It’s probably not fair to say that Americans are too willing to sacrifice security and privacy for the conveniences of technology. But at times that seems to be the case.
Sometimes people are just negligent in updating connected devices to patch vulnerabilities, for example. Or they use smart devices without taking precautions, such as running equipment through a firewall or making use of password authentication.
The consequences of poor defense practices are especially great among business organizations that have an obligation to protect the information of others as well as their own assets.
Cyber threats evolve. So do strategies for protecting networks. Here’s one basic truth that most security experts, including those from SDN Communications, have come to agree on:
Strongly protecting the perimeter of a network is no longer enough to guarantee security.
Companies should deploy protective steps in layers from the outer edges of a network to the end-point work stations and include regular training for every person in the organization.
Several other current truths about cybersecurity have emerged and, according to experts, should be acknowledged and embraced, especially by organizations with the responsibility of protecting other people’s information.
In April, during the second Sioux Falls Cybersecurity Conference, cybersecurity experts from Dynetics in Huntsville, Ala., likened deploying good cybersecurity strategy to building a maze. The objective is to frustrate intruders and chase them away. There is no single, silver bullet that can guarantee protection, they said.
Greg Jackson, a senior cyber risk advisor with Dynetics, referenced several other “truths about cybersecurity” that businesses should embrace. Some of what he highlighted include:
- Complying with government or regulations does not equal security. The networks of compliant organizations get breached all the time. Establishing good security requires more than following basic rules.
- Not every vulnerability in a network can be eliminated. Companies should conduct continual vulnerability scans and follow them up with efforts to remediate critical findings.
- Assume that the perimeter of your network has been breached but not impacted. Strive to avoid or significantly reduce the potential impact of intrusions because if your network hasn’t been breached multiple times already, it probably will be.
- Implement internal protections. Make intruders work hard and “get noisy” so that they can be more easily detected and identified.
- Implement internal detection tools. Closely monitor activity at endpoints. The only way to positively identify a skilled adversary is to analyze user behavior at endpoints with help from a skilled cyber analyst.
“Embracing these truths and reacting appropriately is critical to the defense and resilience of network assets and data from today’s cybercriminals. This is a continual process that is expected to evolve as cybercriminals adapt to the defenses they encounter,” according to Dynetics.
A report distributed by the company documents the largely hidden and deceptive nature of threats facing businesses. During the past three years, Dynetics has conducted 20 simulated attacks to help organizations test their cybersecurity systems. The results of the attacks are eye-opening.
Dynetics’ teams breached each organization using some form of social engineering, such as deceptive email messages or phone calls. It took from two minutes to 23 days to breach perimeter defenses, and from 40 minutes to 60 days to fully compromise systems.
The potential for catastrophic impact was evident in 18 of the 20 breaches, and none of the 18 organizations at significant risk were aware of the test intrusion until notified by the hired attackers.
The results, according to the report, “show that traditional cybersecurity approaches alone are no longer effective against motivated hackers – hackers who are willing to target an organization and be intentional about their objectives.”
Results like that also suggest that Americans might not be intentionally accepting escalating cyber risks. Maybe they just don’t fully understand what they are up against.
The Sioux Falls Area Chamber of Commerce hosted the Sioux Falls Cybersecurity Conference; SDN Communications was a major sponsor of the event.
SDN Communications is a regional leader in providing broadband connectivity and cybersecurity services to businesses in communities such as Sioux Falls, Rapid City, Worthington, and the surrounding areas.
