Imagine the scenario: you’re on the frontline of a call-centre, helping run a customer service helpline.
You receive a call from a woman – she’s flustered, and you can hear a baby crying in the background.
She’s polite and apologises continually for the noise of the baby, who sounds sick. She can’t remember the username to log in to the account attached to the phone number she’s calling from. Out of goodwill, you give it to her.
Thinking the call is over, you offer: ‘is that all I can help you with today?’. Come to think of it, she says she would like to add a user to the account and wants to know how to get a password for the user. You say the password has to be texted to her, but (with baby screaming in the background) she says her hands are full and just asks if you can give it over the phone. Looking to help a young mother out, you give it to her. She thanks you profusely and hangs ups.
The only issue is she isn’t a young mother nursing a sick and screaming baby. She’s a social engineering hacker, who has spoofed a phone number and then weaselled her target’s account details out of you.
The face of cybercrime has changed,
alongside the strategies used. It’s no longer just the teen hacker in
the bedroom, it’s a variety of different faces and people with a
broadening array of tactics. And what’s more, in the current
climate of goodwill it is increasingly easy to get caught up in one of
these highly emotional traps.
Cyber criminals look to cash in on uncertainty
While the environment of three months ago
may have felt like a lifetime ago, cybercrime hasn’t been furloughed –
it’s one constant that’s remained the same, and if not the same –
increased its presence. Cyber criminals have proven
themselves merciless in the face of a global crisis – the
WHO for example reported a fivefold increase in cyber-attacks
against its staff since announcing COVID-19 as a global pandemic, with
some scammers even impersonating WHO in order to channel donations to a
fictitious fund.
Those that mean to do harm will continue to look for the weakest
link. And while cyber criminals continue to boast of their successes –
businesses feel ashamed when they are the victim.
The point is, it isn’t security needs
that have changed during the past few tumultuous months. What has
changed is the need for improved education, to keep businesses and their
employees updated on the basic principles to keep
them safe. As we move to a more hybrid way of working in the future,
with employees operating from home with more regularity, this education
piece will become increasingly important to maintain resilience against
hacks.
And this isn’t just a role for employer to employee. There is a role for governments and vendors across the industry as well.
The five cyber hygiene principles
So, let’s revisit these cyber hygiene principles:
1. Least Privilege
Just because you trust everyone in your business doesn’t mean that your receptionist needs the same access levels as your CEO. Give users minimum necessary access and leave your most valuable data vulnerable to far fewer breach points. You wouldn’t give a hotel guest a key for every room in the hotel.
2. Micro Segmentation
We don’t use drawbridges and castle walls anymore for a reason – they give a false sense of security and encourage lax approaches to security within the walls. Once your attacker infiltrates your outer-defence the threat’s inside and there’s nowhere to hide. Breaking down your network into layers and self-contained areas keeps the entire system protected and ensures your access points aren’t left vulnerable to attack. Don’t neglect your perimeter, but don’t rely on this alone. This is where intrinsic security – building it into your network and your application platform – makes security sense. As a business model flexes to meet the needs of a Covid landscape, it is this type of security that will help meet these needs. And should there be a breach – it is contained without infecting the rest of your business.
3. Encryption
Think
of encryption as the last weapon in your arsenal against hackers –
except with cyber security it keeps you ahead of the game. If all else
fails and your firewalls and
access protocols are breached, encryption means that all the critical
data you have stored is useless to them. Like a Rubix cube, if you don’t
know how to decode it and put it back together, encrypted data is a
difficult puzzle to crack. Basic cyber hygiene
means encrypting your files and data before sharing. The same applies
to encrypting network traffic wherever possible.
4. Multi-factor authentication
From
thumb-print ID to facial recognition, security is becoming personal.
But even implementing basic two-factor authentication stops the first
wave of breaches. And, the
more personal we get with authentication, the more secure our networks
will be. After all, your thumbprint is much more difficult to steal than
your pin code!
5. Patching
Systems
require updates for a reason. Every time malware gets more advanced
your service providers respond with system and software updates. Don’t
remain in the past. Upgrade
and update to stay ahead of your attacker’s game.
Education, Education, Education
Although the recent pandemic has meant
that everything has changed, when it comes to basic cyber security, we
should presume that nothing has changed. The same basic cyber hygiene
principals, which are often the simple ones that
are forgotten or overlooked, are still just as relevant. They should be
kept front of mind to keep businesses – and their employees – safe. This
will help to safeguard data wherever it lies, whether on a desktop at
home, mobile, or laptop in transit – or a
combination of them all.
Ultimately,
successful cyber security is all about identifying people as the first
line of defence. Whilst an organisation can invest in hundreds of
different tools, if the people unwittingly roll out the carpet
to let the hacker in right in front of them, then it’s all for nothing.
As a security practitioner, your primary efforts should start with
education. A mandatory education process should be in place for
everyone: from IT professionals and business leaders,
to employees and third-party contractors, with applications sitting at
the core. Focus on your people first, and then look to simplify your
systems.
Just like washing your
hands, good cyber hygiene habits protect everyone, and prevent the
spread of maladies with the potential to decimate communities.
