The war in Ukraine is troubling in numerous respects, including the threat of cyberattacks. U.S. President Joe Biden recently warned that intelligence suggests Russia could launch attacks on U.S. infrastructure. He urged U.S. businesses, especially those that provide infrastructure services, to immediately prepare for this possibility by prioritizing cyber defense.
For this reason and for many others, now is a good time for all companies to perform security audits, make needed improvements, and develop plans for future enhancements. If you haven’t done much to improve your cybersecurity, the process may seem overwhelming. Breaking it up into steps can help. In the following sections, we provide suggestions for smaller actions to take, which are applicable no matter what your cybersecurity is like now.
Understand the Problem
One of the first steps to promoting effective cybersecurity is understanding what you are securing against. The following descriptions outline three of the most common types of attacks.
- Malware. Malware means malicious software, and it can come in the form of viruses, worms, trojan horses, and spyware. For example, a piece of software could be disguised as legitimate software. But once a user launches it, it infects the computer, diminishing its functionality. And the virus can spread to other computers on the network.
- Ransomware. With ransomware, which is also a type of malware, the perpetrator essentially holds your data for ransom. After using software to gain access to your files, they demand payment, often in the form of cryptocurrency. If you don’t pay it, they may not only keep you from accessing your data but also release your proprietary information to the public or a competitor.
- Phishing. Phishing is a play on “fishing”, as in “fishing for information.” In this scenario, the cybercriminal uses various ploys to trick users into divulging sensitive information. For example, they may send an email that looks like it’s coming from a company executive requesting account numbers or passwords.
All of these attack types require the cooperation of someone in your company. For example, ransomware is downloaded when a user clicks on a link from a hacker disguised as a legitimate request. Cybercriminals are adept at making their requests look real, so a big part of cybersecurity is training employees on what to look for. The following video describes additional methods for addressing these threats.
Test Current Systems
To determine the best ways to protect your data, you must first know your vulnerabilities. Perform an audit to find out how easy it would be for a hacker to penetrate your systems. If you don’t have someone on staff who can perform this testing, consider hiring an ethical hacker to help. Don’t forget about devices you might have added recently, such as Internet of Things (IoT) sensors, which create new pathways for attack.
You should also test your employees to find out how savvy they are at recognizing phishing and other types of cyberattack attempts. Software and services are available to regularly send false attempts and track how many workers take the bait.
Once you have performed testing and identified possible risks, prioritize these vulnerabilities to determine which ones to address first. Then, set a regular schedule for testing, identifying attack vectors, and updating your plan (see below).
Develop a Plan
Based on the testing you perform, you should get a sense of which systems or features are the most vulnerable to attack. Create a plan, timeline, and budget to address each one.
Part of your plan should be specific steps for what to do in the event of a ransomware attack, which is more complicated than it may first appear. If you pay the ransom, you lose a significant sum of money and there is no guarantee you will be granted access to your data. If you don’t pay it, you end up “paying” in terms of the lost time and money it takes to retrieve your data, not to mention your diminished reputation. Consider these matters carefully when creating your plan.
Additionally, make sure your plan includes work from home (WFH) action items. While remote working can accelerate efficiency and employee satisfaction, it can also increase cybersecurity risks since employees don’t necessarily have access to the best network equipment and IT support.
Shore Up Defenses
By following assessment and planning, you’ll be ready to take action. While each company’s list of activities will be unique, here are some possible steps you might want to take.
- Update software. Make sure systems and software, especially antivirus software, are up to date, including patches and security updates.
- Institute or improve password management practices. For example, you could create rules about password complexity or require employees to use a password manager.
- Use multifactor authentication (MFA). Even the most complex passwords aren’t enough to protect devices and applications any longer. MFA requires the use of a secondary process to gain access.
- Back up data. This step is critical because any kind of cyberattack will likely destroy or block access to data. Ideally, both onsite and offsite methods should be employed. Periodically test the backups to be sure you can retrieve your data if needed.
- Train employees. As mentioned above, employees are often the first line of defense against cyberattack attempts. Yet this aspect of cybersecurity is often overlooked because of the expense. But rigorous training is worth it when you consider the potential expense of a data breach.
- Hire additional experts. If your IT team is stretched too thin to perform assessments, create a plan, train employees, and deploy additional strategies, consider hiring additional staff, outsourcing, or hiring a vendor to work with you temporarily to get your cybersecurity up to speed.
The Importance of Data
In today’s world, data is one of the most valuable assets a company has but many businesses fail to adequately protect it. Doing so could involve many more tactics than we’ve discussed here, and you should thoroughly research options to determine which options are right for your industry and company.
