Four Network Security Priorities for 2017

Posted by C Henry on Wed, Mar 1st, 2017

Four Security Priorities for 2017

The way in which we approach technology within our organizations changes from year to year as does, and so should our security priorities. Yearly shifts in our security practices are attributed to both new technologies as well as new tactics implemented by cybercriminals.  Below are four security priorities that every IT team needs to address for the coming year.

1. Securing the Internet of Things

Aruba Networks published a study just days ago involving 3,100 IT and business decision makers across 20 countries concerning the current state of IoT and its impact across various industries.  The study showed that 85% of companies will have adapted some sort of IoT by 2019.  Depending on whose numbers you use, estimates are that there will be somewhere between 20 and 50 billion IoT devices and sensors distributed across the Internet by 2020.  New uses for IoT are being contemplated everyday as organizations realize the value of obtaining operational insights in real time.  Many analysts refer to it as the next paradigm shift.  Unfortunately, just as IT teams are still learning how to use this technology; they are also realizing the need to secure it as well.  Because many organizations have overlooked the importance of securing their IoT devices, hackers are targeting them profusely. The fact is, you need to approach IoT devices in the same manner you do any computing device or appliance on your network.

• Implement the same password policies on your IoT devices as you do with your other network devices and by all means – change the default password immediately
• Be diligent in installing the latest patches and firmware updates
• If possible, put your IoT devices on a separate network or VLAN in the same fashion you do a guest network
• Turn off Universal Plug and Play (UPnP)

2. Implement multifactor authentication

Identity is the new security perimeter.  Hackers no longer target firewalls.  Instead, they target users through various means such as phishing attacks in order to hijack user accounts, particularly highly privileged accounts.  According to Verizon Enterprise, 63% of all data breaches were the result of weak or stolen passwords last year.  A network today is only as secure as its weakest password which is why at the very least, strict password policies are imperative today.  However, many cybersecurity experts suggest that the sole reliance on passwords should be eliminated, turning to multifactor authentication instead.   Multifactor authentication requires that a user must submit something he knows (a password), something he is in possession of (a security token for instance) or something he is (such as a fingerprint scan).  Although some organizations are now requiring multifactor authentication in order to access the network, many organizations are using it in the following circumstances:

• Accessing high value network resources such as HR or financial records
• Authenticating highly privileged user accounts such as network admins or top level executives
• Cloud services such as Office 365 or AWS

3. Training and more training

Your users are under siege. They are constantly being baited with an endless barrage of phishing attacks and malvertising.  Phishing attacks are serious business today as a single business email compromise attack can cost a company millions of dollars with wire transfer requests such as the successful attack on the Mattel Corporation, which garnered $3 million dollars.  Phishing is all about targeting what is often the weakest link in the security chain for most any organization – the human element.  A recent report showed that employees who fell for email phishing scams have accounted for data breaches at more than 7,000 organizations and a loss of around $740 million.  Users need to be trained how to identify the common characteristics of a phishing email and should be dissuaded to click any embedded links. Because users are highly mobile today and readily take company devices beyond the protection of the network perimeter, they need to be properly trained to operate their devices in public networks and to avoid open Wi-Fi environments. With the devastating costs of security breaches today, a scheduled 30 training session repeated throughout the year is not a lot to ask.

4. Dealing with ransomware

Ransomware became a $1 billion dollar business last year.  Ransomware has changed everything.  Because cybercriminals are focusing so much effort into it, IT teams must focus equally on combatting it.  Because the majority of phishing emails contain ransomware today, it all starts with a reputable email system.  While many organizations are turning to cloud based email services such as Office 365, the need to utilize a separate and dedicated spam filter is just as vital as when the company email system was exclusively hosted on premise.  Content web filtering is another required tool in the security arsenal in order to prevent users from accessing drive-by websites.  Those who run Microsoft based enterprises can implement group policies that prevent common ransomware file types from being implemented within targeted folders.  IT managers also need to re-evaluate their backup systems in order to ensure that they are able to fully recover from even the most devastating ransomware attack.

Stay Protected! Learn more about our suite of security solutions. Get a free trial or no-obligation quote to evaluate whether our solutions are right for your organization.