Fortifying Your Digital Assets against Cyber Attacks

Data needs protection. Cyber security shields all official, sensitive or important data from theft and damage. Companies that lack cyber security programs are unable to defend themselves against data breach campaigns. [1] It makes them appealing targets for cybercriminals. Cyber attacks target personally identifiable information (PII), protected health information (PHI), personal information, intellectual property, and government or industry information systems.

Data risk is now both inherent and residual. Global connectivity and usage of cloud services to store sensitive data and personal information have augmented cyber attacks. [2] Prevalent poor configuration of cloud services and sophisticated cybercriminals further increases cyber-attack or data breach risk.

Businesses can no longer depend exclusively on cyber security solutions like anti-virus software and firewalls. Cybercriminals are getting smarter by the day. Their strategies are becoming more and more resilient to conventional cyber defences.

Media reports reveal the cybercrime economy generates $1.5 Trillion a Year! The global COVID-19 pandemic has witnessed a massive rise in cyber attacks. [3] Since last January, numerous social engineering campaigns started exploiting the fear of the virus.

Malicious agents reportedly pose as representatives of banks or reputed merchants. At the time, they also pose as individuals like coworkers, managers, or IT administrators. According to 'Proofpoint,' a cyber security company, the volume of malicious emails has rocketed over the last few months. 

Organisations and employees need to be sceptical and trained to avoid damage from COVID-19-themed phishing. Companies must put in place technical safeguards. There is also a need for a multifaceted defence strategy, along with increased security awareness for workers. 

Cybercriminals are behind scams like Business email compromise (BEC). These scams deceive victims into transferring sensitive data or funds. This data could be personal or corporate. It threatens the actors' accounts. [4] Additionally, these scams also attempt to steal credentials to infiltrate organisations and compromise information systems. They primarily target corporate payment systems. Once successful, the attacks can lead to more fraud.

However, before the global pandemic, executive teams faced challenges while protecting their institutions from cyber-attacks. It happened despite their concerted efforts to innovate and extract value from technology investments. 

The Chief Information Security Officers (CISOs) and the IT teams brainstormed to protect increasingly valuable digital assets. They also mulled over –

• Ways to weigh up threats associated with the increasingly fraught geopolitical environment
• Ways to meet more and more strict customer and regulatory standards 
• Ways to steer through disruptions to existing cyber security models. 

With companies adopting agile development and cloud computing, this has become a constant threat.

For years organisations have been taking stringent steps to keep their systems and data safe from cyber threats. [5] That said, the digital age brings in newer sets of challenges and vulnerabilities. It is tough to gauge how far cyber offenders would go to violate corporate information networks. Notably, cyber threats could be directed from outside or inside of an organisation. Often, a naive and neglectful act by a new employee does severe damage.  

Reasons are aplenty why cybercriminals seem to win the fight. First, there is no doubt that cybercrime pays. Today, most cyber-criminal outfits operate like legitimate businesses. They carry out organised operations, strategies, support, and profits. They reinvest their pilferage in research and development efforts.

Here are some steps that companies can take to protect their digital assets:

• The workforce of an organisation is the first line of defence. Companies must protect themselves by encouraging employees to be sceptical of emails from unknown senders. [6] It is also vital to doubt emails from familiar people. Emails from the company's CEO or the family doctor, who do not usually communicate with you, can be spurious.
• Companies must allow cyber security teams to work collectively with fraud risk management teams. This coordination will strengthen detection-and-response activities.
• Companies must assure their workforce that greater awareness is a powerful solution. Coaching all employees is a great way to fortify your digital assets. 

Organisations should train their workforce to do the following:

• Do not click on links or open attachments from unknown senders or those who do not usually communicate with you.
• Refrain from forwarding suspicious emails to coworkers.
• Inspect the sender's email address to ensure it's from a valid account. Check the linked web addresses. You will find it in the "to" and "from" fields. Try to identify if there is a slightest change in the characters. Such a change makes email addresses appear visually accurate. For example, it is highly dubious if a dot com domain is in place of a dot gov.
• Note down grammatical mistakes in the email text. Such errors are generally a clear sign of fraud. [7]
• Always inform about the suspicious emails to the IT or security department.
• Make sure to install the organisation-permitted anti-phishing filter on browsers and emails.
• Make use of the corporate-approved anti-virus software to scan the email attachments.
• Stay away from donating to charities by clicking links in an email. Instead, visit the charity website and do the needful.

