- December 15, 2022
- Catagory cybersecurity
Remote work during the pandemic and the current dynamic of hybrid workplaces has had a strong impact on how you must manage cybersecurity. Remote work isn’t going away, while other longstanding trends as well as new realities will affect cybersecurity in 2023.
Ransomware remains a major threat
Expect ransomware attacks to continue to be a factor in your cybersecurity planning, as threat actors move from encrypting files to targeting third-party cloud providers while continuing to use aggressive, high-pressure tactics to extort victims, including data-encrypting malware and more novel infiltration approaches.
Global geopolitics will affect your business
The ongoing conflict in Europe will mean some of those ransomware threats will come from Russia. Overall, 2023 is going to begin with a great deal of uncertainly and tension, with more state-sponsored threat actors looking to destabilize global economies and specific industry sectors such as logistics and shipping, energy, semiconductors, and financial services.
Zero Trust adoption will grow
With more workloads being moved to the cloud, a Zero Trust approach to security will become more compelling and necessary in 2023, transforming how you secure your infrastructure, including network penetration testing.
Automation will increase, too
It’s near impossible for organizations of any size regardless of budget to keep up with the volume of threats, which means 2023 will see even more automated cybersecurity, enabled by artificial intelligence (AI) and machine learning. The downside is the bad guys can leverage automation and AI, too, which means organizations will need to take a more active approach to cybersecurity.
Watch out for bots
Speaking of automated bad guys, be prepared for more bot activity in 2023, which can automate and expand attacks as perpetrators rent out IP addresses to make it difficult to track them.
Your own IT is a threat
Between shadow IT and the proliferation of endpoints either due to remote work or internet of things (IoT), there’s no shortage of attack surfaces for threat actors in 2023. If your endpoints aren’t properly configured and you’re not keeping a handle on shadow IT, your cybersecurity posture will be drastically weakened.
You people can still be a problem
Even with all the right technology in place, the biggest threat cybersecurity in 2023 will continue to be your own people, whether it’s by accident or due to insider threats from unhappy or former employees. Training combined with a Zero Trust approach will mitigate risk to your business.
What won’t change in 2023 is that cybersecurity isn’t something most organizations can handle on their own, so if you haven’t already, make it the year you see how a managed service provider can help evaluate and shore up your security posture.
- August 31, 2022
- Catagory cybersecurity
You don’t use auto insurance as an excuse to drive recklessly, so why would you cut corners on cybersecurity because you have ransomware insurance?
With ransomware attacks doubling in 2021 compared to the previous year – due in large part to the massive shift to remote work – the average cost of a data breach grew to record levels by more than 10% in 2021 as threat actors took advantage of a broader attack surface that resulted from a hybrid work environment.
Much of the costs of these breaches were covered by insurance, including ransom payments, but cybersecurity insurance providers are becoming more selective with their coverage as payouts have increased – qualification processes are more rigorous and the threshold for a payout is getting higher.
If you were depending on cybersecurity insurance without a data protection strategy, you need to seriously rethink how you implement security in your organization.
As ransomware attacks rise, so do premiums
For starters, the number of ransomware attacks is only going to get higher as more and more threat actors with a wide array of experience and expertise look to make money off data breaches – cybersecurity insurance is not going to be enough to save your business.
It’s not that you should cancel your insurance – you should be prepared to pay more – but you must also have people, processes, and technology in place to secure your business and sensitive customer data. Making an insurance claim should be a last resort – no matter how much you pay for it, it won’t bring your data back if you fall victim to a successful attack.
You really don’t want to be paying the ransom, even though many companies go that route – that only emboldens the bad guys to keep at it. Some insurance companies are no longer even covering ransomware payouts. If cybersecurity insurance premiums are going up and not covering what they used to, it’s time to implement better security practices – prevention is much more affordable in the long run.
Your MSP can help you up your security game
Cybersecurity awareness should be something that touches everyone in your organization, including the understanding that a data breach costs the business money – and your insurance provider expects you to raise your game to take a more proactive stance with security.
Even if you’ve put the effort into your cybersecurity, keeping it current and staying on top of all the threats can be daunting. With so many systems, endpoints and users, visibility is you biggest challenge, and understanding the threats, attack surfaces and vulnerabilities requires a great deal of time and resources, including skilled people.
