Whether it is ransomware, malicious insider attacks, advanced persistent threats, or any other form of cyber-attack, cyber-criminals are getting smarter. Any business that has sensitive data—which in reality, means all businesses—is a target for cyber-criminals. This means the risk of an attack is no longer a matter of if, it's a matter of when.
Despite organisations spending more on cyber-security, and their confidence in their cyber-security readiness, research has revealed that 71 percent of organisations surveyed have been the victim of an attack in the past 12 months.
So, in an age where cyber-attacks are increasing, how do organisations make themselves harder to hack and ensure their confidence in their security isn't misplaced?
While the concept of layered security isn't a new one, (in fact, it is as old as IT security itself), it doesn't make it any less relevant today. What is important to IT security today, however, is choosing the correct layers. Your layered security approach should be constructed of multiple layers across the length and breadth of your complete IT environment.
This will help protect your business against the inevitability of an attack. And if done correctly, it will buy you the time you need to effectively respond to an attack and mitigate the risk of a potential breach.
Adding layers to security can be done in a number of ways:
More devices, more visibility
The more connected devices within your IT network, the greater the risk of compromise. Having network visibility gives you the power to scan and count all devices within your IT environment and spot any anomalies. Security event monitoring of this kind is actually a cost-effective way to perform meaningful analysis and proactively protect your IT infrastructure and the data it holds.
Ultimately, with more visibility of your network, you will be able to quickly spot cyber-criminals before they do any damage.
It's all about the policies
Web protection is another crucial layer of security for your business, as it provides a window into controlling, monitoring and enforcing your web policies for internet access, email, or web chat.
But rather than having policies in place at the device level, having one, central policy that can be edited and scaled across the complete range of devices within your IT network will help you to apply website filtering by time or content, perform bandwidth checks, as well as protect your business against its legal liabilities.
Patch with caution
While scanning for potential cyber-attacks and having policies in place will help, with new vulnerabilities being exposed on an almost daily basis, you won't be able to keep up with them all with just these two layers. And although patch management won't prevent zero-day exploits, it will help you to stay protected.
But patching should be taken with caution—you should only patch when you know it is safe to do so. Patch management isn't just about knowing when patches are available. It's also key to know that they are stable. Reading security news sites will help to keep you informed. After all, adding an unstable patch without prior testing could do more damage to your bottom line than the exploit it's trying to prevent.
Encrypting what matters
While all businesses will see a vast majority of their data as important, when it comes to encryption, it is best to encrypt the data that really matters to you. Data encryption is often viewed as too complex or too expensive—but by encrypting the most valuable data, you should be able to make the process a lot simpler.
Whether that is firmware encryption on smartphones and tablets that is built into the OS, or using hypertext transfer protocol secure (HTTPS) to protect information and ensure only secure sites are accessed, if your valuable data is encrypted strongly enough, it will be beyond the abilities of most hackers.
Make strong passwords simple
Many employees will regard ‘safe' passwords as little more than a hassle rather than an obstacle. But having a mature authentication policy in place can be a simple yet effective way to stay protected.
It's easy to see why having strong passwords can be a chore—any password that is lengthy, complex, and random enough to be classified as a strong password isn't easy to remember. Add one or two more of these into the mix, and staff will default to simple passwords, and no doubt use the same password for everything!
Password managers offer a solution to this problem. By generating secure passwords and managing these in the cloud, employees won't have to remember a multitude of cryptic puzzles. To ensure you are truly secure, add two-factor authentication, like a smartphone app-generated password, to add another layer and ensure you have a mature authentication policy in place.
Don't forget to delete
The last layer of security is usually the least considered in the process—secure file deletion. Hitting delete doesn't necessarily mean that data has been removed and is no longer a security concern. It's still possible to retrieve that deleted data very easily, very quickly, and very cheaply.
If you have gone through the effort of encrypting your most valuable data, you should apply the same importance to its removal as well. This means using secure deletion tools on individual files or folders to ensure that cyber-criminals can't trace something you thought was no longer a worry.
Making it harder for cyber-criminals to win
IT security isn't something that should be taken lightly—but for many businesses, ensuring the right protection is in place is no easy feat. While layered security is important, choosing the right layers to implement is key; it means you can protect what's important, take a proactive approach to breaches, and ensure that all measures in place are helping you to stay secure and not compromising your business.
As cyber-crime continues to grow in sophistication, an in-depth defence might not guarantee complete attack prevention, but it can go a long way to ensuring you are harder to hack—and buys you the valuable time you need to respond in the best possible manner.
Tim Brown, VP, Security Architecture, SolarWinds MSP
*Note: The views expressed in this blog are those of the author and do not necessarily reflect the views of SC Media UK or Haymarket Media.