Rethink IT Security Strategy for the Digital Future

Cybercriminals are constantly finding new ways of hacking into company networks and stealing data and, as a result, protecting those networks and data resembles a game of chess – an effective defence strategy needs to take into account the moves of the adversary, in this case a hacker. However, while chess moves at a pace that gives both sides time to think, the security game is dynamic and its rules may change unexpectedly.

What kind of threats are networks and company data exposed to?

Reading reports of yet another data leak or learning about the enormous number of theft attempts (more than 800 million in 2018), one may only feel confused – how can we know what a hacker will do? It’s impossible to predict with 100% accuracy. Luckily, we can single out a number of trends, or the most common methods of attack that cybercriminals use:

• Phishing – stealing data by using fake websites
• Social engineering – users receive fraudulent emails from people posing as, for example, company IT admins, asking for login details and passwords to company email accounts or websites, allegedly to provide (better) protection or update data
• Wi-Fi hacks – cybercriminals take advantage of poorly protected routers to penetrate company devices and gain access to a company network.

What does a hacker do once they get into a network? In addition to stealing company files including sensitive  information, they may also use malicious encrypting software (ransomware) to hijack attacked devices. They encrypt files and then demand a ransom from the victims in return for a decryption key. The costs are usually very high, and there is no guarantee that, even if the ransom is paid, the criminal will actually transfer the key.

Such attacks are frequently carried out via company mobile devices, especially if these are used by employees for private purposes, or if a company implements a BYOD policy. Computer worms can get into a device when, for example, a user checks their private mail, spreading from there into the company network once the device is connected.

How to protect oneself effectively from cyberattacks?

To prepare an effective line of defence, it’s crucial that we understand the vulnerabilities of the company network. This is no easy task, and works best when entrusted to an expert company. Security specialists won’t make any far-fetched guesses as to where an attack may take place, but will rather use their own tools to identify any infrastructural vulnerabilities and carry out penetration tests to simulate a hacker attack and assess its potential outcomes. One such specialist company is Comarch, which provides comprehensive IT audit services tailored to any given company’s needs. Not only do the audits involve IT infrastructure verification and security testing, but they also aim to assess protection of personal data in connection with data bases, in line with legal requirements.

Once an audit is completed, company security can be benchmarked against the desired state. There are usually many system-related issues that need to be resolved as soon as possible. Moreover, if a business relies on data obtained from payment card holders, it needs to bring its security levels into compliance with the PCI DSS standard. How does an organization adopt a strong line of defence? Naturally, by removing all gaps identified during the audit and by eliminating vulnerabilities. The task requires expertise, so should be entrusted to experts who know how to implement security solutions that will effectively protect businesses against attacks without compromising the effectiveness of the company network and its devices. Keep in mind that any solutions currently in use may prove inadequate. If this is the case, completely new solutions should be considered. Experts conducting audits will certainly be able to provide advice on the optimum solutions adapted to individual company needs.

The human factor is also important

According to a study conducted by Small Business Trends, employee negligence or carelessness caused 48% of data leaks in 2018 worldwide. Additionally, Xopero Software reports that, in January 2019 alone, over 40% of Polish businesses were exposed to data threats by their employees. Thus, no matter what software and hardware solutions companies use, cyber-education for employees is equally important and should be a staple of company IT policy.

An employee who is aware of threats and risks means half the battle against malicious attacks is won, especially if we consider that phishing campaigns are more and more often targeted at specific companies. Employees must know that, when they get an e-mail saying “Invoice” or “Sales contract”, they first need to check the identity of the sender. For a malicious attachment often turns out to be the snowflake that starts an entire avalanche, bringing the whole IT department to a standstill.

How to determine an effective organization security strategy?

An effective security strategy can only be defined after an audit is completed and vulnerabilities are eliminated. It is recommended that both testing and strategy definition are entrusted to recognized specialists, such as the aforementioned Comarch. Many years of experience, knowledge of the most advanced technologies and 24/7 availability make Comarch a trustworthy partner for everyone who wants to ensure the highest level of security and protection against the latest threats.

The original article has been published at https://www.computerworld.pl/news/Rethink-IT-Security-Strategy-for-the-Digital-Future,412458.html