A Solid Cyber Security Strategy Lowers Risk of a Data Breach

When we think of security these days, it is no longer limited to physical crime.  Cybercrime is on the rise and putting an alarm in your office, hiring physical personnel, and having a sign-in process will no longer suffice as protection for your organization. Securing your IT assets is critical and implementing a solid cybersecurity strategy that combines training and awareness on how to protect corporate and customer data combined with cyber security tools are critical. According to the Ponemon Institutes 2016 Cost of a Data Breach report, a data breach will hit a company’s bottom line by about $4 million.

There are a few ways that organizations can lower the risk of a breach. There is no particular priority assigned to them, as all are important.

Implement and enforce strong password policies. It sounds simple, but in fact this is often not a priority, but it should be. According to Verizon’s 2016 Data Breach Investigation Report, 63% of data breaches involve weak, stolen, or believe it or not, default passwords! Passwords should be a minimum of eight characters, contain upper and lower case letters, numbers, and at least one special character. They should not be reused, and should not be dictionary words or contain any portion of a user’s personal information. They should be changed regularly. Security professionals recommend this be done quarterly at least.

Multi-factor authentication (MFA) can help significantly. This is particularly true if you have a mobile app for your customers, clients, or even vendors. Companies without MFA features for their mobile apps are four to nine times more likely to be affected by rogue applications and are more prone to phishing attacks than those that do have it implemented.

Implement and enforce privileges. There is no need for everyone to have full access to everything on the network. Create roles and assign users to them appropriately. This is particularly important for access to files within human resources, finance, accounting, and other departments that work with sensitive and confidential data. The fewer people that have access to the information in those types of departments, the lower your risk of it getting into the wrong hands.

Log and monitor logins and activity. There are tools available that will do this. It will allow you to see who is inside the network and from where. This is especially important if you allow remote work or have vendors or third parties that log into your network. These are a favorite way for hackers to get inside. This is how it happened at Target and CiCi’s Pizza, as well as many other companies. This also allows for easier analysis should you find yourself needing to find out who is inside that perhaps shouldn’t be.

Segment your network. Isolate and encrypt sensitive data and keep it separated as much as possible from other network segments. This adds an additional hurdle should a hacker end up inside the network.

Create, practice, and follow an incident response plan (IRP), should it be necessary. Take time to draft a plan that includes clear roles and responsibilities of the incident response team members. Make sure to update it at least annually and whenever a team member or information changes. Don’t forget to include contact details for reaching team members after regular business hours.

Regular security education and awareness for everyone who connects to your network. This includes employees and third parties. Humans are still the weakest link when it comes to data breaches and malware making its way onto the corporate network. Therefore, a solid and comprehensive training program should not be pushed aside. Don’t forget to test on it so you know where improvements are needed.

Hopefully, these measures are already part of your cyber security strategy. If not, it’s a good time to re-asses and get them in it. It’s a lot less expensive to do it now, than to pay for it in cash and reputation later.