4 Essentials to Secure Your Business Even From State-Sponsored Online Threats Malicious foreign governments are a potent threat but every business can afford to harden their systems against cyber attack.
By Peter Daisyme Edited by Dan Bova
Opinions expressed by Entrepreneur contributors are their own.
Recent online security breaches and attacks have left the business and technology communities in a turbulent state regarding the strength of their security. While we may talk for hours on end about the attacks perpetrated by skilled individuals, small groups of hackers and very lucky "script kiddies," it's equally important to consider that some national governments are cyber-attacking foreign businesses. These attacks are often politically motivated, better planned and more dangerous than attacks by private entities.
China has admitted to having a "cyber army" of sorts, which may have been responsible for the recent DDoS attack on GitHub. North Korea is the alleged perpetrator of the attack on Sony Pictures Entertainment, purportedly as retaliation for the film The Interview.
It is difficult for businesses, especially small ones, to ward off attacks from monolithic entities such as state institutions but they can take concrete steps to reduce the risk of attacks from both private and government entities. Here is some advice from security experts and top executives from security companies with years of experience protecting businesses from such threats.
Related: 5 Lessons Leaders Can Learn From the Sony Hacking Scandal
1. Knowledge is power.
"When a breach occurs, there is a period of time during which the affected organization has no idea what happened. If you know who is accessing your database, the discovery process becomes simpler. The ability to monitor your own data places you in a position where you are more equipped to handle breaches rapidly should they ever happen." – Marc Gaffan, Incapsula General Manager.
As you gain more visibility into the "who" and "what" of your data infrastructure, you can tell if an attack is external or internal, then take the necessary actions to prevent any further breaches. Make sure that all access points are covered and monitored at all times. The fewer people who have access to the most sensitive data you're housing, the less likely is a breach in those areas. Don't allow more people than absolutely necessary access to records of who is tapping into the access points.
In short, if can track your information flow, you make it easier to prevent breaches or address one in the event of a hack.
2. Rein in your cloud apps.
"It is so simple right now for an employee to create an account in a cloud application that creates a blind spot for organizations. All a hacker needs to do is to compromise that one account to gain access to sensitive data that would have otherwise been stored in a more secure environment managed by the organization the data belongs to. Knowing what your employees are doing with your data outside of your own infrastructure is key to preventing breaches caused by negligence. With cloud app gateways, you can view all the unsanctioned apps that your employees are using, giving your IT staff visibility into possible risks. If you're going to venture into the cloud, make sure you have an audit trail that shows every footprint" - Ofer Hendler, CEO of Skyfence.
Applications in the cloud offer unprecedented convenience, but they are a danger if not managed correctly. By adopting or creating a gateway that vets these applications, you gain perspective into the risks that allow you to draft comprehensive security policies. IT blind spots expose your customers and employees to potential breaches that can compromise the integrity of your organization.
Related: Lessons from Anthem: Make Every Employee Part of the Cyber Security Team
3. Small data mistake can have serious repercussions.
"People forget that employees can leak data from home or mobile devices. This has become a dramatically larger problem since the dawn of social media and the entrance into the workforce of a generation of people who grew up oversharing on social media. Technology implemented at the perimeter of an organization does not do anything to prevent these types of leaks, so standard data leak prevention (DLP) solutions are often insufficient." – Joseph Steinberg, CEO of SecureMySocial.
Endpoint protection is as important as securing central infrastructure or technology assets. As can be proven by the massive breach at Sony Pictures, all it took to get into the company's IT systems is a poorly maintained email account with a weak password. With the prevalence of social media and telecommuting, employees are a soft target for malicious entities who are experts in social engineering. The risk is particularly high for employees maintaining active public profiles on social media or who regularly access sensitive content from their personal smartphones, tablets and laptops.
A strong security policy must include mobile devices. Proper endpoint protection must include security policies, procedures and training so employees comply with the policies, even in their private activities. "No technology can deliver security if people undermine it," says Steinberg. "Failure to properly design an overall program is going to leave holes that can – and likely will -- be exploited by nefarious parties."
4. Small businesses are most vulnerable to competitors.
"The use of insidious cyber criminal methods such as DDoS attacks on small businesses are unlikely to be State-sponsored attacks. Small businesses are most vulnerable to targeted attacks fuelled by competitors or hactivists as they use cheaper hosting and do not allow for the added protection against DDoS attacks or hacks. As an example, you can hire a hacker on the black market for as little as $20 a day and the hacker will DDoS "anyone you want' repeatedly. This is commonly used as a practice to nullify a competitor by destroying their search engine ranking and thereby increase the prominence of the competitor's online presence. A severe hack could wipe out the entire database of an online store or brochure website and, as has been seen, many small businesses have not even allowed for backups of their online assets. The result, a destroyed online presence and the competitor or vested interest moves to their next target. - Brook Zimmatore, CEO of Massive Alliance.
Today, it is imperative that small businesses research and integrate solid security solutions which mirror what the big corporations are doing. There are affordable options which will deter and block the most common exploits and attacks from interrupting your online assets and local systems. Common sense solutions would include,
- Ensuring you have firewalls in place on your website and your company systems.
- Using IP restrictions and "black IP blockers" to ward of the most common attacks.
- Anti-virus and anti-phishing solutions integrated into mail and company servers.
- Strong BYOD (personal device) policies.
These basics are the foundation to effectively protect your online and offline assets, your employees and consumer data.
Every wall should be built on a solid concrete foundation. If you plan to do business with the world, focusing on security helps build a trusted brand. The many businesses suffering breaches now is evidence of how little attention they paid to this one aspect of their operations. You can help change this status quo by adopting smart strategies and solutions that protect you and your customers.
