5 Major Business Security Risks & How to Avoid Them
There’s not a day that goes by where we don’t hear about a security threat or data breach that has impacted customer records, trade secrets or classified emails from government offices. The truth is that the Internet is the new Wild West and black hat hackers are waiting in the wings to exploit their next victim. In this article, we will examine the Five Business Security Risks and How to Prevent Them.
Risk 1: Disgruntled Employees
Perhaps one of the most overlooked threats comes from internal attacks. It is the rogue employees that have access to networks, data centers and passwords that can cause the most serious damage. For example, there was a rumor that the Sony hack was not carried out by North Korea but in fact by a disgruntled employee. According to the Daily Mail, the Sony hack was perpetrated by a group of employees that were paid off by people from a hacking community that hated Sony.
There are many ways that an employee can cause damage. Here are just a few of the more common methods: introducing viruses, stealing funds or trade secrets, sabotaging data and networks, or intentionally crashing computer systems.
How can you prevent disgruntled employees from causing serious damage?
The most important aspect of preventing damage from disgruntle employees is controlling access, setting up permissions and monitoring access. As an IT department, you must have the thought an ‘inside threat’ is ever present. It could be a low-level, mid-level or even highly trusted employee in a top position. There were no measures in place to stop Edward Snowden from committing the largest data breach in history.
Another fix is to disable USB drives on desktop and laptop computers. This prevents employees from intentionally or unintentionally loading viruses or malware onto computers. It also prevents the unwarranted transfer of company files onto personal storage devices. There is a downside to doing so. It can hurt productivity and create a work environment that lacks trust.
Risk 2: Careless or Uninformed Employees
Uninformed and careless employee is another common occurrence that often leads to data breaches. It’s critical that businesses have security policies and training for their employees and it must be taken seriously. For example, employees that have weak passwords, visit unauthorized sites, click links in suspicious emails or open attachments post an enormous security threat to systems and data.
The solution is to create an environment where security is understood and practiced.
One key to protecting your business is training employees from day one on cyber security best practices. Some employees may simply not know how to protect themselves. It is also important to hold regular training with existing employees and send emails regarding the latest threats and what to look for.
Another important element which takes the employee out of the threat equation is encryption. This should be a part of your security strategy. In addition, businesses should also consider implementing multi-factor authentication such as: One Time Password (OTP), RFID, smart card, finger print readers or retina scanning to mitigate risk.
Risk 3: Mobile Devices (BYOD)
Bring Your Own Device (BYOD) is perhaps one of the greatest security vulnerabilities facing businesses today. It is low hanging fruit for thieves and hackers alike. Employees using mobile devices such as smart phones and tablets share data, access company information, or neglect to change passwords which can lead to substantial data breaches. A report by BT Americas showed that mobile security breaches have affected more than two-thirds of global organizations in the last 12 months.
What’s your policy on BYOD? A policy could save you millions or even billions of dollars.
It’s important to make sure that you have a carefully spelled out BYOD policy that you employees understand. Make sure to educate and set clear expectations for new and existing employees. If you are going to allow employees to use their own devices, then make sure to monitor emails and documents that are being downloaded to or from the company. BYOD monitoring will provide greater visibility, help to mitigate data loss and pinpoint exposure.
Risk 4: Unpatched or Unpatchable Devices
Another large vulnerability found within in most businesses is unpatched or unpatchable devices such as routers and servers that use software or firmware in their operation. There are two scenarios here. Either a security patch has not yet been created to address a potential vulnerability or the hardware was not designed to enable them to be updated following the discovery of vulnerabilities. This leaves an exploitable device in your network open to hackers wanting to gain access to your network or data.
Make sure you have a patch management program in place for devices and software.
The first step to having a patch management program is to implement a vulnerability management technology to analyze your network to see what is, and isn’t, up to date. Another important element is to have a policy in place that addresses equipment that is unpatched or unpatchable. If it’s not updated or patched within a certain amount of time it is simple taken offline. Make sure to make an inventory of all devices and prioritize based on risk and criticality.
Risk 5: Third Party Vendors