Cover your top 7 basic security threats first

When it comes to infosec, many of the most core basics are being overlooked. Many of the most obvious areas where security can be tightened up with little effort are being blatantly ignored. Are you doing your level best by covering the basics? Below are seven potential vulnerabilities. Most of these can be tackled without major cost or time, so there’s really no excuse not to consider these.

Mobile malware

If you allow people to bypass security systems by jailbreaking or rooting, and let them install apps from unknown sources, then you can bet they will. The consequences can be devastating. An infected device, unwittingly brought into the office by your own employee could effectively bypass the rest of your systems. You need to identify and remove malware, remotely wipe devices, and provide secure access to corporate servers. A solid split between personal and corporate data, with encryption and secure containers is vital.

Device loss or theft

Sometimes people are careless with devices. Sometimes they get stolen. More often they are left at an airport lounge or separated from their owners someplace else. The vast majority of devices have the capability to encrypt and password protect the data they hold. Take advantage of these capabilities, and you drastically decrease the risk of data breach after a loss or theft.

Unencrypted email

Millions of emails are being sent every day with absolutely no encryption. Malicious tools that allow criminals to collect unencrypted email are easy to find. Combine unencrypted email with open Wi-Fi, and you are asking for trouble. What most don’t realize is that it’s easy to encrypt email. Plenty of friendly, inexpensive solutions exist. Encrypting your email doesn’t just deter cyber-criminals, it also protects users from their own errors. It’s all too common that emails are sent to the wrong address, and that alone can lead to a data breach.

Open Wi-Fi

You simply can’t afford to use unsecured consumer routers for a business. Like a public utility such as a drinking fountain, free Wi-Fi is everywhere and most of them make it too easy for hackers to spy on your traffic. Man-in-the-middle attacks will intercept unencrypted email. Get a security policy for your network and enforce it.

Faulty firewalls

Unfortunately, firewalls evoke a false sense of security. Modern malware is designed to sit unnoticed and exfiltrate data silently. Without the right software and expertise, you will never know if you’re infiltrated. You need to know how your firewall should be configured. Too many IT departments are not aware of firewall features that have been paid for. It also has to provide real-time protection for all devices and locations, without affecting performance.

Broken web filters

Although you probably have a web filter to block porn or other non-business related content, most malware online is hosted on legitimate websites that have been compromised. Whether the entry point is a hijacked website, or a link in a malicious email, or a downloaded PDF file, the user will never know they’ve been attacked. Hackers can buy exploit packs online and use vulnerabilities in browsers and third-party software to gain a foothold. A static filter isn’t enough, you need real-time filtering to scan for dodgy URLs and web-based malware.

Macs do get their fair share

Macs are not immune to attacks or malware. Recall the Flashback Trojan that infected 600,000 Macs back in 2012. There have been other incidents since then. Apple’s OS X has some compelling security features, but it’s not perfect and there are always vulnerabilities in third-party software as well. Consider also the rising tide of ransomware, where data is locked and a demand for money is extorted if you want it unlocked. Lesson learned: install security software on your Macs.

There are lots of other things to consider when you’re addressing security. It’s an ongoing challenge to stay on top of threats. But if you begin by dealing with these seven threats, you’ll be off to a good start.

This article was recently published in Dark Matters.
Image courtesy of Dark Matters.