Conventional wisdom on mitigating security risks is based on the foundation of defence; building a secure network with impenetrable points of entry. It is usually a policy formed around the risks posed by common threats from malicious content like malware, viruses, spam and DDoS attacks. Whilst a solid security strategy should not ignore these real […]
Conventional wisdom on mitigating security risks is based on the foundation of defence; building a secure network with impenetrable points of entry. It is usually a policy formed around the risks posed by common threats from malicious content like malware, viruses, spam and DDoS attacks. Whilst a solid security strategy should not ignore these real and present dangers, it is only by taking a proactive approach to these risks that you can help reduce the prospect of an attack. As importantly, it can also significantly enhance your ability to recover from exposure to one.
So, what are the four key areas to mitigating data security risks and malicious attacks in your organisation?
Protect High Risk Individuals
Every organisation has individuals who hold key access to critical areas of the business, whether this is holding a senior position or a having a vital role within a department. Spear phishing is increasingly becoming a mode of stealth attack by which criminals target these individuals in BEC (Business Email Compromise) attacks.
Using social media and other online sources of data, attackers often employ a casual approach to gain the trust of the user before defrauding them. The subsequent fallout of a breach of this kind can be varied but typically extends to a user sharing personal information, log-in credentials or even erroneous transfers of money.
Mitigating against a risk of this kind is essential to avoid exposing your business but can be delivered through solutions like Barracuda Sentinel. This comprehensive cyber-fraud solution offers:
- DMARC authentication to provide alerts and actionable reporting on the use of your domain.
- Real time spear phishing and BEC protection using AI to provide intelligence on potential attacks.
- Simulation training for key individuals to test security awareness using simulated fraud attacks.
Prepare the People
Of course, access to your network and your data is not restricted to just a handful of individuals and the risk of an attack and breach is shared by all. Cyber attackers know only too well how to exploit the weakest link in an organisation and email remains one of the most vulnerable parts of any business’s defences.
Combining Barracuda Sentinel with the PhishLine platform offers greater levels of defence in an organisation by offering training and simulations on social engineering attacks. Targeted vector threats will remain one of the highest risks in any business unless you empower the people with the knowledge and tools to guard against email-borne attacks.
PhishLine provides customised training to end-users that is both engaging and relevant to deliver the skills necessary to recognise threats from multiple sources. Users can then analyse, test and report risks giving your organisation extra layers of human defence as well as providing an automated anti-phishing program.
Proactive Management
Although end-users and email remain two of the most vulnerable elements of your defence strategy, there are many other areas which pose a potential risk to attack. For most organisations, this will be most prevalent across the applications and websites that are in use.
The challenge for many security professionals is in balancing the requirement for agile deployment alongside assessing and remedying vulnerabilities. This is most evident in rapid application development within cloud platforms like Azure and AWS.
Research undertaken by WhiteHat security in 2016 revealed that as many as 86% of websites had at least one ‘serious’ vulnerability. The likelihood of information leakage from these vulnerabilities was calculated as being 56%. With the average time to fix these vulnerabilities being 300 days the amount of exposure that this represents to your organisation could be costly.
Proactive and comprehensive assessments (and remediation) of the security of your apps and websites is essential in order to avoid infiltration and data breaches.
Preserve Your Data
It is widely acknowledged that recovery against malicious attacks is an inevitable part of the cyber-security landscape and organisations ignore the importance of preserving their data at their peril.
A robust data backup and recovery plan is an essential component of any security strategy.
Solutions like Barracuda Backup provide cloud or private off-site locations to duplicate your data in a secure environment allowing you to isolate attacks at source and restore your data from a clean backup.
The future of security is not just about building walls to keep attackers out, but the combined approach of having lookouts to see them coming as well as a damned good field hospital to help you repair when they, inevitably, get through your fortifications.
