Technology Adviser: Is it Time to Rethink Your Cybersecurity Strategy?

The last two years have forced businesses to adopt new work flows, policies, and procedures to remain competitive. With this transformation comes an increase in cybersecurity risks. Laptops, desktops, mobile devices, and even employees are vulnerabilities that traditional solutions like antivirus and firewalls cannot fully protect.

Changes in how we work have shifted a focus to the development of enhanced security solutions designed to protect the new business user. Businesses large and small are combining modern security tools with ongoing cybersecurity training to achieve a viable cybersecurity plan. By focusing on the two largest risks factors, employees and endpoints, organizations can improve their overall security posture while significantly reducing risk

The modern cybersecurity plan starts by securing your endpoints with software that is built to defend against today’s threats. Endpoint Detection & Response, or EDR, unifies prevention, detection, and response using machine learning and automation to quickly identify and remediate suspicious activity.

To put it simply, EDR is a more sophisticated and modern antivirus that is specifically designed to combat Ransomware.

While computers and other user devices are the most vulnerable attack vectors for a cybercriminal to exploit… they are not the most common target. Digital credentials such as usernames and passwords used to access your corporate network and cloud resources are a much more valuable prize. Employees are constantly bombarded with clever phishing attempts aiming to steal their credentials and use them for illegal access or sell them on the Dark Web.

Your company does not have to be hacked for your credentials to be found on the Internet. When a large company or website is breached, often millions of usernames and passwords are stolen in the process. Cybercriminals know that people often use the same password for personal websites as they do at work. A modern cybersecurity plan must include Dark Web Monitoring to scan and alert for stolen employee data before it can be exploited.

An often-overlooked tool to protect business data is change management. Most businesses use change management to document and audit planned changes. However, when used as a security tool, change management policies can alert IT departments to suspicious activity. For example, when a cybercriminal gains access to a victim’s mailbox they typically create inbox rules that will manipulate incoming and outgoing email to better disguise their presence. The longer the attacker has access to the inbox, the more costly the attack becomes. With change management as part of a business’ cybersecurity defense, suspicious inbox rules will be detected upon creation and steps to mitigate the breach can be implemented immediately. The ability to identify malicious changes to access permissions, mailbox rules, and administrator accounts quickly limit the damage of a successful cyberattack. 

Along with protecting hardware and digital property, organizations must eliminate as much human error as possible with a focus on strengthening their staff’s cybersecurity skills. Cybersecurity awareness and competency should become a standard requirement for employment. Research shows that human error is a factor in 90 percent of all data breaches.* 

Employees are constantly exposed to sophisticated phishing and social engineering attempts and must be trained how to recognize and respond to these types of attacks.

Ongoing training and testing of staff members can improve cybersecurity aptitude and simulated phishing attempts will identify those prone to clicking where they shouldn’t.

By analyzing these behaviors, businesses can strategically provide additional training to mitigate the risks of malware, data loss and cyber theft. This approach to employee training and testing has shown significant results across all industries and sizes of organization. On average, companies that implement ongoing awareness training reduce their risk of a successful email attack from 40 percent down to just 5 percent within 12 months.**

When combined, these tools and concepts create a strong cybersecurity foundation for any business. Cyber threats continue to evolve and become more sophisticated, demanding that cybersecurity standards follow suit. It’s critical for business owners to understand these modern threats exist and start a conversation about how they can improve their defenses.

We like to say that the best time to talk about cybersecurity is yesterday, the second-best time is today.  

Sources:*https://ico.org.uk/

**knowbe4.com