That’s why you should turn to your managed service provider for guidance – they’ve got to contend with rising insurance premiums too and know that prevention is better than getting the cost of a ransomware attack covered. They already have visibility into your infrastructure and can help you put all the people, processes, and technology in place so you can qualify for cybersecurity insurance but hopefully never have to use it.
- March 17, 2022
- Catagory cybersecurity
As we wrap up the first quarter of the year, some trends are emerging around cybersecurity that affect businesses of all sizes.
Not surprisingly, these trends are being driven by the impact of the pandemic, as remote work continues, and organizations look to establish a new normal of flexible work hours and hybrid teams.
Cybersecurity is getting more expensive
The cost of securing the organization is going up, and so is the cost of not having robust security. According to a report released last year, the global average cost of a data breach surpassed 4 million U.S. dollars. These costs are attributable to lost revenue and lost customers, fines for non-compliance, and even ransomware payouts. For larger organizations, it’s the cost of doing business, but for smaller ones, it can mean the end. Investing in cybersecurity is also expensive, but it’s an investment that pays off in the long run.
People are the deciding factor
Social engineering remains a preferred tactic of bad actors when it comes to gaining access to systems, stealing data, and disrupting systems. Ransomware continues to be one of the most popular types of attacks, and remote work has made it easier for threat actors to target vulnerable users. This means training employees with sufficient security awareness is more critical than ever so they can spot a phishing email and understand the need to adhere to security policies. Given that passwords remain integral to managing access, there’s an increase in adoption of biometrics to add an additional layer of security to turn people into their own password by using their individual characteristics to facilitate access.
The bad guys are getting smarter
Threat actors see the benefit of honing their skills because it makes them more successful, especially when the motivation is money. Whether it’s remote work or other circumstances, they’re always looking for new avenues with vulnerabilities they can exploit. As organizations adopt new ways of working, including flexible hours and workspaces for employees, cybercriminals are going to look for windows where they can access data and disrupt systems.
One trend that’s been clear since before the pandemic is that security can not be just an issue for IT to manage. If organizations are to implement effective cybersecurity, they need the support of the C-suite who can lead by example and provide budgetary support with and understanding that cybersecurity impacts the bottom line.
- September 30, 2021
- Catagory Security
Remote work technology continues to be a prime target for cybersecurity attacks.
Recent research released by Tenable in collaboration with Forrester found that nearly three quarters of organizations have traced recent cyberattacks that have impacted their businesses to vulnerabilities in remote work technology. Even before the pandemic began, the traditional perimeter around enterprise IT infrastructure had become rather porous due to increased mobility of workers and cloud adoption. With a hybrid workforce that has fully embraced remote access tools, cloud services, and personal devices, that perimeter is pretty much gone.
The Tenable / Forrester research found that 80 per cent of security and business leaders say remote work has put their organizations at higher risk because IT teams lack visibility into remote employee home networks as more than half of remote workers use a personal device to access work data. This has meant three quarters of cyber attacks are targeting remote employees. Threat actors are also exploiting third-party software providers or leveraging vulnerabilities in those products, with 65 per cent respondents linking those compromises to recent cyberattacks.
For small and medium-sized businesses, it can be challenging to invest a great deal of money in security technology and dedicated IT staff, but there several core things that can help to better protect remote work technology from cybersecurity attacks.
- Use a Virtual Private Network (VPN): Implementing a VPN for anyone accessing corporate data and applications via the Internet provides an additional layer of security via multi-factor authentication and should be required for anyone looking to access valuable company intellectual property and other sensitive data.
- Use complex passwords: Many employees opt for simple passwords they can remember and use them for more than one application or website, which means once a hacker guesses one of them, they have access to a great deal of private information. Since these can be difficult to remember, consider implementing password encryption software that stores usernames and passwords without the need to know what they are because the information is encrypted from the start.
- Educate everyone: Having the right technology in place only goes so far; you need a culture where all employees understand the need for complex passwords, log in via VPNs, and recognize phishing attacks and other suspicious emails. In addition to employee training, set aside a budget for your cybersecurity team to attend webinars and other courses that help them keep up with an ever-changing threat landscape.
