7 steps for more cyber security

This form of cyberattack already so popular that it is even offered as "ransomware-as-a-service," where you can assemble your own personalized ransomware on the Tor network, with those behind it demanding commission on the extortion proceeds, writes Barracuda Networks.

To improve cybersecurity, the company recommends seven steps:

1. cyber security as a matter of corporate performance and compliance
Cyber security is often viewed as an IT-only issue, so executives often have little insight into proven security standards and risks. Moreover, without experts on the team, it is all too often left to ordinary IT personnel to take care of the extensive field of cyber security, but IT security requires a centralized approach with clear responsibilities. Key individuals, most notably members of senior management, must champion the issue to enable a company-wide decision-making and employee culture focused on confidentiality of customer data and good data management. An initial professional risk assessment is essential in this process to identify specific threats and implement solutions. This process should include an accurate assessment of the direct costs associated with a security breach, as well as its impact on the entire organization. To do this, work with specialists and use managed services to accelerate the implementation of security best practices and technologies. Specialized providers can help identify potential vulnerabilities and develop a thoughtful strategy to protect against cyber attacks.

2. implementation of security best practices
Establish concrete guidelines for the email, web, collaboration, social media, and other tools used in diverse workflows. Make sure these guidelines include legal and regulatory requirements for encrypting email content that contains sensitive data. Furthermore, monitor or control the use of personal mobile devices such as laptops, tablets or smartphones (BYOD) that are used to access company systems. Instruct your employees on which tools and applications they should use to access corporate resources. For example, prohibit the use of third-party data sticks or software on company infrastructure.

3. measures for monitoring and prevention
Implement systems to detect and eliminate phishing and ransomware attacks. Monitoring software should provide extensive visibility and enable IT teams to scan mailboxes regularly and trace threats to a specific device. Preventive measures should also be taken, including scanning for vulnerabilities in web applications as well as existing spyware and using advanced tools to detect a compromise.

4. data backup
A disaster recovery plan is critical to business continuity. Therefore, review your backup procedure to ensure that data can be recovered across platforms. This way, you ensure that you have a consistent mitigation strategy in place. Cloud-based backup systems, for example, are suitable for cost-effectively mapping the requirement for offsite backup in the event of a disaster.

5. data encryption and cloud security
A comprehensive security plan should also include advanced approaches such as data encryption rules to protect private data storage and cloud-based backup systems. Also included are heuristic scanning tools to detect commands that may indicate malicious activity, and cloud-based system emulators that open and examine files in a sandbox to protect systems from the risk of malicious attachments.

6. sensitization of the workforce
There's also a lot to be gained by raising awareness among the workforce, as cyber criminals tend to target the easiest target on the network - the user. Email is one of the most common gateways for numerous types of attacks, but many employees struggle with information overload, so the likelihood of them thoroughly checking their mail for phishing is low. Promoting security awareness is a key part of improving protection. The findings of a recent report by Osterman Research confirm that companies with well-prepared employees are less likely to fall victim to a spear phishing attack. It is important to hold regular training sessions on how to deal with fraud or email attacks, good email practices, and safe Internet browsing behavior.

7. keep your systems up to date
All applications and operating systems should be regularly checked for security vulnerabilities and updated with the latest patches from the respective vendors. Edgescan found that 63 percent of all vulnerabilities could have been fixed with a security update.

Source: Barracuda Networks