Ways to Stay Safe from Cyber Attacks

Companies all over the world are dependable on their digital assets. To fortify the digital assets, they must deliver a secure environment for networks, applications and systems. [8] An organisation's cyber security experts will have to implement a security design based on the latest innovative technology. It ensures the complete safety of the digital assets.

Here is what companies should do to stay safe:

Plan a Response to Phishing Attacks

Organisations should integrate lessons learned from previous simulations. It is essential to seal gaps in the response plan. They should allocate responsibility for communicating with stakeholders, like customers and the media.

Fortify Perimeter

Companies should use security solutions to prevent and ward off threats before attackers can break through the systems. Integration of tested and proven detection and monitoring controls can be of great help. It is also crucial to minimise exposure to attack and limit access to sensitive data. 

Strengthen Remote Access Management Policy and Procedures

Another very effective measure is to put into practice multi-factor authentication. It is vital for VPN access, IP address white-listing, and remote desktop protocol (RDP) access limits. Extra scrutiny of remote network connections is also highly imperative.

Strengthen End-Point Protection

Companies should be careful about protecting their devices against the standard and advanced malware. Think of testing the security software to ensure it works as it should. Also, employ it in a broader detection-and-monitoring program. Moreover, by all means, harden and patch the devices. 

Secure Supplier Portals

Make it a point to secure supplier portals and other externally facing applications. Ensure that they use multi-factor authentication and risk-based authentication. It is particularly true for applications allowing suppliers to change bank account information, divert payments or make changes impacting financial costs.  

Additionally, it is better to strengthen financial and treasury controls. Make sure that they require call-backs or confirmations of emailed payment and change requests.

Widen the view of threats and risks during a crisis. Team up with risk management and fraud management professionals to enhance detection, monitoring, and hasten responses. Also, join forces with Financial Controls, Treasury and Fraud teams to reinforce fraud prevention and detection. 

Backup

Set up a hybrid policy for backing up the company data. Make sure of a local backup as well as a cloud solution. It will be of great relief in case of a disaster.[9] Remember! It is highly crucial to test the Backups. The best way is to try it once a day. If you want first-rate recovery, go for an hourly backup.

Conclusion

The current cyber security industry has too many security vendors and products. It is time that the industry gets consolidated. The need of the hour is a fully integrated approach to cyber security. The process will be one in which humans and machines work together in a self-automated and coordinated manner. It will help to combat the unrelenting and ever-growing cyber threats effectively. 

Global cyber security leaders recommend an upbeat and precautionary approach to manage vulnerabilities. The consensus is that protecting the network perimeter, keeping end-point devices patched, and building clear access protocols are indispensable in guarding data repositories against infiltrators. 

Sources

1. CES Limited (online) "Protect your Digital Assets from Cyber Threats with Vulnerability Management" Link accessed on 07 Oct 2021. 
2. Ibid.
3. PWC US (online) "How to protect your companies from rising cyber attacks and fraud amid the COVID-19 outbreak" Link accessed on 07 Oct 2021. 
4. Ibid.
5. V 500 (online) "Intelligent Cyber Security" Link accessed on 07 Oct 2021. 
6. Ibid.
7. Fabian Muhly, Jennifer Jordan, and Robert B. Cialdini, Harward Business Review, "Your Employees Are Your Best Defense Against Cyberattacks," Link accessed on 07 Oct 2021.
8. Multiple Authors, McKinsey & Company, "Cybersecurity in a Digital Era" (pdf, online).Link accessed on 07 Oct 2021.
9. MTC Member POV Blog, Maryland Tech Council (online) Link accessed on 07 Oct 2021.