Month: February 2016

Ever since the internet rose up from the mists of nowhere, security breaches have been a source of big news, terrifying news. Whether it is the likes of Yahoo being hacked, or Election Results being tampered with, hacking scandals seem to be rearing their ugly heads more often than not. We read story after story about security leaks and each one ends with the same paragraph, the same foregone conclusion; businesses and business leaders need to up their game when it comes to protecting the sensitive data they hold. That is the common message from security experts, and yet so many businesses still don’t prepare themselves properly. Because they have been targeted and affected, they don’t take it seriously enough to seek out the weak links in their business, research the most recent trend in threats, and thus fail to protect themselves and their clients/customers from any breach.

Don’t believe us? Well, the recent State of Risk report concluded that a majority of businesses – big and small – have not invested in a system that will protect, control and track the sensitive data they have been entrusted with. The majority have no or only a partial, system in place. Trust us, if Yahoo is struggling to hold their defensive line against hackers then, chances are, you are going to struggle too. That’s why it is imperative to invest in security. Put it this way, the average cost incurred by a cyber breach on a small or medium sized business is £325,000.

I thought that would grab your attention.

So what preventative measures can you take? How do you best protect yourself and your customers? How do you make sure you are doing all you can to prevents a security breach? How do you stop your sensitive data getting into the wrong hands? Well, we have conducted thorough interviews with security experts to hear what they say, and have compiled a list of the most common areas of weakness in most businesses.

1. On The Go Tech

In the early 90s and before, a data hack would mean someone would have to hack into your servers or break into your premises in order to access your sensitive data. But these days are gone, and data theft has been made so much simpler by the rise in mobile technology. Simply put, mobile devices increase your vulnerability and thus increase the risk. Of course, mobile devices are a must-have for all employees these days because it increases flexibility and productivity, and reduces the issue of wasted time and resource. However, the more your employees use these devices to share data and access your servers or fail to change their passwords, the more risk you are at. In fact, mobile breaches account for almost three-quarters of all breaches, a rise that mimics the rise of the bring your device to work policy that so many companies are embracing.

As such, it is imperative that you renew your BYOD policy so that it carefully spells out certain rules and expectations. This will better educate your workforce on the risks. A great way to make this more effective is to relate security breaches at work to the risks they face at home; make it relatable to personal risks like using ATM machines. You should also ensure that you have the capabilities to better monitor mobile devices. This way you will be able to quickly pinpoint any breach or any weakness.

2. Uneducated Employees

We don’t mean uneducated in terms of schooling, we mean uneducated regarding security, and that means your training program is letting them down. But, yes, all too often your employees are a security risk. It could be that employee leaves their laptop on a table in Costa as they nip to the bathroom, or a smartphone gets left on the subway, or in a taxi. All of these pose serious threats to your security. But it is not just about exposure outside the office. Too many employees are not educated on the importance of a strong password, what constitutes a strong password or how often they should change their password. This leaves you exposed on the inside. The same goes for training on what to look out for when it comes to suspicious emails.

Cyber attacks have got more and more sophisticated. The phishing techniques have improved, spear fishing is now called upon, unauthorized websites are now able to install malware without the user knowing, and all of these pose a serious threat to both your systems and your data. That is why training is so important, and regular training too, as this will allow you to renew their understanding as different trends arise. A great way to do this is to approach digital learning companies who have experience in this kind of training. This will offer you a cost-effective means of training that is not just interactive and engaging but offers an audit trail too. They will know how to teach your employees about passwords, phishing, keylogging and much more.

3. Inside Jobs

It is hard to say exactly where an internal attack originates, but it is typically unhappy or disgruntled employees. What’s more, these account for a seriously high number of breaches. Of course, any inside attack will require in-depth knowledge of your IT systems and will require someone to have access to all areas of your network, which is why most inside attacks come from within the IT Department. A disgruntled employee working within IT support can create a huge amount of problems.

How you can prevent this weakness is a challenge, but it requires mitigating any chance of employees in this sector becoming disgruntled. This is not always possible, so it is crucial you identify all those that have access to all areas of the server, this way you will be able to act quickly should an event happen. Another step should be to terminate access to anyone that no longer works within this capacity as soon as possible.

4. The Cloud

The most effective way to protect all data that is stored in the cloud is to encrypt any access at ground level. Different experts suggest different encryption software, but all suggestions usually represent the gold standard in this field. We can’t stress enough the importance of investing in this kind of security. Since the cloud first originated, a high proportion of cyber attacks have been made possible by companies not using data level encryption devices to protect data stored up high, so make sure you invest well and invest fast.

5. Third Parties

There are a few reasons why outsourcing has become more and more attractive. It is cost-effective, it frees up resource time, it allows experts to address what is becoming a more and more complex area. It could be you outsource the maintenance of your server, or your point of sale system, or a myriad of other things. However, while they may be experts in protecting you, third-party providers sometimes don’t follow best-practices themselves. It may be they use one password to connect to all of their clients, for example, which poses a threat should that password be hacked.
As such, you should always ask as many questions as you possibly can. Make sure they follow the best practices of remote access security, and enforce stringent policies for their workforce to uphold, and use sophisticated authentication techniques to ensure there are unique credentials required for each user. The other step you must take is to know which third parties you are using and then terminate their access as soon as their contract runs out or as soon as they no longer require access.