Cybersecurity Techniques to Keep You Grounded Against the Winds of Change

By Jake Lehmann

Like any living environment, your cybersecurity ecosystem must evolve and adapt to defy emerging threats. CyZen’s cybersecurity experts spotlight four powerful techniques to protect your valuable assets for the long haul.

1.Cause the sky is the limit.

The beauty of a mobile workforce is the ability for employees to access the resources they need from anywhere. However, securing cloud-based resources becomes increasingly challenging, and without the proper know-how, your employees become slow-moving game for cyber predators. This is where two-factor authentication (“2FA”) comes in—the most common and effective way to secure your resources. 2FA creates a protective layer between your company’s valuable information and cyber attackers, but not all implementations are equal.

Evaluate the strengths and weaknesses of each 2FA tool before you commit. For example, using 2FA with text messages (“SMS”) is less secure than using 2FA with push notifications, security keys or authenticator applications (i.e., Google Authenticator, Duo).

SMS 2FA is susceptible to “SIM Card Porting” attacks, where the attacker calls your service provider and switches your phone service to a phone they control. At this point, they are able to receive the 2FA text messages used to secure your accounts.

2FA implementations that use authenticator apps are susceptible to phishing attacks, where an attacker provides a victim with a logon portal that mimics the one the user already knows—we know…very sneaky. The user unsuspectingly enters their credentials, including the pin provided by an authenticator app. The fake portal forwards the information to the actual site and the attacker now has access.

So, what should you be looking for when selecting the best 2FA tools? You want 2FA that includes the push notification and the security keys, both of which are not susceptible to phishing attacks. Beyond 2FA, Whitelisting is also an effective way to ensure that only someone in the office is accessing your website, blog, etc. This adds an extra layer of security to 2FA.

2. Roll call! Know where all your assets live.

Construct a streamlined strategy for keeping track of your inventory—from securing assets such as where data is stored to the details of your hardware security solutions. At the drop of a dime, your team must be able to answer: Who are the owners/users? Where does the asset live/belong? What is it used for? These questions will help you effectively track and monitor your assets.

Once your IT assets are identified, you can add layers of visibility and anomaly detection through the use of many available tools and platforms (such as a Surface Equipment Inventory Management). These tools and platforms are designed to help add value beyond just knowing your assets—you can actually protect them in a meaningful way.

3. Turning weakness into strength.

Building on the ideas of tracking and managing assets, you should focus on the lens of known vulnerabilities. Technical vulnerabilities in your company come from two basic areas: outdated software/hardware and misconfigurations.

We no longer need a slew of seasoned advisors with decades of field experience. Today, vulnerability scanners have made locating risks so much easier. These automated scanning devices should be regularly deployed in your environment—especially if a new big vulnerability hits the news. Vulnerability scanners can list a myriad of valuable information, such as: What are your high-risk systems? What is the impact of the risk? How critical a vulnerability is and steps to remediate.

As a best practice, IT administrators should deploy a routine and robust patching schedule. They should also roll out a vulnerability management program that runs quarterly, at a minimum, to identify gaps in patched systems. This ensures that your organization will identify and react to these vulnerabilities that are discovered by industry professionals daily.

After a few rounds of vulnerability scanning and remediation, you’re ready for a penetration test. Basically, skilled professionals simulate a breach by manipulating broadcast traffic, as well as using other advanced techniques that are more visible to the human eye than by vulnerability scanners alone.

4. Any day’s a good day for phishing.

Old school anti-virus solutions were very clunky, resource heavy and ineffective when it came to actually blocking the most malicious files. Most old AV solutions were only signature based, meaning it had to know that something’s file signature was bad before it took action in identifying and blocking it. Newer solutions dubbed as “Next-Gen AV” are heuristic based. This means they are hands-on and interactively searching for bad signatures and addresses. They achieve this by looking at what the malware is doing and judging it against a baseline of normalcy before preventing an action (such as pulling passwords from memory) which is typical of malware and not something a normal user would initiate.

Now that you have these four powerful techniques in your back pocket, connect with a CyZen expert to learn how you can start implementing them and start your path toward cybersecurity enlightenment, here.

Compliments of CyZen, a member of the EACCNY