This blog post was written by Jim Ervin, Involta Senior Network Engineer, CCIE No. 5592.
Your corporate security environment is under attack. Are you ready?
Could your systems withstand an advanced cyber-intrusion attempt? How much sensitive data could be compromised by a single disgruntled employee? How much would a breach cost your company?
These are the kinds of questions that are keeping IT directors and C-suite execs alike awake at night.
Here are the four biggest and most common threats to corporate security environments, according to Involta’s Managed Security team:
1. Threat: Malicious insiders Does the name Edward Snowden ring a bell? Companies these days need to be very cognizant of who has access to their data. Users now have smartphones, laptops and VPN access, all of which can create a security nightmare for the IT department. Discount the insider threat at your peril.
As the Ashley Madison hack has shown us, an insider can unleash devastation that no
script-kiddie in North Korea or the Ukraine could match.
Negligence by non-malicious insiders can also compromise company security.
Defense strategy: Whole network security
A sturdy firewall at your perimeter is not enough. Enterprises need to embrace a “whole network” model of security. Design and deploy a comprehensive top-down security solution, including intrusion, detection and prevention measures, anti-malware defense and URL filtering.
Couple this with thorough information-security training, documented procedures and local agent software running on each and every device (PC, iPhone, Android, everything) and you stand a much better chance of surviving an attack.
And if you do sustain an attack, you’ll have forensic evidence to provide to the FBI, increasing the odds that they’ll catch the bad guys.
2. Threat: Exogenous cyberattacks
Many exogenous (externally originating) cyberattacks are fairly easy to launch and hard to defend against.
Distributed Denial of Service (DDoS) attacks, for example, remain a favorite of hackers around the globe. Often, a company enduring a DDoS attack is at the mercy of its ISP to help block the offending traffic.
Viruses are another example. The infamous Conficker virus of 2008 exploited vulnerabilities in Microsoft platforms and spread through the Internet like a recessive gene, wreaking havoc along the way. The authors of this virus are still unknown but are suspected to be military in origin.
Defense strategy: 24/7/365 cybersecurity
Along with the aforementioned “whole network” security with robust intrusion detection and so forth, ensure you have 24/7/365 monitoring and defined procedures for breach mitigation, including customer notification and strategic PR.
3. Threat: BYOD (Bring Your Own Device)
Look around the room you’re in right now. How many Internet-accessible devices do you see?
These days everybody has one and they all have access to public and private networks. Smartphones have huge chips that can hold gigabytes of data.
A disgruntled employee could download massive amounts of sensitive information to his or her phone and waltz right out the door.
Or a sophisticated threat actor could compromise an employee’s device via a public wi-fi connection to intercept data and access credentials.
Defense strategy: Device security solution
Implement a comprehensive security policy and a device security management platform. Look for a future Involta blog post delving deeper into device security.
4. Threat: Windows XP vulnerabilities
Though Microsoft stopped supporting Windows XP in 2015, there are still many machines running XP.
These machines are wide open to exploits because Microsoft is no longer supplying patches. Customers still using this operating system in a business environment are inviting trouble in the form of viruses and hacking.
Bottom line, XP shouldn’t be running in any business environment unless it is isolated from the network – and that’s not very useful, is it?
Defense strategy: Upgrade
Upgrade to a currently supported version of Windows, such as Windows 8 or Windows 10.
Your next step
For more information about security threats to your corporate IT environment, attend an upcoming Executive Briefing. Or schedule a complimentary security consultation with an Involta expert today.
