Skip to main content

IT Defense In Depth Part I



In the 1930s, France built a trench network called the Maginot Line to rebuff any invasion. The philosophy was simple: if you map out all the places an enemy can attack, and lay down a lot of men and fortifications at those places, you can rebuff any attack. The problem is, you can't map every possible avenue for attack.

What does this have to do with IT security? Today many business owners install an antivirus program as their Maginot Line and call it a day. However there are many ways to get into a network that circumvent antivirus software.

Hackers are creating viruses faster than antivirus programs can recognise them (about 100,000 new virus types are released daily), and professional cybercriminals will often test their creations against all commercially available platforms before releasing them onto the net.

Even if you had a perfect anti­virus program that could detect and stop every single threat, there are many attacks that circumvent anti­virus programs entirely. For example, if a hacker can get an employee to click on a compromised email or website, or "brute force guess" a weak password, all the antivirus software in the world won't help you.

There several vulnerabilities a hacker can target: the physical layer, the human layer, the network layer, and the mobile layer. You need a defense plan that will allow you to quickly notice and respond to breaches at each level.

The physical layer refers to the computers and devices that you have in your office. This is the easiest layer to defend, but is exploited surprisingly often.

Here are a few examples:
  1. Last year 60% of California businesses reported a stolen smartphone and 43% reported losing a tablet with sensitive information.
  2. The breaches perpetrated by Chelsea Manning and Edward Snowden occurred because they were able to access devices with sensitive information.
  3. For example, Comptia left 200 USB devices in front of various public spaces across the country to see if people would pick a strange device and insert into their work or personal computers. 17% fell for it.
For the physical layer, you need to:
  1. Keep all computers and devices under the supervision of an employee or locked away at all times.
  2. Only let authorized employees use your devices
  3. Do not plug in any unknown USB devices.
  4. Destroy obsolete hard drives before throwing them out
Next time in Part II, we will talk about the human and network layers of security.

Comments

Popular posts from this blog

Understanding Managed Services and How They Benefit SMBs

Understanding Managed Services and How They Benefit SMBsSmall to medium sized businesses (SMBs) receive a lot of calls each day from slick sales people peddling the next technology trend that's going to save them money and revolutionize how they do business. They're all too quick to caution that if you don't listen to them, you'll fall behind the times, and eventually be swimming in a sea of debt and out of business.

No doubt you've heard, or you've at least read about, the benefits of managed services. Managed services refer to clearly defined outsourced IT services delivered to you at predictable costs. You know the exact IT services you'll be getting and what you'll pay for them. There is no surprise sky-high bill for services rendered. So are solicitation calls that pertain to managed services worth listening to? We think so. Then again, we're in the managed services industry. There may be a bit of a bias here.

How Managed Service Providers Work

Ma…

Is That Email a Phishing Scheme?

Research has revealed that over half of all users end up opening fraudulent emails and often even fall for them. Phishing is done with the aim of gathering personal information about you, generally related to your finances. The most common reason for the large number of people falling for fraudulent emails is that the phishing attempts are often so well-disguised that they escape the eyes of a busy email reader. Here are a few tips that help you identify whether that email really came from your bank or is another attempt at defrauding you…

1. They are asking for personal information - Remember, no bank or financial institution asks you to share your key personal information via email, or even phone. So, if you get an email where they ask for your ATM PIN or your e-banking password, something’s a miss.

2. The links seem to be fake - Phishing emails always contain links that you are asked to click on. You should verify if the links are genuine. Here are a few things to look for when doing…

Be Proactive: How to Avoid Potential Network Failures

Be Proactive: How to Avoid Potential Network FailuresFor small- to medium-sized businesses (SMBs), an IT network failure can be devastating because they don't have the resources of large corporations to bounce back from such disasters. Preparation against such devastation may be the only course for them to avoid failure and survive with the least damage if failure occurs. SMBs must be proactive in recognizing the eventuality of a cyberattack or human error that can cause data loss and disrupt business continuity. This is what needs to be done to help prevent a potential failure.

Be prepared: Being proactive is an essential step for preparation against a disaster. There are two ways to determine how to best prepare to prevent potential failure of your infrastructure. First, you need to identify the weaknesses throughout your systems, and second, determine how you are going to eliminate those weaknesses and protect your network.

Identify the weaknesses: Determine how and why your syst…