Data loss and theft are serious matters for any business with digital assets such as customer information and applications. The reality is that something from as simple as a mistyped command on a production database to a malicious hack can result in catastrophic losses for a business.
Consider for example how Gitlab lost six hours of unbacked-up customer code just because a new developer made a mistake. More than the actual and potential monetary losses, the said incident had badly affected the startup’s reputation among customers.
Backing up data is only one aspect of disaster recovery. While the cloud does offer redundancies and business continuity features, it pays to be doubly safe and secure when it comes to protecting business data and ensuring its integrity.
The important thing to consider when securing your organization‘s data is to implement both active and passive security measures, both within your organization’s infrastructure and individual members. Here are a few words of advice you should heed.
Stay Up-to-Date
Malicious hackers are always on the lookout for security loopholes that they can use as attack vectors in either gaining access to your system or distributing their malicious code and apps. One such attack vector involves zero-day exploits or unpatched vulnerabilities. Software developers try to keep up by releasing regular patches and updates that will solve these multiple issues (along with new feature releases, of course).
Keep your operating systems and other applications updated, as this can help reduce the risk of being attacked through unpatched vulnerabilities. If you are using cloud-based applications, coordinate with your service provider whether they are pushing out regular updates across their infrastructure, too.
Deploy Active Protection for Your Assets
Web and application servers are a popular target for malicious hackers because these are always online, and always accept traffic and requests sent from the internet at large. Thus, there is also the risk that hackers can find security vulnerabilities on your server itself, or the applications that reside in it.
The same goes for client machines used within your organization, such as employee laptops, smartphones, tablets, and other devices. You can secure these devices with capable antivirus and anti-malware applications. Meanwhile, you will need to deploy a web application firewall for your server, which actively blocks potentially harmful traffic, including malicious code, cross-site scripting attacks, SQL code injections, among others.
Secure Your Local Infrastructure
With all the data and digital information that resides on either the cloud or your local servers, it is sometimes easy to overlook the physical aspect of security. This means potential attackers can easily access your company‘s data and information through physical or similar means.
For example, if you have weak Wi-Fi encryption, or if you do not use secure Wi-Fi networks, then anyone within range can easily snoop into your network, eavesdrop on traffic, and potentially gain access to information while it is in transit. In the same light, anyone with USB storage such as a USB stick or even a smartphone can easily plug into a local computer or laptop and gain access to information from there.
Another potentially overlooked security vulnerability involves employee devices — both devices brought in through BYOD (or bring-your-own-device) policies or company devices taken out of the workplace environment. In these cases, a laptop or smartphone can be easily misplaced or stolen, for example. If this falls into the wrong hands, unscrupulous individuals or groups can extract data from the storage or use saved passwords to gain access to your systems.
In this case, you will need to have a way to remotely wipe data from employee computers and devices in the event these get stolen. Such services are offered to both enterprises and small organizations through Microsoft Exchange and Apple‘s iCloud, for instance.
Educate Your Organization
Another oft-overlooked aspect of security is the human aspect. Again, the chain is only as secure as the weakest link. And if your employees are not aware of their responsibilities as users and members of your organization, then they might easily fall victim to attacks like scams, phishing, ransomware incursions, and the like.
Part of this education is making sure your employees know what to do and what not to do when using their devices and accessing applications. For example, educate them against entering information without verifying the identity of the website they are accessing. Warn them against opening email attachments, even if these are just images (these can contain metadata that can potentially harm networks and computers). You will also need to be aware of possible social engineering attacks from faked email addresses and fake social network profiles.
Also, warn them about accessing the internet through insecure connections like public Wi-Fi networks. And since we have already discussed keeping up-to-date, this also includes all members of the organization — make sure they keep their devices and applications updated to prevent the possibility of exploits through unpatched vulnerabilities.
Use Secure Authentication
Another aspect of education, of course, is the use of strong passwords. There are different schools of thought with regard to using passwords. Some security experts say that forcing everyone to change passwords too frequently might mean they will have a hard time memorizing their passwords and will write their passwords somewhere, which defeats the purpose.
At the very least, ban the use of dictionary word passwords, and include special characters and cases in your passwords. If you have shared company accounts, it will be a good idea to use a password manager instead of individual passwords, so that employees will only need their master password to access digital apps and assets.
Another thing to consider here is the use of two-factor authentication, which can significantly increase the security of user accounts. This means that even if their password were to be compromised, their accounts will not be accessed by just anyone, since 2FA will require a separate one-time password generated by either their authenticator app or sent through text messaging.
Stay Abreast of Security Trends
Security is an ever-evolving field. Every day, there are new vulnerabilities being discovered and exploited. There are also new methodologies being carried out by attackers, especially in doing social engineering attacks. The responsibility of keeping up-to-date and using the best tools and measures to improve the company’s security usually falls upon the Chief Information Security Officer or IT manager, although it should be everyone’s responsibility to keep themselves updated and to keep everyone in the loop when it comes to digital security and safety.
