From the Desk of Evan Berk
While the recent WannaCry ransomware outbreak affected many users – reportedly over 200,000 in 150 countries – it also woke up a great many complacent business owners and executives to the fact that it’s all too easy to suffer a malware attack and a loss of data.
As an article in Forbes recently put it… Companies aren’t prepared for what may happen. They’re prepared for what they believe will happen. And too many executives simply don’t (or didn’t) believe a breach or data loss would ever happen to them. After all, they use anti-virus software, right?
Wrong. Only a multi-layered cyber security defense can realistically protect against malware and data breaches. Simply put, no single software product or appliance can provide complete protection. Instead, companies need to diligently employ multiple defenses, including:
- Fully Monitored Off-Site Data Backup
- Anti-Virus and Anti-Malware Software
- Advanced Firewall Technology
- Business-Grade Wireless Networks and Access Points
- Encryption Technology
- Virtual Private Networking
- 24 x 7 Monitoring
First, there’s backup. It goes without saying that your data (and server images) should be backed up off-site (think “cloud”) and with multiple iterations. You need to make sure that your backup process is monitored – every day – to ensure it is working. And you have to regularly perform restoration tests, or you won’t really know that it can be restored when you need it.
Next is anti-virus and malware software. There are two types… signature-based and behavior-based. Signature-based software, which is “traditional” anti-virus software, depends on constant downloads of the latest signatures (threats) in an ever-expanding list. Their success depends on your anti-virus software company staying one step ahead of (or at least not too far behind) the hacker community, who are constantly changing their malicious code to make their viruses look new… effectively changing their “signatures.”
Behavior-based software (like Sophos Intercept X) watches for subtle changes to your operating systems and data. Rather than examining hundreds of millions of known malware samples, the idea is to focus on the relatively small collection of techniques used to spread malware, catching them “in the act” and warding off attacks without having ever having seen them first.
The fact of the matter is you need both.
What about your firewalls and your wireless networks? Are you working with secure, business-grade, centrally managed firewall and wireless network technology? Or are you using the router that the cable company gave you? Is your network being monitored 24 x 7 for malicious activity? Do you have a separate “guest” network that your visitors use? If not, you’re at risk.
Are you using encryption technology to automatically protect sensitive data like electronic health information (ePHI)? Are you storing unencrypted credit / debit card information (and violating PCI DSS)? Are you encrypting and protecting what may be your most valuable asset – your intellectual property? If not, you’re running huge risks.
As for Virtual Private Networking, it’s really a simple concept… think of the Internet as a large pipe through which all your data is flowing, and which hackers, with the right tools, can easily see. That means unencrypted information… including your e-mail… is potentially visible. Now imagine running your own, temporary garden hose through that large pipe, with your data within the hose fully encrypted. That’s what a VPN does.
Together, these layers protect you and your organization. Sure, it seems like a lot of technology. But it’s really not, and it’s quite affordable.
Have questions or concerns? Call me personally at 973-944-5000, x1002, or e-mail me at EBerk@CertusTechnologies.com.
About The Author
Evan Berk is Managing Partner at Certus Technologies, an IT Managed and Cloud Services firm that specializes in helping clients dramatically improve their business productivity.
Evan is passionate about simplifying and demystifying complex Information Technology systems and believes that the best IT systems should make our lives easier and more productive, both in the workplace and at home. He can be contacted at EBerk@CertusTechnologies.com or at 973-944-5000.