5 Forgotten Cybersecurity Best Practices

Data is the life-blood of most organizations nowadays, with the value often being compared to oil or gold. The intrinsic value of data, combined with the rapid increase in the volume of data being generated, has led to widespread increase in cybercrime.

Attackers are evolving and improving their approach every day, and many organizations are struggling to keep up. It may even surprise you to learn that many enterprise security teams are still failing to adequately address insider threats.

Cybersecurity needs to be the priority the IT team if we have any chance of tackling these issues. A culture of cybersecurity best practices needs to filter down from the C-Suite, through management and into every member of every department in the organization.

With that in mind, here is a list of some perhaps forgotten cybersecurity best practices.

1. Think of Data as Cash

Data has a monetary value on the black market and yet we do not yet think of it as having a financial impact on the business. The average cost of a data breach, depending on which research you look at, seems to be around $3.86 million. Knowing that, why is it so difficult for security teams to justify spending money on security solutions?

Each piece of data you store in your organization, if stolen or lost, could cost you around $148. This value needs to be communicated throughout the organization.

2. Start Spending Some Money on Data Security Platforms

It’s about time that boards started allocating serious money to security teams to address the most common data breach problems. Often, companies fail to implement solutions that address insider threats, focusing instead on firewalls or anti-virus solutions.

Whilst those solutions are vital, they are useless if you are not also looking at insider threat focused data security platforms. Make sure, when evaluating cybersecurity solutions, that numerous people are involved, from the CISO all the way down to the technical individuals like sysadmins.

Money should also be spent on attending the latest cybersecurity conferences and trade shows to keep up to date on current threats and solutions.

3. Make Sure You Know How to Handle a Data Breach

If you haven’t got an incident response plan in place that you have rigorously tested and fine-tuned, then you are at risk. We’ve seen so many examples of companies failing to adequately respond to data breaches and making it worse from themselves.

No organization, no matter how prepared, can fully prevent themselves from experiencing a cyberattack. But what you can do, is ensure that you are ready to respond in the event you’re the next headline.

Uber, for example, when hit with a ransomware attack, decided to pay the ransom and not notify their users they had been hacked. This eventually backfired of course, and they were made to pay a fine of $148 million. Don’t be Uber!

4. Watch Your Employees!

The vast majority of cybersecurity incidents involve some sort of internal failing, usually taking advantage of negligent or disgruntled employees. Your users already have access to your data, so you should be watching them closely.

Make sure that you are promoting good user behavior, such as not accessing company data from personal devices, maintaining strict password policies and not clicking on obvious phishing emails.

If an employee is granted privileged access, changes job roles or is put on notice, they are far more likely to be the source of a data breach. You need to monitor the behavior of these users closely to ensure that you are not caught out.

5. Set up Your Environment to be Secure

There are a number of simple things you can do to reduce the risk of data leaving the organization. When we run data risk assessments with enterprise organizations, we still see vulnerabilities in these areas. Some of the things you can do include:

• Cleaning up stale accounts: Having a large number of stale accounts with access to your data increases the potential attack surface.
• Remove open shares: There probably are very few folders in your organization that need to be accessed by everyone. Limit open shares to reduce the risk of privilege abuse.
• Automate where possible: Processes and best practices will not always be followed if employees deem them to be time consuming. The way around this is automation.
• Enforce least privilege: Make sure that your users only have access to the files and folders they need to do their job effectively. Nothing more.

If you’re still unsure about where to start with your data security, then it might be worth taking our data risk assessment to see where the gaps in your data security are.