- Keep everything up to date: Whether it’s hardware or software, getting behind upgrades and patches is sure fire to create vulnerabilities that threat actors will support. While much of this can be automated, you should have a program in place to verify all necessary updates are done on schedule.
- Pick a reputable cloud service provider: A great deal of security misconfigurations that lead to data breaches are the result of connecting with the many cloud services available to businesses today. Make sure your chosen providers have a solid track record on the security front and understand what they’re responsible for securing and what must be done at your end.
Keeping ahead of cybersecurity attacks has always been a challenge and the remote work era hasn’t made it easier. Consider seeking out a managed security services partner who can help you evaluate your security posture, implement new technologies and policies, and automate where possible so that your business is a less appealing target for threat actors.
- May 31, 2021
- Catagory networking
After more than a year of focusing on securing remote workers, it’s time to prepare your office for a hybrid workforce and reinforce your wireless security.
The threats to your on-site wireless security haven’t gone away and having workers who are in and out of your office post-pandemic ends means the network security landscape is just as dynamic as ever. The hybrid workforce is a stark reminder that there is no network perimeter, and you must constantly review your network security checklist—Bring Your Own Device (BYOD), the Internet of Things (IoT), and ubiquitous connectivity remain important considerations.
Secure your office for a hybrid workforce
As people come back to office, the best practices for wireless security are more important than ever, especially as many employees may no longer have a permanent office or workspace as hot desking becomes more prevalent. In addition to guests, you’ll have employees connecting to your office network on-site in an inconsistent manner with devices that are connecting a variety of other networks, whether it’s the employee’s home network or a wi-fi hotspot as it becomes possible to work from coffee shops again.
Now is a great time to review your management policy for all IT endpoints and provide refresher courses on wireless security for your staff. For some organizations, a hybrid workforce was already familiar to them before the pandemic, but for others it will be just as jarring as going fully remote. Given that you’re about to experience another paradigm shift, it can’t hurt to bring an outside partner to evaluate your current wireless security posture.
What’s in a name
A good place to start is to review your inventory of wireless routers access points.
No matter how many you have or where they are located, you should review their service set identifiers (SSIDs) to make sure they are suitably named as to be found by authorized users, but not so easy for unwanted guests to connect to because the names are obvious or remain the factory default. Your network naming should be just as well thought out password selection—avoid creating one that’s likely to help a hacker guess the network password. Rotating passwords and SSIDs can also make it harder for devices and networks to be breached, and the more unique, the better.
With a hybrid workforce, you may want to segment your network so that transient employees have dedicated wireless access points to connect to that are separate from employees who are back on-site full time. Either way, you should hide your SSID so only users who know the actual wireless network name can search it out.
Apply access controls
Even before the advent of the hybrid workforce, there was never a need for every employee to access the same network resources or devices. Just as you segment wireless router access, consider giving specific users access to specific devices such as network printers depending on whether they’re occasionally on-site or in the office everyday.
No one needs to be connected to every device in the organization, so segmenting access will limit the impact of a breach should one endpoint be compromised. At the end of the day, not all employees are equal, including post-pandemic visitors, who wireless access for their mobile devices. Adopting a Zero Trust model for wireless security can go a long way because it’s based on the mindset that organizations shouldn’t automatically trust anything inside or outside its perimeter—every connection must be verified, whether it’s an endpoint, switch or IP address if the organization is to prevent breaches.
Secure and scan everything
Wireless security demands that all access points been encrypted, and yet surprisingly, many wireless networks are left wide open, making them easy avenues for threat actors to gather sensitive information, or as a means to gateway to hack more secure systems.
No matter how stringent your wireless security, it’s often just a of time before someone or something gets past the firewall because today’s cyber threats are so persistent. The trick is to balance security with productivity—you don’t want it to be a barrier to getting things done, otherwise employees will find shortcuts around it whether they’re working at home or in the office.
If you’re feeling rusty about in-office wireless security and would like a refresher to prepare your organization for the hybrid workforce, seek out the help of a managed security services provider.
