A new year begins with opportunities to mitigate threats and reduce risk for your company, plus protect your assets. Rather than predicting doom and gloom for IT, here are five security recommendations for 2014 to help you improve your network security:
1. Educate Users – Targeted attacks and social cons profile users to lure them into attack kill chains. Threats using lures of fake surveys, free gifts, fake photos, plus email notifications for shipments, payments and taxes should be understood by all. Continue the educational process with contests for employees to submit possible lures and awarding the best finds. People are curious about attacks and how crimes operate, just look at a weekly TV schedule for an overload of police and detective shows as evidence.
2. Remove Java – Reduce your risk profile by removing Java from end user systems. Few, if any, popular websites require it. However, you may find a legacy web application that requires an older version of Java for operation. If this is the case, then use a separate browser that is Java-enabled with specific bookmarks for this web app only. Everyday web browsers for end users should not be Java enabled.
3. Data Back-ups – Ransomware (e.g. Crytoplocker) is on the rise and cybercriminals are making millions infecting systems and demanding small sums of money to provide the keys to recover data. Payment may or may not recover the data and also marks your organization for a follow-up attack. Regular data back-ups will remove this threat, financial impact, and nuisance to operations.
4. Encrypt Customer Data – 2013 had its share of stories about cybercrimes accessing customer data that was stored unencrypted and often within an arms reach from a public facing web server. While your jurisdiction and industry may not have compliance regulations to protect customer data, the impact on your company brand, customer loyalty, revenues and partnerships could be damaging. Unfortunately web services continue to be laden with exploitable vulnerabilities and internally compromised systems are a given. Assuming 100% security to protect unencrypted customer data is a losing bet in 2014.
5. Continuous Security Monitoring – In addition to your AV, Firewall and Web Filtering, deploy or employ continuous security monitoring of inventories, software, apps, network devices, exploitable vulnerabilities along side traffic analysis for anomalies and signs of infection. United States, United Kingdom and Australian security experts recommend critical security controls with continuous monitoring to subvert 80-90% of attacks. Security is not an audit, report or one time inspection; continuous security cycles will improve security and lower risk in 2014.
Near the top of list we also ranked restricting admin rights from users, moving beyond simple passwords, white listing applications for users and groups, plus providing enterprise apps for data movement between devices. Beyond these network security recommendations, what else can you recommend for 2014?