While your people are without a doubt the power behind your business, they can also be a weakness when it comes to cybersecurity. Organizations must protect against all types of threats – internal and external – and, the first step to doing this is understanding the basics of cybersecurity.
Today, we want to offer some actionable steps you can take in 2018 to defend against any threats of the coming year – everything from social engineering scams to insider-led data exfiltration. For our most up-to-date list of cybersecurity best practices, check out our 2019 post.
10 Cybersecurity Tips for 2018 & Beyond
Here are 10 cybersecurity tips to follow in 2018. Adopting these practical strategies will help your business take its security program to the next level, and better prepare for the threat landscape of today and tomorrow.
1. Build Processes Before Choosing Tools
Organizations must consider implementing a formal security governance program. This enables teams to ensure that security strategies are well-aligned with business goals. In an era when it can feel like security is often at odds with the profit motive, taking this approach can help bridge the divide and turn security into an enabler, rather than a naysayer, for the organization.
To that end, we highly recommend that you think through your strategy, and then determine appropriate processes to carry out that strategy before you invest in security tools. It can be easy to get sucked into the allure of a shiny new tool without considering how it actually fits into your organization’s goals. If you prioritize processes over tools, you’re less likely to fall victim to this challenge.
2. Recruit HR to Halt Data Loss
Often security can wind up a siloed part of the organization, which contributes to some of the problems discussed above. A much more effective approach is to look at areas where security is naturally a concern and integrate secure processes and tools into relevant departments.
A really strong example of this is data loss and its impact on human resources. Data loss is a major problem, as you’re probably aware by now.
More data was stolen in the first half of 2017 than in the entirety of 2016, and there’s no reason to think that trend is slowing down or reversing anytime soon. One way you can reduce the odds that you will fall victim to data loss in 2018 is to recruit your HR team to develop and execute an offboarding process that better protects your data by systematically removing access from departing and departed employees.
3. Prioritize Visibility to Reduce Insider Threats
Managing insider threats and risky user behavior is a perennial challenge—nothing new in 2018. But, organizations are getting smarter about what it takes to do this successfully.
In a recent survey by Gatepoint, gaining full visibility into user behavior was cited as “highly challenging” by 69% of respondents. If one of your 2018 resolutions is to decrease insider threats at your organization, visibility is a great place to start. Most security tools only analyze computer, network, or system data.
To stop insider threats, both malicious and accidental, you must continuously monitor all user activity. If you plan to invest in insider threat prevention technology in 2018, make sure you choose a tool that gives you unfettered visibility.
4. Test Your Backups
A lot of organizations invest in data backup tools, but fail to test them and make sure they are actually working. The worst time to find out your failsafe isn’t so safe? In the midst of a crisis.
Don’t wait until ransomware strikes or you catch a data exfiltration in progress to find out that your systems aren’t doing what they’re supposed to. When you invest in backup solutions, set aside time to test them regularly and verify that data is actually being safeguarded. Trust us, you’ll sleep much better at night.
5. Up-Level Your User Training
2018 will the the year that phishing and online scams stop once and for all… Yeah, right. 2017 was a banner year for social engineering, and attacks are only getting more sophisticated as time goes by. You can expect 2018 to be full of highly effective social engineering-based scams.
The keyword there being “social.” It’s your people who can be either your best line of defense or your weakest link. Which of those options comes to pass depends on how well you educate and train them to spot attacks in the wild. The most important way to ensure that user training is effective is to make it hands-on and relatable.
A Powerpoint presentation once a year is simply not going to cut it. Instead, follow these tips on how to improve your security awareness program and make your users your strongest line of defense.
6. Automate All the Things
We’ve written before about the importance of keeping software and systems up to date. As the recent Meltdown and Spectre vulnerabilities demonstrated, it’s very, very important to make sure that business systems (like computer operating systems) are continually patched.
Don’t leave things like system updates up to your users’ discretion. If a security task requires human effort, especially on the part of folks for whom security is not a core job function, it will inevitably fall through the cracks somewhere. This holds true for a wide variety of security-related tasks and best practices.
Wherever possible, automate updates, incident detection, analysis, and response. Leave strategic and complex activities to the humans and let machines do what they do best—all those rote actions that are boring and easy to forget about but that keep your organization secure.
7. Prepare for GDPR
If your organization handles the data of European citizens in any way, shape, or form, then you should be thinking about how you will prepare for and meet the new GDPR guidelines, which take effect in May of this year. The General Data Protection Regulation is designed to better regulate data privacy for all European citizens, and it will apply to many more businesses than may realize it today.
Like any other regulatory mandate or compliance framework, it can be time-consuming to ensure that you are meeting the standards, so take action now if your organization is one of the many that will be affected by these new laws.
8. Secure Your Site with HTTPs
Protect your site and your users with and SSL Cerfiicate. HTTPS (Hypertext Transfer Protocol Secure) is an internet communication protocol that protects the integrity and confidentiality of data between the user's computer and the site.
Google encourages all businesses to adopt HTTPS to ensure a secure and private online experience and protect your users’ connection to your website. Ultimately, this provides three essential methods of protections – encryption, data integrity and authentication.
9. Ensure Software Is Up-to-Date
An easy way to protect against potential vulnerabilities is to ensure the software your business uses is constantly being updated. Software companies release security updates ongoing for a reason – to address these types of vulnerabilities. This is why it’s essential to stay on top of the updates that are available to you.
10. Investigate & Respond to Insider Threat Incidents
When a cybersecurity threat incident takes place, organizations need context to respond in a quick and effective manner. This is why visibility into incidents is so important.
You need to know exactly where to get context about what happened. But, system, network, and log data can be extremely difficult to sort through. Insider threat software simplifies the investigation process and provides all of the context and visibility needed to investigate including user activity via visual capture, precise activity trails, and metadata.
Final Thoughts
For businesses looking to take their cybersecurity to the next level, we recommend considering the tips listed above for 2018 and beyond. What tips or strategies did we miss? Feel free to reach out to us directly on Twitter @Proofpoint to share your thoughts and exchange insights.
Learn more about how Proofpoint can help you identify and eliminate insider threats.
Related Articles:
- The 5 Biggest Data Breaches of 2017
- 10 Best Practices for Cybersecurity
- 5 Security Technologies that Address Insider Threat
BTW, can we send you email?
Once a week or so, we send an email featuring our newest blog post—including helpful content like this. Interested?
Subscribe to the Proofpoint Blog