Cyber threats are more common than you think: protect yourself with tips from the experts

Ransomware attacks occurred every 11 seconds in 2021.

Yes, there’s a very real threat out there, but we’re here to tell you that it’s possible (and easier than you might think) to protect your business and your data.

This blog post is full of actionable tips to keep you safe.

10 cybersecurity tips from the experts

1. Remember the 5Cs of cybersecurity

The 5Cs are the five most strategically important areas to focus on if you want an effective cybersecurity solution.

Change

In cyberspace the only thing that’s constant is change. Developments in software technology and in the world of business can accelerate in such a way that gaps can be left behind. This creates a weakness or blind spot within infrastructures that hackers can take advantage of.

SaaS security platforms provide one solution to this problem. As this model is subscription-based, all you need to do is sign up for the monthly fee and you receive the benefits of an ever-evolving, fully comprehensive option, without the need for extra staff or hardware.

Compliance

If you run a business or company, you need to ensure that staff have guidelines to follow that structure their working methods. This is needed to safeguard information that could be used maliciously by cybercriminals.

For example, the following two improvements can be easily rolled out by better work policy compliance:

• Training staff to spot suspicious emails so that they don’t open and respond to them
• Preventing sensitive information from being leaked to people outside of a department.

Cost

Depending on your budget, there are many different avenues to go down. The most scalable method is the SaaS model, as you simply pay for the protection that you use. But as you’ll see from our comprehensive comparison guide to different cybersecurity solutions, MDR is actually the most cost-efficient option.

Continuity

In the event of an unforeseen disaster, and your operations are shut down, what can you do to retrieve data and minimize downtime?

Previous solutions included back-up computers, data storage, and recovery locations. But these can be expensive and likely run off an internal network that may prove difficult to access in a disaster situation.

Whatever modern approach you take to cybersecurity, you want to ensure it utilizes back-up storage centers that kick into action if primary storage centers are compromised, making your data super safe.

Coverage

When a business becomes successful, it usually branches out and expands geographically. This is also true of the services that a business might offer: they evolve. If demand is high, then it’s likely that your business needs to grow at a similar rate to match the demands.

If expansion occurs and resources become stretched, you need to make sure that vulnerabilities aren’t exposed.

XDR provides protection over all of your endpoints, no matter how distributed they are.

2. Avoid the “things are secure enough” mentality

Continuing from our point that the cybersecurity landscape is in constant flux, feeling like you are safe with what you have may make you complacent. Before you know it, you’re left behind with little to no resistance to attacks.

The biggest companies in the world invest in up-to-date cybersecurity programs. It’s a good idea to follow their lead.

3. Keep hardware and software up to date

There are usually three motives behind software updates: to resolve bugs, to bring in additional features, and to strengthen security measures — something that global logistics company, Maersk, overlooked and suffered “the most devastating cyberattack in history” as a result.

Security solutions upgrade at a rate that matches the threats, for obvious reasons. If you have increasingly old hardware, it’ll make compatibility with newer cybersecurity packages much more difficult. Older hardware may also no longer receive security updates to its firmware.

Similarly, older hardware will be slower and less capable of responding to breaches than newer counterparts.

4. Use a VPN to privatize your connections

Virtual Private Networks (VPNs) offer greater protection from hackers as they’re encrypted and harder to access than regular public internet sources.

They can be used to prevent data logging, eavesdropping, and data sharing so you don’t leave a trail of information that can be used by criminals.

VPNs remove the need to expose application servers and other network resources publicly, reducing the attack surface of the organization by only having one externally visible connection point, rather than many.

VPNs have been used to better protect systems that don’t have native MFA. In some cases, organizations are now replacing VPNs with SASE (Secure Access Service Edge).

A lot of modern cloud services (mostly SaaS in this case) have sufficient security controls to obviate the need for VPNs or separate SASE.

If you need to make a remote connection back to a service inside your company network, always use a VPN.

5. Increase the layers of security in the network, and supplement the security protections offered by cloud providers

Examples of security layers that you can incorporate include:

• Firewalls - These act as a first line of defense. They analyze incoming and outgoing data and block anything that is not deemed a trusted source.
• Patches - These are software and firmware fixes that ‘patch’ over vulnerable points in your system. Security updates may also be included in larger software updates. Again this reiterates the importance of keeping your system up to date.
• Multi-factor authentication (MFA) - You may have encountered this when entering a password to access an account that you have. For example, it’s when a site requires an additional bit of information such as an access code that’s sent to your phone, to further authenticate your identity. More advanced MFA systems use authenticator apps on your mobile phone.

Cloud-based services can also be a handy way to supplement your security measures. Using their storage systems as a way to back up your data is a smart move and enhances your protection level.

6. Strengthen endpoint security

Endpoints are typically end-user devices, such as laptops and mobile phones, which allow users to connect to networks. They can be places of weakness for cybersecurity because they are often overlooked by companies that quickly expand. The increase in working-from-home has highlighted the importance of bolstering endpoint security, as workers are no longer working in a location protected by a company firewall.

A solution for this is to use firewalls and VPNs to protect your endpoints. You can also invest in XDR — Extended Detection and Response.

7. Evaluate third-party risks

Working with third-parties such as clients or vendors can lead to unintended gaps in your defenses — especially if your client doesn’t take care of their side of security management.

It’s advisable to have a system in place for evaluating the security of third parties that you work with, so you can spot potential gaps that could place your business at risk. Certification against standards such as ISO27001:2013 requires significant time and investment, but are worth it for big organizations. When it comes to card payments, partners must be PCI DSS compliant while it’s SOC2 compliance you want to check with service providers.

8. Evolve past multi-factor authentication (MFA) with risk-based authentication (RBA)

While multi-factor authentication provides a layer of security, it does mean that there’s another step for consumers to have to go through. This can lead to lower conversion rates, as it can be a hurdle that creates friction and puts people off.

Risk-based authentication (RBA) will streamline conversion as it only applies additional authentication when it thinks that there’s a genuine need, arising from unusual behavior.

9. Protect against internal threats as well

Staff members can inadvertently become the source of a breach by using USB devices that aren’t encrypted. If the USBs are lost, the data stored on them can compromise the security of an organization.

When sharing files, your workforce may choose to use a medium that they are familiar with, such as a personal email account, over a platform that’s provided by your business. This is due to personal familiarity with a platform; the worker may feel that they can get a task done more efficiently using a way that they know well. However, this has the potential to jeopardize the security of your business as it’s difficult to monitor such methods.

Ensure that all devices are encrypted and that staff members use the platforms that are deemed safe by your organization.

Useful industry-standard cybersecurity courses for staff include:

• Cofense PhishMe
• SANS Institute
• Proofpoint Security Awareness

10. Back up!

Of course, backing data up is also an effective measure to protect your organization. There are many ways of doing so that are easily available such as cloud or external databases.

A prominent threat faced in the world today is ransomware. Hackers will steal your information and only return it once a ransom fee is paid.

Knowing that you’ve got your sensitive information in an additional safe place, means that you’ll be insulated from this risk and won’t be blackmailed into paying off criminals. Just make sure your backups are protected too:

“Attackers can still tamper with your backups. You want to make sure that your backups are immutable and can’t be changed.” - Gregory Garten, CTO at NTT Security Holdings