What can be protected without a cybersecurity professional.

Cybersecurity choices in today's worldWhat Protection can be achieved without a Cybersecurity professional?

That is a loaded question, because most professional cybersecurity experts believe that nothing can be done to protect an organisation without said expert.

There are a number of things that can be done to make your business environment secure, but all have to be driven by management with the vision to protect their organisation.

If management, C Level execs, board members and owner beleive that business security is important, vital in fact, then it will be picked up by everyone else in the organisation.

The introduction of cloud computing and everything stored in the cloud has exposed more and more data. This data is targeted by the bad guys.

Here are 6 tactics that can be implemented by any organisation without the need for a security expert

Patch it

The constant barage of patches and updates that come from microsoft, apple and android are exceedingly annoying.

In fact they can have an impact on business.

The reason that they are produced is to protect the operating system.
Patches are developed because someone, somewhere has found a way to compromise a piece of software, the manufactrer has found out about it and the software has been rewritten or changed to stop it from happening.

These changes are called patches and are BENEFICIAL to you. Every organisation needs to have a process to implement those updates.

Complex Password

Passwords have to have 3 requirements.

They have to be complex, any character on the keyboard should be and can be in a password. Letters, numbers, symbols all mixed together to create a complex password.

But, it does not stop there – they also have to be unique, different for every digital location and that have to be longer that 10 characters.

We use to specify 8 but changes to technology and the speeding up of processing power has reduced the time needed to crack an 8 digit password.

2 factor authentication

Any additional protection to data is a good idea.

Two factor authentication relies on three things instead of two to access the information.

It is addirional to username and password and is only triggered if the combination of the first two is correct.

In todays world, we all have a mobile phone, this is used as the two factor authentication process.

User name, password and a code delivered to your phone means you are verifying who you are.

Separate and segregate data.

I can think of three areas in any organisation where information needs to be separated.

Email, financial data, trade secrets have seperate requirements within an organisation.

You do not need to have everyone access financial data.

In the old days it was called compartualisation, need to know. Today it is still very relevant.

Train and educate everyone

There are many free or inexpensive training and education programs available to suit any organisation.

Training needs to be focused on the individual.

Everyone needs to understand why the organisation is protecting the data, why certain things are done in a certain way but most improtantly why the organisaion is trying to protect their staff, clients and finances from the bad guys.

Back it up.

You never know when you are going to experiance a cyber event.

You have to know what information needs to be protected, how often it is accessed and what will happen to the organisation if that information is compromised or lost.

This should be part of your business risk management plan. (You do have one of those?)

The other part of backing it up is to test it.

All of these can be done without the aid of a professional cybersecurity expert.

There is one additional tactic.

Remain vigilant.

The bad guys are everywhere.

They target you, not because you have something worth stealing, but because you are connected to the digital world and you think that is a good idea.

The days of the gentalman cyber criminal are well and truly gone.

Everyone is out for themselves and even a basic hack, malware attack or cryptovirus can shut down your organisation.

Cybersecurity is your responsibility!

Roger Smith is funny, scary, on point and is focused on one thing – increasing everyone’s awareness and understanding of the problems and issues associated with the digital world.

He is the winner of the worldwide 2018 Cybersecurity Educator of the Year award and was Runner up in 2017 .

He is a highly respected expert in the fields of cybercrime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity) on Cybercime, Cybersecurity and the hacking techniques used by the digital criminal.

He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger, going to number one on Amazon.

He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI.   He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.

Cybersecurity – we still do not have the correct focus!

focus on cybersecurity

With the expected $660 billion loss to cybercrime this year, we definitely have to change our understanding, our focus and most importantly our attitude when it comes to business security and cybersecurity.

We have to stop with the simplistic crap – I have been guilty of this myself but we have to stop.

Cybersecurity is not only about AV, firewall and patching.

Doing one is good, but the attitude of doing all makes you bullet proof is definitely stupid thinking in today’s business world.  The number of SME’s that adhere to that thinking is phenomenal.

Cybersecurity is about knowing your data, the location of your data and more importantly protecting it from people who should not have access to it.

It is about risk management and understanding that all risks associated with your data have been mitigated, differed or migrated.

There is a whole ecosystem of things that have to be done, as fast as possible, to reduce the risk of a cyber event, but the simplistic keeps getting in the way.

Attitudes like too small, nothing to steal and she’ll be right abound, and really does show that most people have a basic disdain for protecting their organisations.

Until this attitude changes, the basics are the only things that will be applied.

Introduction of the NIST framework (any framework), implementation of SOC and SEIM environments, an acceptance and adherence to policies, process and procedures and a basic understanding of what the bad guys are capable of is absolutely paramount for any organisation going forward.

But, we still rely on just or only the basics.

Without a change we will still go through the same solutions expecting a different outcome.   Definitely stupid thinking.

We forget the capabilities of today’s cyber criminal.

  • They are well educated in ones and zeros, in other words – the digital world.
  • They know how to bend and break the rules that society relies on to be a society.
  • They know how to bend technology to do things that even the designers never thought of.
  • They have a vast range of motivations to do wrong, and
  • They do not give a stuff about you.  To them you, your family, your business are cannon fodder.
Applying this knowledge to your business environment makes you realize that sitting ducks abound and improving your status is paramount.

To change, you need help in changing.

Changing the attitude, getting and listening to advice but more importantly actioning what needs to be done is the only way forward.

There is still one fundamental issue, in most cases, you do not know what you do not know.

Getting advise from experts is important.

You can no longer rely on the jack of all trades, someone who knows computers or thinks they know the digital world.

You need an expert!

You need an expert to stop a cyber event from compromising your organisation.

You have to find the time, the expertise and the financial motivation to make change, but you need an expert to put you on the right path.

If you cannot find it internally then you have to go outside your organisation.

 

Roger Smith is funny, scary, on point and is focused on one thing – increasing everyone’s awareness and understanding of the problems and issues associated with the digital world.

He is the winner of the worldwide 2018 Cybersecurity Educator of the Year award and was Runner up in 2017 .  

He is a highly respected expert in the fields of cybercrime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity) on Cybercime, Cybersecurity and the hacking techniques used by the digital criminal.   

He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger, going to number one on Amazon.   

He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI.   He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.