Every day an estimated 2.5 quintillion bytes of data is generated, with no sign of slowing. Complicating matters is the constant barrage of threats ranging from malware to human error—and the plethora of tactics to combat them.
As we settle into the new year of 2018, cyber thieves will continue to steal data and disrupt IT systems. Keeping up to date with IT security tools and techniques as well as regulatory compliance is vital. If you’re an IT professional with data security in your job description, here are five tips that will help make your 2018 a little safer.
Fortify Your Wi-Fi Against Krack
Wi-Fi vulnerability is a growing concern, particularly now with the rise of Key Reinstallation Attacks (Krack). An attacker can exploit the weaknesses of WPA2, a protocol securing modern Wi-Fi networks.
Krack occurs when a hacker intercepts the authentication process as a Wi-Fi client device connects to a protected network, allowing the hacker can eavesdrop on all data sent and received over that network. Through this attack, hackers use HTTP content injection to sneak malicious code into websites or infect devices with ransomware or viruses.
To protect against Krack, ensure that your operating software, firmware and antivirus programs are up to date on all devices. First, encourage employees and other users to visit sites with HTTPS connections when on public Wi-Fi networks, even if they’re password-protected. Second, use encrypted communication protocols between servers and clients. In addition, employees should employ a virtual private network (VPN) from a trusted provider to connect to the Internet when out of the office.
Tap Next-Generation IAM Tools
As more organizations adopt cloud computing, business processes are traversing a diverse range of users, devices and hosting models, eroding security boundaries. Cloud-based identity and access management (IAM) tools—particularly those that handle identity governance administration (IGA)—can help. IAM tools enhance security by ensuring the right individuals access the right resources at the right times for the right reasons. They can also enhance organizational agility by applying up-to-date access controls and by monitoring IT compliance measures.
Look for flexible hybrid deployment models that can accommodate cloud and on-premises delivery as well as easily integrate with SIEM, DLP and similar security products. The best among them can also govern data access at granular levels for structured and unstructured data types through robust identity analytics.
Make Backup a Priority
Although it would seem obvious to anyone that data backup is important, many small businesses still fail in this regard. According to a recent study by Clutch, a research firm based in Washington, DC, more than half of the small businesses are unprepared for data loss.
It’s critical for every company and organization, big or small, to back up data regularly, whether through an online service, separate hardware device, different location or tape. If original data is lost or corrupted, you can retrieve it by simply “rolling back” to an earlier copy of the data.
Backups also necessary for complying with IT data-security requirements, which might include, for example, recovering a user’s emails from three years ago. Backups are the safety net in your business-continuity plan.
You might also opt for a third-party vendor to handle backups. Companies that offer cloud-based backups can provide greater efficiency and security. Some of them allow you to back up data from any physical or virtual infrastructure, or from a Windows workstation, to their cloud service. Data is accessible anytime from anywhere. Some also offer backups as a managed service or disaster recovery as a service (SaaS), handling everything from remediation of backup failures to system and file restores.
Keep Software and Firmware Up to Date
Installing the latest patches as well as upgrading software and firmware on servers, end points and other devices can often seem like a never-ending endeavor. But it’s one of the best ways to keep your infrastructure secure.
Patching vulnerabilities that are more than a year old protects against many of today’s common attacks. Make patch management a top priority and install patches within two weeks of their availability, or sooner. In addition, stop using outdated software that the vendor no longer supports. By making a regular inventory of IT assets, you ensure no one is still using retired or unauthorized assets.
Get Your Logs in Order
Security and audit logs provide vital information for root-cause analysis of security incidents. Replicating and isolating log data prevents attackers from deleting it to hide security breaches.
With the General Data Protection Regulation (GDPR) taking effect in May 2018, logging everything will be more important than ever. A well-defined log strategy will specify logging methods and tools as well as data-hosting locations and information. Be sure to consider the log format to make identifying and extracting insights easier. Also, ensure that logs are automatically collected and forwarded to a central location separate from the production environment so information is accessible without affecting production.
These IT security tips are just a few that your organization should keep top of mind in 2018. Your IT systems can never be too secure, but a well-designed plan minimizes the risks to your business, reduces costs, increases compliance and helps improve overall business service.
About the Author
Aaron Shaver is the chief technology officer at US Signal, a leading IT solutions provider offering connectivity, cloud-hosting, collocation, data-protection and disaster-recovery services. Previously, Aaron led Cloud Architecture at US Signal and was the director of product development. He has more than 20 years of experience in the technology industry. In 2008, he graduated from Baker College with a graduate degree in information security.