Cybersecurity attacks are becoming so common that it’s no longer a matter of if a breach will occur but rather when. Hackers are looking for vulnerabilities in your system 24/7 and in today’s digitalized world, their efforts have never been easier, or more successful. Over the last 12 months, 66.2 percent of financial organizations faced at least one cyber security attack. And the global cost of cyber crime is estimated to reach $2 trillion by 2019, a threefold increase from the 2015 estimate of $500 million.
Cyber breaches can cause any number of business challenges, from financial and reputational damage to a loss in shareholder value. For public companies whose websites house sensitive information such as quarterly financials, press releases and more, the stakes are high. The best defense is to understand security best practices and partner with an IR vendor who puts them into action.
Here are five key security measures you need to know about to help you stay ahead of future attacks.
Passwords: The necessary evil
How many times has IT reminded you to create a unique password (using letters, numbers and symbols)? The purpose: secure access to your resources. For many, the weak link in the authentication chain has been the much maligned “password”, however, new and secure technology trends are on the rise.
Many companies, large and small, are looking to new authentication trends such as: Two Factor Authentication (2FA or TFA). 2FA is an extra layer of security often referred to as two-step verification. The first step is the password and the second step could be PIN, token or smartphone app that is only accessible to the application user. 2FA makes it harder for attackers to gain access to your IR web application because knowing the password alone is not enough to pass the authentication check.
Data Encryption: Mathematical algorithms at work
Encryption, a system of mathematical algorithms that encode user data so that only the intended recipient can read it, is one of the best methods to safeguard your privacy. Using Wi-Fi to connect to the Internet is convenient, but in terms of security, there’s always a trade-off as it isn’t difficult for an intruder to intercept your connection, which could result in stolen user credentials and other sensitive data. This is why many websites use a protocol called HTTPS for encrypting data that’s being sent between sites. While this doesn’t guarantee absolute security, the risks are reduced as information being transmitted can only be decrypted by a destination site.
Before selecting a web partner, make sure their solution provides encryption of data in both Transit (SSL encryption) and at Rest.
Patch Management: Vital for online security
As you know, the cyber threat landscape is evolving at breakneck speed. While cyber criminals are able to compromise a system in hours or minutes, the reaction of companies usually takes months or even years. In fact, 18 percent of new malware remains undetected in the first 24 hours and 2 percent continues 3 months after infection, according to IDG Research.
For many companies that are implementing new technologies one of the top priorities during the planning phase is security. A critical aspect of security is Patch Management: the process of repairing system vulnerabilities that are applied to different parts of information systems, including operating systems, servers, routers, desktops, firewalls and many other components that exist in a network.
To protect from malware and ransomware and other external attacks, it’s important to work with a partner who conducts regular security patches to your website and hosted servers. The importance here is the prevention of viruses like Zero Day Attack or WannaCry, which have the potential to take down a company’s entire network.
Monitoring: Around the clock website check ins
Website downtime not only affects the end user’s experience and productivity, it ultimately affects a company’s bottom line. Proactively monitoring the network around the clock is an important pre-requisite for any organization wishing to protect itself from a potential security breach. There are various monitoring tools (New Relic, Splunk, Pingdom, IDS, Log manager, SCOM, etc. available in the market that allow infrastructure and security teams to monitor both up-time and any security breach in a network.
Security Assessment: Third party independent security reviews
Regular IT security assessments by a third party is key in preventing gaps in the application or infrastructure security. The third party independent vendor tests the application against OWASP standard. This universal security standard ensures the application is built following security best practices and is protected against attacks like SQL injection and cross-site scripting. IRO’s should be requesting the third party audit reports before deciding on the final solution. These third party security reports are similar to a home inspection before purchasing a house. Third party independent reports will provide insight into the security of an IR web application.
With cyber threats on the rise it is critical that you prepare for a cyber incident with the same discipline and rigor as you would an operational one. This means getting up to speed on security best practices, taking the necessary precautions internally, and partnering with a vendor that has the measurements in place to mitigate risk and keep your information secure.
Vee Punia is Director, IT & Infrastructure at Q4 and holds over 17 years of experience in IT Infrastructure Management, Security operations, ITIL Change Management and Service Delivery of Enterprise or SaaS platform.
The post Five security measures you need to know about to stay ahead of future attacks appeared first on Q4 Blog.
