PCR Tech and IT retail, distribution and vendor news
As PCR continues to look at everything to do with security for November’s Sector Spotlight, we hear from Kane Hardy, EMEA VP for Hexis Cyber Solutions, who offers up his top three security tips for businesses.
1. Assume you are already compromised
For too long, the majority of security spending has been invested in signature prevention solutions, which fail to detect sophisticated, targeted attacks inside the network. Once a threat has bypassed perimeter defences then it is free to roam undetected and achieve its goals.
Savvy organisations are now accepting the reality that they have already been compromised and are planning to introduce new systems or processes that address the ‘response gap’.
The ability to provide persistent and consistent correlation of threat intelligence from within the network and actively respond to it is where existing protection is lacking at both the network layer and endpoints.
2. Protect your assets from inside and out
Organisations should encrypt data while it remains active and in use, especially if it is personal in nature.
This approach can be effective in protecting data, even if the network is compromised. Any unused user accounts should be removed quickly and accounts should be managed to ensure that employees do not have access to any user data. These steps help to protect against insider threats.
As for dealing with the daily onslaught of outsider threats, more consideration needs to be given to investing in security budgets to protect from within our networks rather than perimeter focused technology.
All organisations should be making an investment in a next generation integrated detection solution that can identify the more advanced targeted attacks – the ones that are capable of extracting information from multiple points in the network. Cyber hackers are using advanced, automated tools that attack network perimeters relentlessly.
By having a solution in place that can analyse what is happening and actively respond in real time, it is possible to actively defend the network. If your organisation is short on security professionals, there are solutions available through a managed security service to ensure your business isn’t compromised.
3. Educate, educate, educate
Educate the workforce through best practice approaches towards unexpected emails and links – treating those from both unfamiliar and familiar users with caution. For example, the majority of exploit programmes come from content-delivered attacks; java and browser exploits cause the most headaches as users find themselves accidentally downloading malicious code from a few simple clicks.
Similarly, phishing, spear phishing and whaling through email – the most ubiquitous method of communication – is a quick and easy way to breach a network, often involving very little investment from the exploiter. When the cost of not properly training your employees about cyber risk is potentially so high, it makes sense to invest in an ongoing awareness programme, in order to keep pace with the constantly changing threat landscape.
Throughout November, PCR is running a dedicated Sector Spotlight on Security – Click the logo below for more articles
