Is your company prepared for the worst?

No one could get ahold of Charles. Charles was the CEO of the company, had over 250 employees, and no one had heard from Charles in two days. He had been on the trip of a lifetime. He was going to hike the Smoky Mountains by himself for the first time.

He would just be gone for the weekend. The company would be okay for two days, right? But now it was 4PM, and Charles had not returned. On Monday morning the company experienced a ransomware attack. The employees had to return home because their key cards would not open the doors. Many employees noticed that they hadn’t been paid. Due to the data attack, paychecks hadn’t been submitted. The employees and managers were starting to panic.

Charles had always been a planner. He had prepared for just this moment. Everything was backed up and safely encrypted should his company ever experience a data attack. He had safely stored his backups off site and protected it with a password that only he knew. Everything would be just fine!

Except, no one could get ahold of Charles. He was two days late returning from his trip, and his family hadn’t heard from him.

Charles had all the right puzzle pieces in place should a disaster hit… All except one: him. He hadn’t prepared for the extreme circumstance of him not returning, and now nothing could be done.

8 Steps to Ultimate Cyber Security (Part 2)

1 – Continuity Planning

A business continuity plan (BCP) is a document that will outline how a business will continue operating should an unplanned disruption occur. It is more in depth than a disaster recovery plan and contains strategies for business functionality.

If your business suffers damage through a natural disaster or if the company owner suddenly passes away and there is not access to important codes or documents, your company could be in hot water very quickly.

• Backup Person. If you are the sole owner of your business, and you handle vital information that no one else in your company handles, it is especially important for you to find a trusted person or place for this information. Should anything ever happen to you, you want your employees and business taken care of.
• Operations. You want to ensure your company can function under any circumstance, whether that is digitally, physically, or through off-site operations. Creating an extensive backup plan for all these scenarios can bring you back online before other businesses around you may be able to.
• Recovery. How do you recover information should a huge disaster occur, like a ransomware attack? You want to have a clear and quick backup plan should a huge disaster hit your data. It is particularly important that you have a step-by-step process for every department of your company should any disaster occur. You want to anticipate the worst, and then plan accordingly.

2 – Update Management

Update management is a crucial step in your cyber security. Prioritizing consistent updating and security control protects you from fatal data incidents.

• Devices. All devices on your network should be consistently updated, such as laptops and company phones.
• Applications. Applications on your network should be consistently updated and checked for breaches.
• Servers and Routers. All your data moves through your routers and servers. You want them to be always running at top tier capacity to ensure your security.

3 – Encryption

Encrypting your data brings you better security. Encryption is converting data or valuable information into code. Once it is encoded, it requires a password to read the encrypted data.

• Why can’t I just password protect my data or device? Why isn’t that sufficient? Well, if you have not encrypted your data, then the right person could potentially tear the drive apart digitally and still retrieve that data. However, if it is encrypted, the likelihood of a hacker retrieving that data is remarkably close to impossible.
• Encrypted data storage and transfer. When you encrypt data before transferring, it will protect it from any potential weak areas in a network system. If a hacker has infiltrated your system, they still would not be able to see the encrypted data passing through your system unless they have the key to unlock access to it.

Encryption is also good for:

• Web Browsing. Browsers and websites use HTTPS to encrypt and secure website communications.
• E-Commence. Encryption is often used with digital processing of funds, especially with chips embedded into our cards. The chips should be encrypted by the financial companies to secure your financial data.
• Messaging. Messaging apps can encrypt messaging data to secure private conversations from unwanted eyes.

4 – Penetration Testing/Security Audit

A penetration test is a security audit. This is how to test and see if your security systems are utterly secure.

A company that you hire will simulate several different cyber-attacks on your systems to see if they can withstand penetration. They may attempt to penetrate computers or laptops. This could begin with just attempting to log in to your systems through testing password strengths but can go all the way to phishing attempts or checking your physical building security.