- December 10, 2020
- Catagory cybersecurity
The trick to protecting sensitive data is understanding not all business information must be protected.
Even organizations that understand the need for robust information security spend heavily on software and hardware without measuring its return on investment (ROI), only to still fail at safeguarding the most sensitive information that’s the lifeblood of their business because they failed to define what it is before apply security controls.
If you want to adequately protect your most valuable data, you must understand which business information is most critical to your bottom line.
Not all data is equal
It’s seems counter-intuitive, but the reason information security often fails to protect sensitive data is the mistaken belief that all information must be protected equally. Even before the pandemic and remote work became the norm, distributed workers, branch offices, mobile devices, and the evolving Internet of Things (IoT) meant organizations have had to become smarter about how they secure sensitive data. Now it’s more important than ever to make the business case for information security.
The business case isn’t a request for a bigger information security or more technology. Rather, it’s about identifying sensitive data, understanding its value, and being clear about what’s necessary to protect it. You need to operationalize a change in mindset that delivers ROI and protects the sensitive data that powers your business. However, it can be difficult for organizations to step back and understand what data is the most valuable when it’s growing exponentially.
One thing is for certain, however: Trying to protect every single bit of data equally isn’t cost effective.
Sensitive data must be defined to be protected
If organizations are to marshal their information security resources effectively, they must narrow their scope and define what constitutes sensitive information. While the definition can be guided by compliance and regulator obligations, it’s just as important to figure what data constitutes as a critical asset to the business.
Just as a fleet of trucks are critical assets for a transportation company, every business today has stored information that is critical to daily operations—that’s the sensitive data that must be protected. Otherwise, there are financial repercussions in the form of lost competitive advantage and fines for non-compliance, both of which lead to lost revenue, as do settlements from litigation and damaged reputations.
While compliance obligations and privacy legislation do dictate that some information be prioritized by information security strategies, they’re just the beginning. A healthcare organization that may have all their patient data effectively secured but not have all their research data protected—it’s just as valuable as it may support patent application or attract grant money, and has the potential to generate revenue. Personally Identifiable Information (PII) is always an obvious candidate for protection because compliance and regulatory frameworks deem it as sensitive, but intellectual property or data that’s essential to running your business is just as critical.
Treat sensitive data like a business asset
If you want get ROI from your information security spending, you need to think differently. You must understand your data on a deeper level so you can assign a value to it. There’s plenty of information residing in your organization that won’t cripple your organization if it’s lost. But your sensitive data must be assigned appropriate valuations that will be the of a business case for information security spending.
Getting an ROI on your information security spending is about anticipating incidents that haven’t happened yet, much like an insurance company considers the likelihood of natural disasters. To determine sensitive data and its value, you must weigh the cost of the protections you put in place with the financial impact of any breach and its likely frequency.
The simplest approach its to categorize data in three ways: data can be shared freely; sensitive data that can be shared with certain audiences in specific ways, and data that must remain confidential to the organization and never shared. The process of segmented and prioritizing data enables to apply the appropriate information security controls, so you understand the complete lifecycle of all data and adequately protect it based on the repercussions of losing it.
Treating sensitive data like a business asset enables you to make the case for information security so ROI can be effectively measured so can protect these valuable assets as you would any other important investment.
- October 29, 2020
- Catagory cybersecurity
Improving security for remote workers will hopefully be an inevitable consequence of the Covid-19 pandemic, and despite the inherent challenges, it should be a priority for IT teams.
Recent reports by Cisco looking at the future of secure remote work and consumer privacy found that IT buyers had been caught off-guard by the sudden shift of employees working from home, but are now speeding up adoption of technologies to support remote work. A majority of the 3,000 IT decision makers surveyed by Cisco rate cybersecurity as extremely or more important than it had been before the beginning of pandemic.
Guaranteeing access, securely
The biggest challenge for all IT teams regardless of an organization’s size has been improving security for remote workers, although providing the necessary access to the applications and data they needed came first. It comes at a time when the average consumer also values security and privacy as a social and economic issue, according to Cisco.
