ve likely heard that robust passwords are vital to web security. The reality is passwords are critical in keeping malicious actors out of your information and devices! Going by the National Institute of Standard’s and Technology’s (NIST) 2017 new password policy framework, you ought to think of:
- Reducing the crazy, complicated mix of upper case letters, numbers and symbols. Rather, go for something that is a tad more user-friendly but with a minimum of eight characters and a maximum length of 64 characters.
- Don’t leverage the same password more than once across multiple accounts.
- The password should consist of at least one lowercase letter, one uppercase letter, one number, and four symbols, but there are some exceptions.
- Opt for something that is simple to recall and never put a password hint out in the open in your room or make it available in such a position that it’s on public displays for prospective hackers to lay their eyes on.
- Reset your password whenever you forget it. However, change it once annually, as a general refresh.
If you want to make it even simpler to handle your passwords, attempt leveraging a password management tool or password account vault. LastPass Free is an amazing tool for people. LastPass provides a free account and has a 2$/month membership pack with some amazing sophisticated password features.
4.Leverage two-factor or multi-factor authentication
Multi-factor or two-factor authentication is a service that imparts extra layers of security to the conventional password method of online identification. Without two-factor authentication, you would typically input a username and password. However, with two-factor, you would receive a prompt to enter one extra authentication method like a Personal Identification Code, another password, or even a fingerprint. Leveraging multi-factor authentication, you would be compelled to input more than two extra authentication methods after inputting your password and username.
According to NIST, an SMS delivery should not be leveraged over the course of two-factor authentication as malware can be leveraged to attack mobile phone networks and can compromise information over the course of the process.
5.Be educated about phishing scams, be very wary with regards to flyers, phone calls, and e-mails
Phishing scams are upping the ante, and the damages caused by them are turning out to be extensive. What is phishing? In a phishing attack, the malicious actor pretends to be someone
or something the sender is likely to divulge credentials to, tapping on a hazardous link, or opening up an attachment that spreads infection on the user’s system with trojans, malware, or
zero-day vulnerability exploit. This typically causes a ransomware-based compromise, as a matter of fact, 9/10ths of ransomware attacks come from phishing attempts.
A few critical cyber security guidelines to recall with regards to phishing schemes include:
- Bottom line – Don’t read email from individuals you do not know.
- Scan for the safety of links – hover over links to see where they are directed
- Employ a suspicious eye – Look and see where your email messages came from and if there are any grammatical errors or silly aspects to it – for e.g. a Nigerian Prince contacting you
- Malevolent links can come from known people who have been infected too. So be extra vigilant.
6.Safeguard your critical personal identifiable information (PIN)
Personal identifiable information (PIN) is any data that be leveraged by a malicious actor to detect or locate a person. PII consists of data like names, addresses, phone numbers, date of birth, IP address, geo-location details, any physical or digital identity data, and even social security numbers! Your credit card data ought to be safeguarded by enterprises if they adhere to the PCI DSS Standards.
In the new always connected planet of social media, you should be very wary about the data you put up online. It is best practice that you only depict the minimal amount possible about yourself on social media networks. Look at reviewing your privacy settings throughout all of your social media accounts, especially Facebook. Including your home address, birthday, or any other PII data will considerably escalate your risk of a security-based compromise. Hackers leverage this data to their benefit.
7.Leverage your mobile phones securely
Going by McAfee Labs, your smartphone is currently a target to >1.5 million new events of mobile malware. Here are some quick and dirty tips for mobile device security.
- Input a difficult mobile passcode – don’t use your bank pin or your birthdate!
- Setup applications only from trusted sources
- Update your gadget frequently – hackers leverage susceptibilities in un-updated older variants of operating systems
- Don’t transmit PII or sensitive data over text messaging or email
- Utilize Find my iPhone or the Android Device Manager to avert theft or loss.
- Execute ongoing mobile backups leveraging iCloud or enabling backup & sync from Android.
8.Backup your information on an ongoing basis
Backing up your information consistently is an often ignored stage in ensuring personal online security. The leading IT and security managers adhere to a simplistic rule referred to as the 3-2-1 backup rule. Basically, you will retain three copies of your information on two differing types of media (external and local hard drive) and one copy in an off-site location – preferably, cloud storage.
If you become a victim of ransomware or malware, the only reprieve to get back your information is to erase your devices and go about restoring with a recently performed backup.
9.Don’t leverage public Wi-Fi
Don’t leverage a public wi-fi without leveraging a Virtual Private Network (VPN). Through leveraging a VPN, the traffic flowing in between your device and the VPN server undergoes encryption. This implies it’s a lot more tough for a malicious actor to get access to your information on your gadget. Leverage your cell network if you don’t possess a VPN when security is critical.
10. Analyse your online accounts and credit reports on an ongoing basis for alterations
With the latest breach of Equifax, it’s more critical than ever for customers to protect their online accounts and survey their credit reports. A credit freeze is the most efficient method for you to safeguard your personal credit data from malicious actors currently. Basically, it enables you to lock your credit card and leverage a personal identification number (PIN) that only you will be aware of. You can then leverage this PIN when you are required to make a credit application.
Leading reasons for security breaches
Malware, phishing, and hacking are quickly on the rise and are the number one cause of security breaches presently. But what raises even more concern, is that these hacking efforts are the outcome of human error in some fashion. Education and being aware are of vital importance in the war against cybercriminal operations and averting security compromises.
Our hope is that you discovered that these security-related best practices and tips to be helpful in managing the risk with regards to security incidents.