Areas you may want to test:

• Network Infrastructure. Attacking a business’s network infrastructure is often the first type of penetration test. It will focus on internal infrastructure. The test can focus on a network’s external infrastructure, like breaking through weak, configured, external firewalls.
• Web Application. Web applications may have unforeseen overlap, often with network services. Businesses will use more web applications for their businesses to function. Many of them are very intricate and publicly available. A lot of the external attacks will be composed of web applications.
• Wireless. A wireless test will look for vulnerabilities in wireless networks. A wireless test exposes insecure wireless networks and weak authentication. Unprotected or updated protocols along with weak configurations could cause a hacker to breach a wired network remotely.
• Physical. Businesses will want to do a physical pen test that focuses on the physical security of their building. The attacker will attempt to gain access to the building or find misplaced papers or credentials that can be used to break through security.

5 – Training

When identifying risk factors and vulnerabilities in your system, it is imperative that management determines a priority list of what to protect, how to protect, what implementing those protections looks like across the facility or company and making sure that each employee understands the risks – including that all devices and passwords are protected by top security measures.

• Priority Information. Information will go through specific hands and transitions. It is particularly important that it not pass through those who are not qualified or designated to handle them. Creating a protocol for priority and sensitive information ensures that only the correct people see and handle those documents. Training your staff to know the protocols that sensitive information goes through is imperative to the safety and security of those documents.
• Upper Management Knowledge. Ensuring that the highest level of executives within the facility know the protocols and security measures that need to be implemented into the facility is vital to success. Upper management needs to be educated in the processes of security within the company and deliver clear communication of security protocols through each level of the company.
• Training Staff. The most crucial step of all is training all staff in security measures and standards. Safety at its base level must be prioritized to ensure quality assurance and understanding of security expectations. Taking the time to fully educate all current and incoming staff members of important non-negotiable security standards is the biggest step for success.
• Credentials. Credentials and special accesses must be properly designated at security level. Assuring that all credentials are reserved for the correct individuals and access is not commonly shared among a group of staff. Everyone should have separate and secure credentials and access to specific information based on their authorized level.
• Employee Security Measures. Build a culture around your staff to hold security of information as a top priority. Ensuring that all employees are using two-factor authentication (2fa), a password keeper, and being wary of phishing emails, creates tighter security around confidential information.

6 – Security Assessments

Security assessments are an exercise to test the security preparedness of a company. This includes checking for vulnerabilities in your IT systems and business processes. Security assessments are also helpful toward keeping your systems up to date.

• Security Review. Prepare a list of all potential threats that your business could face. Investigate your past experiences and the past experiences of companies around you. Identify any gaps in your system.
• Security Testing. Security testing helps you discover weaknesses in the security strength of your networks and other IT systems. You can conduct security testing along with your reviewing process.

7 – Threat Detection

With detecting and preventing threats, speed is imperative. Your security program must be able to detect threats efficiently so hackers do not gain access to crucial information. A business’s security processes can typically prevent the majority of attacks if they are known threats that the network has encountered before. Businesses need to be on the lookout for unknown threats that they may have never seen before. Hackers may be using different avenues to attempt to gain access to your systems.

8 – Network Monitoring

When it comes to the importance of network monitoring, it’s important to know what network monitoring brings to the table:

• Discover. When beginning the process of network monitoring you want to learn as much about the network as possible. You want to know about the devices, servers, firewalls, etc.
• Visualize. It is important to be able to visualize your network so you can better understand its processes. Network monitoring systems will create network maps. Network maps show us a structured visual representation of the different devices on our network, how they are connected, and up-to-date information.
• Monitoring. Using discovery and visualization tools, we are now able to monitor activity on our networks, along with bringing in added information in real time.
• Alert. Network monitoring systems alert system administrators when something goes wrong, paving the way to quicker resolutions.

Here at DataCom, we can help you prepare your data to be protected so that your business continues to run smoothly despite any cyber-attacks or unexpected life changes. If you would like to know more, please contact us through our website at https://www.datacomtechnologies.net/contact.