Major breaches like the recent Magecart attack and the infamous Equifax breach are ominous reminders that our company’s data is constantly at risk to a multitude of different attacks. A couple of common reactions from businesses include company-wide security seminars, a quick email reminder for company security processes and other solutions aimed at informing everyone at once. Although large-scale solutions like this can help put security into perspective, there are day-to-day things businesses can do to bolster their company’s data security. Unfortunately, a lot of these tasks remain overlooked.
There are lots of disregarded cybersecurity tasks that leaders at all levels sometimes fail to notice or consider taking on their plate. A major mistake lots of companies commit is resting their entire organization’s security on the cybersecurity team (or similar). A business’s security is everyone’s responsibility and different employees can more effectively carry out certain tasks than others based on their position.
As the person at the top of a company, the CEO holds a lot of power to encourage things like company-wide cybersecurity plans. The CEO can relay the importance of threats through to other C-suite executives and, in turn, the rest of the company. Putting cybersecurity at the forefront of everyone’s mind starts with the top.
Plan For Attacks
Every company is at risk for a cyber attack regardless of size and industry. In fact, more than 53% of companies experienced at least one cyber attack in the last 12 months. The best thing a CEO and other senior leadership can do is enforce cybersecurity training at all levels by assigning resources to cybersecurity processes, tools and anything else necessary. This ensures a decreased response time when attacks do occur and lowered impact on business operations.
Create a Response Plan - When data breaches and leaks happen, company executives must be prepared on all fronts to respond to it. These breaches not only affect those in IT but can potentially affect many (or all) departments in a company and require a combined effort across all sectors. For example, the IT and security team must work together to track down and fix the problem, the COO and others on the team must find a way to continue business operations despite the setbacks from the breach, and PR must be kept in the loop with all things so they can handle crisis communication with customers, external stakeholders, the press and countless other people who may be affected.
Ransomware is an attack becoming increasingly common for hackers to use. These attacks are growing more than 350 percent annually and are devastating to a company. This type of malware blocks access to computer systems and data until a ransom is paid out. Putting in precautions in place and having a response plan handy can mitigate the chances of this and other types of attack occurring while also giving employees peace of mind if an attack does happen.
Understand Risk in Financial Terms - The average cost of a data breach is predicted to exceed $150 million in 2020. To make cybersecurity planning more efficient, create a cyber risk registry to prioritize risk by their financial impact.
Make Cybersecurity a Priority for the Entire Organization - $1 trillion globally will be spent on cybersecurity through 2021, so many companies are rapidly investing in cybersecurity to both prevent and recover from attacks. CEOs and senior leadership should implement KPIs to track cybersecurity efforts.
Disregarded Cybersecurity Tasks for Managers - Managers are in direct contact with both senior leadership and with direct reports, so they’re in an interesting spot to relay security objectives and protocols from the top and send up any feedback or issues they observe from their direct reports.
Implement New Technology and Involve Technical Individuals in New Purchases -- Managers should stay in-the-know with rising cybersecurity software to see what solutions would bring the most value to the company as a whole. Cybersecurity trade conferences are a great way to see what’s new and what’s changed in the cybersecurity space.
Thirty-eight percent of technology purchases are managed, defined and controlled by business leaders so cybersecurity savvy team members can help inform smart and relevant security purchases.
Pay Attention to Internal Employee Behavior - Seventy percent of cyber incidents are a result of internal vulnerabilities, so managers have a particularly important role in monitoring any suspicious activity. This includes dangerous behavior that is both intentional and unintentional. Internal hackers and leakers are dangerous if left undetected since they can easily access and abuse sensitive files.
Unintentionally dangerous behavior stems is a result of uninformed employees and a lack of clear guidelines. Encouraging safe practices like properly locking up workstations at the end of the day and discouraging the use of personal devices at work can go a long way.
Incentivize Good Behavior From End Users -- Since managers are work directly with a lot of people on the ground level, it's important for them to help implement a culture of safe security practices. This includes incentivizing good behavior instead of relying solely on negative feedback. Cash bonuses and team-wide recognition are a few ways managers can encourage safe behavior.
Disregarded Cybersecurity Tasks for Security Professionals - Even members of the security team can overlook major and minor tasks that affect overall security. From general cybersecurity hygiene to end-user friendliness, security professionals can do a lot of things to keep security tight and help make cybersecurity practices easy for their non-technical team members.
Remove Stale Accounts - With accounts in various cloud services, some ex-employees may be able to access information even after they’ve left the company. To keep file access under control, add “removal of all accounts” to the list of offboarding activities for each employee that leaves the company. Although this seems obvious, 76 percent of folders in a company still contain stale data. Security professionals can also enforce VPN-access when possible.
Limit User Access - Twenty-one percent of all folders in an average company are accessible by every employee. This grants hackers several opportunities to access sensitive data since they can essentially hack any employee to gain access to those files. Security professionals should limit access by classifying data according to confidentiality and only granting access to relevant personnel.
Make Cybersecurity Easy for End Users -- The best cybersecurity plan can fail if it impedes business operations or is otherwise difficult to implement. Security professionals should look into what processes can be automated to make it less time-consuming for end users.
For example, security teams can enable Domain-based Message Authentication, Reporting, and Conformance (DMARC) to reject spoof emails that pop up in employee inboxes during attempted phishing attacks. Small automation like this can go a long way since it eliminates the unnecessary risk that could cost millions. Phishing attacks, in particular, increased 65 percent from 2016 to 2017 and the average successful attack costs $1.6 million.
Overall, a proactive approach to security and a well-informed team on all levels are a couple of keys to cybersecurity success. A comprehensive cybersecurity effort at all levels and all-around vigilance are the most effective ways to combat cyber attacks.
About the Author:
Rob Sobers is a Sr. Director at cybersecurity firm Varonis. He has been writing and designing software for over 20 years and is a co-author of the book Learn Ruby the Hard Way, which has been used by millions of students to learn the Ruby programming language. Prior to joining Varonis in 2011, Sobers held a variety of roles in engineering, design, and professional services.