However, the company’s own research found there was a lot of work to be done toward improving security for remote workers by IT teams as just over half were somewhat prepared for the accelerated transition earlier this year. Endpoints, including those owned by organization, were cited as being the most difficult to protect, according to the Cisco survey, followed by customer information and cloud systems with the ability to securely control access to the enterprise network being the biggest challenge.
Improving security for remote workers will no doubt continue to be an priority for IT teams, even post-pandemic, as some employees will continue to want the flexibility of working from home and organizations see continued benefits, including cost savings on office space, by not having everyone in a traditional office environment.
Digital transformation can lead to a more secure cloud infrastructure
While IT teams are likely to see some budget increases that will specifically support improving security for remote workers, there are many initiatives that can help improve overall cybersecurity posture for organizations that are already common steps in a digital transformation journey.
If you haven’t already, you should establish a cloud security strategy that’s part of a broader transition cloud infrastructure transition. This will indirectly go toward enhancing security for remote workers while allowing IT teams to have to worry less about on-premises systems that were unprepared for the sudden shift to remote work. While putting more applications and data the cloud come with their own cybersecurity challenges, they can scale better than on-premises solutions and provide the necessary flexibility for supporting a remote workforce.
The transition to the cloud should also include embracing new tools to stay secure, recognizing that IT teams still have some responsibility for securing cloud applications and data, even as the service provider has a role in securing systems, too. IT teams need visibility into cloud infrastructure as well as their on-premises deployments in a single interface.
At the same time, IT teams should consider what experts are calling “zero-trust security strategies.” A zero-trust approach assumes all users and endpoints could present a threat to the organization, so they must be able to prove they are trusted if they are to gain access to the enterprise network, applications and data.
You can be small and secure
For smaller organizations, improving security for remote workers is just as essential but can be challenge for their IT teams. A managed services provider with experience helping small and medium-sized business with their technology infrastructure can play a key role in accelerating their adoption of solutions that can support remote workers with robust security.
Sanjeev Spolia is CEO of Supra ITS
- October 15, 2020
- Catagory cybersecurity
The shift to remote work means cybersecurity awareness across your organization is more important than ever for maintaining ongoing business operations and regulatory compliance.
Even before the pandemic, most organizations had become rather porous in nature from a network security perspective thanks to the Bring Your Own Device (BYOD) movement, adoption of cloud computing, distributed locations, and an already increasingly mobile workforce. But while security technology has emerged to keep up with these trends, it’s not a silver bullet. Every employee needs a heighten level of cybersecurity awareness.
Remote work means that how an employee manages their device at their home office can have an impact on the organization’s entire network. Their cybersecurity awareness means understanding their workstation is an endpoint that must be configured properly as to contribute to the overall security posture of the organization.
Training is critical to maximize cybersecurity awareness amongst your employees, especially remote workers. But it’s easy to lose their attention if training isn’t clear and engaging. If you’re doing regular phishing tests for your employees, try to have a sense of humour with the email content you’re creating as part of the test, for example, but also make sure employees understand the lesson without being made to feel stupid.
Cybersecurity awareness training should be done regularly as part of regular operations, and at least quarterly, rather than being big annual event, because threats to the organization are ongoing as hackers automate their processes to optimize their chance of success. You should also involve the executive team in your training, so everyone understands that cybersecurity awareness is critical to the success of the business. You might have the CEO do a short video, which is easy to share with remote workers.
The training shouldn’t be solely the responsibility of the security team, either. Lines of business leaders should help to spearhead cybersecurity awareness, and it should be a part of your remote work strategy.
It’s important to remember that cybersecurity awareness isn’t only about protecting against threat actors, malware and ransomware, and malicious data theft. Employees need to understand that good security also helps the organization stay compliant with government privacy legislation and meet regulatory obligations that apply to their industry. Data breaches not only have the potential to cripple business operations and negatively affect customers, but also lead to financial and legal penalties that can profoundly affect the long-term health of the organization.
Most people have adapted to remote work for the past seven months, but because organizations are more distributed than ever, there’s a potential for cybersecurity awareness efforts to lapse, even as be bad people around the world continue to take advantage of the new work-from-home reality. Those doing remote work as part of a connected organization must continue to be vigilant about security as part of their daily work habits.
Sanjeev Spolia is CEO of Supra ITS.