As approximately 90% of data loss / data breaches are as a result of human error, a pragmatic approach to help reduce the risks involved related to “cyber crime” is required. It is, unfortunately, not possible to reduce your risk completely but there are a handful of basic fundamentals that, using the 80/20 principal, may help protect your computer infrastructure from such attacks.
Please note the following and take heed of the warnings:
- 100% reduction of risk may not be possible (no matter how much time and money you spend on it), planning for the worst by having processes and procedures in place to work through a “breach” stays the most recommended approach
- Anti Virus and Anti Malware products are not foolproof and cannot be your only defence
A good place to start is an awareness of the main threats and then try to mitigate these as far as possible. Below are a few of the main threats which need to be addressed as soon as possible:
- Social Engineering & Phishing attacks:
- This currently makes up a big portion of the threats being used by persons wanting data which is not theirs. Examples of this are:
- Social engineering would be a telephone call requesting information which can be used to help access your computer networks
- Phishing attack would be email with a link to either an infected website or which has an attachment containing malicious software
- Vishing attack would be a telephone where the person already has information which they can offer as proof of their legitimacy but they require some thing a OTP (one time pin)
- Smishing attack would be similar to social engineering but makes use of SMS technology. It may also mimic that of a Vishing attack
- This currently makes up a big portion of the threats being used by persons wanting data which is not theirs. Examples of this are:
- Poor passwords:
- Due to a lack of knowledge or absolute disrespect for the protection of their own or their employers’ systems, a vast number of users make use of easy to crack passwords. This includes passwords that are too short or contain commonly used “password” words/numbers. Proper password management is vital to both your personal as well as your employers’ data security.
- The use of long, complex passwords is best practice. As this is not that easy to manage, the use of a password manager such as “Lastpass or Keepass” (this is not an endorsement or promotion of only these 2 products, there are many available and your own research is always suggested before implementing such systems) can be used to assist
- Where possible, make use of 2-factor authentication (also known as Multi-factor authentication)
- Do not use the same password for all systems, especially web sites
- Due to a lack of knowledge or absolute disrespect for the protection of their own or their employers’ systems, a vast number of users make use of easy to crack passwords. This includes passwords that are too short or contain commonly used “password” words/numbers. Proper password management is vital to both your personal as well as your employers’ data security.
The next place to pay attention if you are a network owner (include here any small business network) is the segregation of access to information i.e. grant the employee access to that which they need access, and only that. This is also known as the concept of least privilege and allows that should a user (other than the system owner / admin) be compromised, only the data they have access to can be compromised.
The following statement is said with some regret, but unfortunately needs to be said (by taking this approach, you can better prepare for such an eventually than be caught wanting):
Rather assume that your system will be breached than assume it will not!
Some training options to consider to make you and your business more aware of the threats (these are all free, so may not be in depth but more comprehensive options are available. There are also a multitude of providers that can assist with in-house training if required):
- ESET (https://www.eset.com/ca/cybertraining/?cmprfc-PR-B2B2017-GenIT-PR_CAT)
- KnowBe4 (https://www.knowbe4.com/)
This document will be incomplete if mention is not made of the importance of having continuous backups of your information.
Here are some of the main reasons why a data backup is so important:
- Data loss as a result of Virus or Trojan
- Data loss as a result of a ransomware attack
- Hardware failure
- Business continuity
The fact that you have a current backup of your data, will help keep your business going in times of trouble and give you as the system owner peace of mind that there is a possible route of recovery when things go wrong.
A note here would be that a good backup system has both internal and external recovery options i.e. store a backup with an offsite service provider to give your business continuity plan a place to start.
Unfortunately, backups do not always have a one size fits all solution and depend on factors such as do you want the backups to be on or off-site so talking to your desktop support agent or network owner is a good place to start. Alternatively, here are a few product providers to consider:
- On-site:
- BackupPC (http://backuppc.sourceforge.net/)
- Off-site:
- Irontree (https://irontree.co.za/)
- Google Backup & sync (https://www.google.com/intl/en-GB_ALL/drive/download/backup-and-sync/)