360-degree approach is key

August 2019 Cyber Security

The numbers are seemingly terrifying. According to Fortinet, there are over 300 new Zero Day threats and over 140 000 new malware programmes out there, while their security products worldwide are helping to resist 545 000 network intrusion attempts and over 300 000 botnet command & control attempts - every single minute.

Mayleen Bywater

While this growing number and complexity of cybersecurity threats toward business, and the ensuing breaches, continue to make headlines around the world, the news coverage of the resulting attacks often tend to focus on larger corporations that are household names. The reality however, is that all businesses are at risk, regardless of their size, popularity or how much they make.

As long as a business has confidential customer records or financial information stored on their network, they are a cybercrime target; hackers know how to exploit any and all weaknesses, and organisations need to take a 360-degree approach to security if they are to sufficiently protect themselves.

Policies and procedures

The starting point for any organisation has to be setting the right policies and standards that makes security by default a priority. This encompasses conducting a comprehensive risk assessment, the setting of guidelines and procedures, who manages security responsibilities, who has access to information, data governance, setting up training and awareness programmes for staff, and ensuring overall regulatory compliance.

Developments in technology have popularised cloud computing, remote working, bring your own device (BYOD) and more, meaning that security cannot be seen or addressed in isolation; the organisation has to take a holistic look at their network, emails, endpoints, vulnerability, and business continuity.

From a legacy perspective, a company network is the first port of call for any attacker, as this is what breaks out to the internet, and a breach has the potential to compromise your entire organisation. In this case, it is important to have a reputable firewall between your network and the rest of the internet in order to stop hackers ‘at the gate’. Having the right products here can further help your organisation better manage available bandwidth, as well as set up proper access control and user management.

The email threat

But the latest threats don’t target networks, but rather emails, which almost every company employee has access to. With improvements in security technology, humans have been left behind as the most vulnerable of gatekeepers.

Statistics show us that 90% of emails being sent have some sort of malicious intent (malware, phishing attacks, and more), with 70% of those leading to a secondary attack on your network. These forms of email attacks are becoming increasingly personalised in order to appear genuine to the end user, and it takes just one compromised email to bring down your entire network.

With a growing number of employees preferring to work from home or remotely, or by using their own devices (laptops, tablets, smartphones and other smart devices), companies need to have a firm grasp of the endpoints that are accessing their network and data. They need to carefully control user management, ensure these devices are secured, as well as have an understanding of which users have permission to access and modify what data. Your security should be able to detect and take immediate action if an employee tries to connect an infected device to your network.

ackup and business continuity

Despite all these precautions, security as a whole is still not foolproof. If any of these defences mentioned above are compromised, and you don’t have a proper backup system in place, you will not be able to restore your business in a timeous manner, and risk suffering from further damage to your brand and reputation.

Your business could even end up being held liable if it was found that it did not have the proper systems and procedures in place to store, manage and safeguard customer information and other personal data.

Apart from properly maintaining their security infrastructure and software, businesses need to ensure their security policies are still valid, as these need to be continually updated to match the evolving threat landscape. You cannot comprehensively mitigate today’s cybersecurity problems with policies from five years ago.

Skills, education and awareness

To do all of this however, you need to have the right skills in place if you are to secure your network and data, and this is a challenge facing many South African companies. While larger organisations can prioritise security at the C-Suite level and have internal IT staff to maintain network and data security, and ensure that security policies are crafted and adhered to, smaller businesses do not have this luxury - and this is where a managed service provider (MSP) becomes vital.

The right MSP can manage and maintain your security infrastructure, ensure policies are up to date and being adhered to, and that best practices are being applied across the organisation. They should be able to alert you to developing situations, provide a comprehensive report and review of the attempted/successful breach, and put in place measures to remediate the fault.

Lastly, it is important for companies to remember that while they can spend millions on network and data security products and solutions, a human employee that does not understand the security posture or culture of an organisation remains the biggest risk, as all it takes is a click on the wrong link. They need to be continually educated, and brought into the fold to be part of your security defence measures.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Check Point appoints new regional director for Africa
September 2019 , News, Cyber Security
Check Point Software Technologies has appointed Pankaj Bhula as regional director for Africa.

ISO standard for protecting personal data
September 2019 , News, Cyber Security
Tackling privacy information management head on: first ISO standard for protecting personal data has been published.

The hunt for the Carbanak group
September 2019 , Editor's Choice, Cyber Security, News
Tomorrow Unlocked has released a free four-part documentary that tells the story of the notorious Carbanak APT group and its $1 billion bank heist.

Preventing data breaches in small and medium businesses
September 2019 , Cyber Security
To minimise the likelihood of a data breach, companies should hire dedicated cybersecurity specialists, make sure their data is well encrypted and segmented, and only provide limited access to it.

Building automation vulnerable to hacks
September 2019 , News, Cyber Security
New vulnerability revealed in Internet-connected building automation devices at the DEF CON IoT Village that could impact critical building systems.

Threats spread to IM, collaboration tools
September 2019 , Cyber Security, Residential Estate (Industry)
The average office worker now spends up to 80% of their time using collaboration tools, but many lack adequate security.

Becoming more cyber-savvy within the OT environment
September 2019 , Cyber Security, Industrial (Industry)
Organisations running operational technology (OT) have increasingly come under cyberattack, with malware sending shockwaves through these sectors.

Cybersecurity requires a new approach
September 2019 , Cyber Security
From digital transformation through to the arrival of the Fourth Industrial Revolution (4IR), decision-makers are changing their views on how technology can benefit the organisation.

Inundated with cyberattacks from all directions
August 2019 , Editor's Choice, Cyber Security, Security Services & Risk Management
IT managers are inundated with cyberattacks coming from all directions and are struggling to keep up due to a lack of security expertise, budget and up-to-date technology.

Under cyberattack
August 2019, Kaspersky Lab , Cyber Security, Residential Estate (Industry)
Cybersecurity is not something one usually associates with residential estates, but the threats from cybercriminals apply equally to estates as they do to businesses and the individual homeowner.