While the internet age has made it easy to scale a business globally, the openness it has promoted has also allowed new threats to emerge.
In recent years, hackers backed by organized crime syndicates or overseas governments have stolen data from governmental bodies and private corporations alike, awaking them to the importance of internet security.
However, before you blindly install a firewall on your networks or enact measures like people centric security, you’ll want to understand the problem you are facing.
In the paragraphs below, we’ll walk you through the process you should adopt when you set out to protect your company’s data from bad actors.
Identify data you need to protect
It is easy to be overwhelmed with the task you are facing, but if you start by highlighting the data sets that desperately need protection from online criminals, it will be easier to proceed.
Protecting customer data, which includes credit cards, bank account info, and addresses/e-mails/phone numbers, should be an ‘A’ priority.
Trade secrets, prototypes, and internal financial information should also be afforded the best possible protection from threats.
Finally, anything pertaining to your employees should be also be well-guarded, as having an entire staff’s checking account numbers exposed to a cash-hungry Ukrainian cybergang is not the best way to inspire long-term loyalty to your company.
Set up defenses and train staff on how to use them
Once you have identified the information you want to protect, you’ll then want to set up systems that will guard it from even the most seasoned online intruder.
Ensure that every page on your site has the HTTPS protocol in place, and that all information forms transmit their payload in an encrypted format.
Require that your employees set strong passwords (more than 8-12 characters, with a mix of lower and upper case characters, numbers, and symbols), and that they are changed on a regular basis.
Back up information weekly, if not daily. In the event of a ransomware attack, you’ll be glad you did.
Train your staff how to recognize phishing e-mails – when in doubt, have them forward the message to IT.
The call could be coming from inside the house
It’s easy to picture your biggest threat being some Ukrainian hacker snacking on Cheetos in Kiev, but often, the perpetrator of data leaks are internal employees and contractors.
60% of the time there is a breach, it is the people you have trusted to keep your company’s trade secrets under wraps who ends up betraying your trust.
Knowing this, it is insufficient to set up an external firewall and DDoS protection and call it a day. You also need to have a system which tracks the behavior of employees and contractors as they navigate through your company’s intranet.
When a people centric security system detects anomalous behavior, it alerts your IT staff that something nefarious is up, allowing them to take appropriate measures against those flagged for engaging in ‘suspicious’ actions.
There may be many false alarms, but a people centric security system will pay for itself once it catches its first disgruntled employee trying to leak customer e-mail lists to a contact on the dark web.
