Today’s companies are falling victim to attacks that target physical and logical infrastructures, mobile platforms, user identities, network devices and more. The number of threats to company systems – and the security of precious data – is growing exponentially. Unfortunately, those threats are also becoming increasingly sophisticated in their efforts to undermine companies’ security provisions – so both the volume and the effectiveness of security threats are increasing.
The last several years have seen an unprecedented change in information technology both at the personal / consumer level and in the business / commercial environments. These changes have dramatically shifted how we generate, access, and most importantly, attempt to secure our data. The pace of change far outstrips the ability to rapidly understand, manage and secure data. Below are 10 tips you can use to be more proactive with your security and decrease your chances of becoming the next victim of a data breach.
Assess Your Internal Infrastructure
Getting an independent vulnerability assessment of your environment is a great way to discover gaps in your security, determine areas of strength and weakness, and validate processes and procedures. This needs to be done on a regular basis as the threat landscape is in constant change. Assessments can uncover vulnerable targets before hackers can find and exploit them.
Understand your Data
Organizations are generating and storing more data now than ever before. It is vital that everyone understands the different kinds of data and how each type is to be transmitted, stored and accessed. Strong policies and procedures surrounding data handling can drastically reduce accidental loss or leakage. Preventing the loss of regulated or confidential IP is becoming a critical and central mission for an organization. Defining standards for data collection, storage, retention and approved use removes confusion and limits accidental disclosures. Developing consistent data classifications, acceptable use policies, and repeatable processes and procedures will reinforce proper actions with your staff.
User Training and Education
Users with excessive or inappropriate privileges can potentially wreak havoc on a business, including violating compliance mandates or causing leakage of confidential data. Training, documented policies and procedures, and clear communication channels allow employees to understand how to handle data and become part of the solution.
Policies and Procedures
Well defined policies and procedures can prevent problems before they begin.
Companies are facing an increasingly complex regulatory environment. These regulations span far beyond IT security to now include legal, HR, C-level executives and the Board of Directors, all of which can be found liable for not doing enough to protect sensitive data. To be successful, this process must be uniform in its implementation and persistent in validating compliance. Well defined policies and procedures can prevent problems before they begin. Unfortunately, policies and procedures don’t come in “one size fits all”. Effective policies need to reflect the specific operating environments they apply to. Procedures must balance the needs of the business against the capabilities of the staff.
Patching and Upgrades
Patching and upgrading software is one of the simplest yet most beneficial actions a company can take. Known vulnerabilities on un-patched systems are the most common attack strategy for hackers to use to gain control of a system. Patching solutions should be automated, provide detailed asset information about what software versions are installed, and monitor for compliance.
Endpoint Security
Traditionally, security threats have been viewed as coming from somewhere external to the company rather than internal. Users have access to all of your critical information and routinely make for easy targets for malicious code (malware) and phishing attacks. Monitoring and enforcing security standards for every device before granting access to corporate resources has increasingly become the requirement across enterprises. By uniformly and consistently requiring and enforcing security standards, vulnerabilities are decreased and end user’s awareness of acceptable use increases.
Knowledge, Big Data and Analytics
To successfully defend against ever evolving and sophisticated threats, organizations must be able to correlate data from numerous sources in near real time into useable intelligence. Log data generated from within the company must be aggregated with external third party threat intelligence data, and vulnerability assessment data to give you a full picture of your environment. Once the data has been unified, correlation of that data turns raw information into actionable remediation tasks and brings clarity and awareness to security events.
Cloud Security
The concentration of resources and data make cloud infrastructures an attractive target presenting a myriad of challenges to secure and monitor. Compounding the problem is the very nature of cloud infrastructure, systems which are designed to be replicated for scalability and prevent data loss. This has the unfortunate side effect of distributing your resources and data throughout a cloud provider’s environment making securing your data even more challenging. A critical step before moving to a cloud based solution is defining accurate business requirements, determining what data is within scope of those requirements, and planning on how to protect that data once it resides in the cloud. Protecting data in the cloud requires a multi-faceted approach with encryption playing a vital role. Controlling access and ensuring the security of data between users and data centers is critical to leveraging a virtualized environment.
Expect the Breach
The demands on IT staff, employees, and partners for the safeguarding of Personal Identifiable Information (PII) is an ever growing concern. Penalties for data breaches can range from fines and lawsuits, to loss of business. Further losses to the business can result from having to disclose data breaches, thereby reducing credibility and increasing costs to recover from the breach both internally and in the public’s eye. It is vital to have a tested game plan ready if a breach occurs so that staff can respond appropriately. Being proactive and prepared enables companies to respond quickly and limit the damage.
Be Proactive
If there is one common thread to defending against these threats, it is taking a proactive approach to security day in and day out. Security breaches are on the rise and organizations of all sizes and levels of sophistication are struggling to secure sensitive data. Sony, Target, Home Depot and Anthem all had sophisticated security products installed. What they did not have was proactive action. Investing in security products does not equal protection, protection comes from being proactive before a breach occurs.