Information technology systems and software continue to increase their footprint in today’s businesses. Advancements in Internet and cloud services, automation, integration, and application intelligence enable greater organizational productivity for the same or even reduced spend compared to years past. Unfortunately, not all technology development is driven by good intentions.
Information security problems also continue to grow and evolve -- typically at speeds that far outpace their well-intended counterparts. The need to understand threats and incorporate technology defenses continues to increase as well. This has created a challenging scenario for organizations of all sizes and at all points in their growth and development.
Therefore, business leaders need to understand the importance of how to build a secure IT infrastructure in order to defend against rising cybersecurity threats. Whether starting a new business or evaluating your current organization, business owners need the right IT perspective.
Today’s top two organizational technology tools -- email and web -- are also the top two threat actor attack weapons. According to the 2020 CrowdStrike Global Threat Report, in 2019, 49% of attacks were from Malware and 51% of attacks used more sophisticated, non-malware techniques.
Email thrives as a threat actor’s primary weapon, carrying 92% of today’s malware and 96% of today’s phishing. Websites rank a close second and offer yet another way for threat actors to inject malicious code into your machines and, as a result, your corporate environment.
While every organization needs good malware protection software, this protection is only the first of many needed lines of defense. The most prevalent computer compromises leverage unauthorized access to valid accounts and passwords alone are no longer a secure mechanism for controlling access.
Putting up safeguards against these attacks should be a high priority to secure your business. Fortunately, there are ways to reduce risk and exposure.
Build a Secure Infrastructure to Protect Your Assets
Consider these five keys to build a secure infrastructure that shields your IT system from cyber-attacks.
1. User Education
- Work with your employees to help them understand what to look for and how to identify malicious or phishing emails.
- Pay attention to misspelled company names or odd-looking email suffixes. For example, receiving an email from someone at Micorsoft.com vs. Microsoft.com.
- Teach employees to reach out to the IT team BEFORE they click on an email they suspect may be a phishing attempt. If possible, leverage products and services such as KnowBe4 to introduce phishing campaigns and training to your organization.
2. Email Security
- Invest in an Email Security Gateway, which is designed to protect your emails against hackers, spam, malware, and viruses. Many of these solutions are less than $4/mo per user.
- These tools will aggregate and analyze billions of data points on a daily basis and many will offer a safe “sandbox” to launch and scan attachments prior to rendering them in your actual production environment.
- There are many competitors in this space that target SMB up through global enterprises. A few options include Proofpoint Essentials, Mimecast Secure Email Gateway, Barracuda Essentials, Sophos Email Security, and Microsoft ATP.
3. End-Point Protection
- Before you can protect your hardware, you need to know what hardware needs to be protected. Ensuring that your organization has an asset management capability / program will allow you to first understand what you have so that you know what to protect.
- After identifying your assets, it is important to keep them updated via security patches and firmware updates. These updates may need to be scheduled outside of normal business hours in order to minimize impact to your business and to allow for adequate post-update testing.
- Implement password hardening measures. At a minimum, there should be some requirements around password complexity as well as a defined cadence in which users must change their passwords.
4. Multi-Factor Authentication (MFA)
- MFA is based on the premise of “something you have and something you know.”
- The “something you have” could be your laptop, iPhone, Android, etc.
- The “something you know” could be your PIN, fingerprint, hard token, etc.
- The banking and credit card industries have done this for years. As a consumer, you were given a debit / credit card (“something you have”) and asked to set up a PIN (“something you know”). A threat actor would have to have the actual debit / credit card AND know your PIN in order to access your account. The same concept should be considered in your organization to protect your assets.
- There are many players in this space as well: LastPass, RSA, SecureAuth, etc. Forcing fingerprint scanning, facial recognition, and / or PIN numbers to access smart devices (and especially your email applications on those devices) is built into more current technology at no extra charge.
5. Controlled User Privileges
- Eliminate end users from having administrative privileges. If they must have administrative roles due to the nature of their jobs, then create a separate admin or “a” account for them to use when they need to function with elevated credentials.
- Provide access to only those folders and files that end users need to do their work.
- There is no question that this can be tricky to pull off, especially if this introduces new behavior into the organization. This will require some work to ensure the proper file structure is in place. (For example, Accounting files are in an Accounting folder and not spread throughout multiple folders.) This may also require communication and change management to help the organization understand why these changes are happening.
Contingency Planning: Prepare for “When,” Not “If”
Despite your organization’s best efforts, attacks and phishing attempts will happen. Threat actors are not targeting only large organizations, rather they are inundating the Internet and attempting to find the ones without safeguards in place.
It is becoming easier for novices to arm themselves with tools to launch attacks, plus MaaS (Malware-as-a-Service) and other similar services are on the rise. Most small to mid-size companies don’t have the resources to combat the barrage of attacks and even after implementing several defense options may find that their company is still at risk and not 100% secured.
To offset that risk, we encourage your team to consider some of the suggestions above. In addition, there are a few additional items to consider:
- Ensure your data is backed-up and that those back-ups are tested. Also, you should understand the process and time to recover that data BEFORE the need arises. You should also work with your application vendors to understand how quickly applications could be restored or reinstalled.
- Develop an Incident Response plan. At a minimum, compile a list of contacts and an escalation path for your IT team, business leadership, key business users, application vendors, etc.
- Conduct periodic assessments and reviews of your IT posture. Hire an objective third party to evaluate your systems and processes and understand areas you can improve.
Using a computer connected to the Internet today is analogous to walking alone through the streets of a big city. If you are not prepared, you may find yourself missing money, identity information, or the ability to function depending on your path.
Computer and software tools come with more than operational responsibility and budgetary considerations. Knowing how to use a computer and its software is not enough. Computer systems today also require information security tools, software, and services to maintain a healthy operational state and to protect the information they transmit, store, and process.
Find IT Infrastructure Support from NB Business Solutions
NB Business Solutions (NBBS) provides IT leadership for business owners seeking support with their IT infrastructure. We will come alongside your company to support the audit/analysis, provide input on vulnerabilities, evaluate security strengths and weaknesses, and identify other IT issues to consider as you build a secure IT infrastructure to protect the integrity of your business and business data.
We offer flexible IT solutions that are scalable to the size of your business -- whether a mid-size company or a global organization that needs IT support across the enterprise.
Contact NBBS today to discuss how to build a secure IT infrastructure and how we can help ensure that your business is ready to defend itself against the growing threat of cybersecurity attacks.