In the context of IT, the word “security” typically conjures negativity and fear. For end users it is an annoyance; with complex passwords, MFA and calls to support to get things unblocked. For business leaders and IT decision makers, it is an increasing concern; the latest of many “new balls” to juggle, an ever-changing landscape, and sometimes not knowing where to start.
The truth is that IT security is and will remain a hot topic, it needs continual attention, but need not be burdensome. Our lives are full of decision making based on risk and IT security is no different – we ultimately need to identify and assess the risks, review the ways to mitigate that, and decide whether the mitigation cost outweighs the risk.
Key Areas
User Awareness and Training
End users are consistently identified as the most vulnerable part of an IT system and hence the easiest target. Even with the best technical safeguards in place, there will always be a new and emerging method to bypass them, meaning that users need to be aware of threats and cyber-safe working methods to reduce their likelihood of succeeding. Do you complete an induction for new users that includes IT and cyber security? Do existing users undertake refreshers? Do you have established and robust procedures for authorising monetary transactions? If not, this should be your first foray into the world of cyber security.
Response Plan
It is important to shift mindsets from “what if” to “when”; all companies have almost certainly already been subjected to an cyber attack of some sort, and it is inevitable that a breach will occur. What will you do when that happens? Who do you need to contact? How will your business operate when key IT systems are offline? Will you pay the malicious party trying to extort money from you in exchange for the safe return of encrypted data? You should build a response plan to address these, and tie it in with your business continuity and disaster recovery plans.
Monitoring
Whilst many cyber-attacks are “smash and grab”, it is increasingly common for attackers to “play the long game”. Targeted recognisance is conducted, such as an attacker gaining access to your emails and actively monitoring; they learn and understand your frequent contacts, the language you use, and identify relationships of value to later be leveraged. When the final attack is unleashed, the attacker has already been inside your systems for months, and whilst the first attack may not be successful the information gleaned from the recognisance is repeatedly reused in further attacks.
Proactive monitoring is essential to help mitigate this; you need to know as soon as an attacker has gained entry so that this can be removed. There are a huge range of products and tools to assist with this, but you can start simple:
- Use the inbuilt alerting within Microsoft 365 (such as the default policies in the security centre) and enable the audit log.
- Sign up for the National Cyber Security Centre’s “Early Warning” system. This is free for UK organisations and will alert you if your public IP addresses are seen to be communicating with known malicious websites.
Golden Basics
The technical solutions available to harden your cyber security are endless, but you should start by ensuring you’re not scoring any own goals:
- Deploy multi-factor authentication for all internet facing services.
- Disable and remove systems that are no longer used (for example, an old server, router or user) so they are not neglected and provide an unforeseen attack surface.
- Regularly patch and update all systems in-line with vendor guidance.
- Backup all systems and data; you should maintain multiple copies with at least one offsite.
- Abide by “least privileged access”; if a user does not require access, they should not have it. In the event of a user account becoming compromised, LPA ensures that no unnecessary systems and data are compromised. This includes:
a. Administrative access
Users should not have this for day-to-day activities, and if administrative rights are required they should be granted with a separate account.
b. System access
If a user does not need access to a specific application or collection of files, they should not have it.
c. Wireless network
Not granting guests and visitors access to your main corporate wireless network.
Our team are here to fully support you with your security concerns and will make recommendations in line with the levels of security your business needs.
If you would like to explore how we can help make your business more secure, please get in contact with the Bit Solutions team.
