Cyber Security: A definitive guide for SMEs

Part 3: 
How to protect your business from cyber threats (Action list)

Every business, no matter what computer system you use, must work to continually protect themselves from cyber attack.

The below action list are all preventative methods to protect your business from a lot of different types of cyber threats:

• Backups,
• Managed and Maintained Computer Systems,
• Passwords,
• Two-Factor Authentication,
• Safer Emails,
• Staff Training,
• User Access Control.

In the next chapter we talk about what to do if you are attacked, and many of those methods can rely on the following protection techniques to get your company back online.

Action Item #1 - BACKUP, BACKUP, BACKUP! 

Backups are the most critical component of any IT recovery / cyber attack recovery plan. If you haven't had one implemented, do so as soon as possible.

Digital copies of your data should be made as frequently as possible, in a way that is as automated as possible, and to an external location. This can include two major backup solutions, as follows.

A) Cloud backup

Cloud backup is preferred as it can be set to run automatically, meaning it doesn't need human intervention to work.

Cloud backup is, by design, isolated from your computer systems and most keep versioned history of your files or other data (so you don't need to manage your backup media). They also go a step further and encrypt data more than a traditional backup generally does - this helps protect your information.

Recovering data from cloud backups can be quicker and more convenient, as it can be recovered to a completely new computer system immediately.

Depending on your IT environment, how this solution is implemented can vary.

• If you have a server, you may need to pick a solution that works specifically with databases, and full system bare metal recoveries.
• If you run multiple computers in a non-networked environment, a distributed agent style backup solution would be an ideal option for backing up your whole teams computers in a managed fashion.
• Companies that run a lot of cloud services may want to backup their cloud platforms to protect against outages of those services.

It can get more complicated the more systems that a business uses, and in those cases (and even with the above examples) we would recommend working with a Managed Service Provider (MSP) to find a solution that covers everything you need in a safe way, protecting your data.

B) Physical media (an external hard drive, tape, or USB)

With this method it is important to make sure that any drive is disconnected from the computer system when not being backed up so that it's isolated if an attack occurs (and therefore protected).

For the same reason, multiple backup medias should be used incase you need to restore back even further or the data was compromised without you knowing about it. A good number is at least 10 (one for every working except one (4), and three to keep for only once every week in rotation, and another (3) to use only once every three months in rotation).

C) Backup Best Practices

Best practices for any backup solution include:

• Scheduled regular testing of data recovery / the backup solution (try to recover said data);
• Make sure your backup solution meets regulations and/or industry guidelines (as an example, in Australia medical data cannot be stored outside of the country, therefore cloud backups from overseas providers are in breach);
• One backup solution is good, two is better; three is better still: you really cannot have enough backups, or backup methods to fall back to;
• Record confirmations of backup successes or failures - especially with automated backup solutions. (for example, email with the results of a backup session);
• Use software to manage the backup schedule, and the data that matters in the backup solution (this is especially important for physical media; cloud backups tend to do this by default).

If you don't have time to manage a backup solution (regardless of the type), you should consider outsourcing this to a Managed Service Provider (MSP) or other IT support company.

This way you have a group responsible and focused on your data backups.

D) Some things to consider when choosing an MSP:

• What level of support do you want from the solution (Business hours would be the minimum you would want here, with after-hours support if needed);
• Does this firm cover any industry regulations you have to meet (i.e. data storage in Australian only)?
• Pricing method (are they charging pay as you go, or fixed rate? Usually pay as you go works out cheaper as you don't pay for unused storage);
• Are there any other cost factors like data transfer fees or licensing fees? (most solutions don't anymore);
• Is data encrypted and physically secured in a datacentre (If not, do not proceed);
• The service providers reputation. (Do you trust them with your data?).

Action Item #2 - Passphrases, not passwords

Authentication is a major part of security in today's computer systems, and right now that means passwords - sometimes backed up with Two Factor Authentication (2FA).

All users should have passwords with a complexity that cannot be easily guessed by simple dictionary attacks or similar techniques.

Unfortunately, even today common passwords still include for example 'Password123', 'abc123' and worst of all... 'password'. *facepalm*

To break it down:

With modern hacking tools, 'password123' can be obtained instantly, or purchased with a black market value of $0.01. Even a more complex password like 'A&d8j+1' only takes 2.5 hours to crack and can be purchased for around $30.60, according to the Australian Government Australian Signal Directorate.

Instead using passphrases is a better way to secure your accounts.

A good example of a password to use is: 'I would prefer I didn't have to use passwords!': spaces, exclamation points, and apostrophes make it easy to remember and difficult to hack; more than one year with a Brute Force attack and 40 days with a dictionary attack - a great improvement. 

Action Item #3 - Employee Training and a Cyber Culture

Employees make mistakes, as all humans do. However, there are legal and ethical ramifications (not to mention financial ones) when information is stolen or systems compromised.

Staff training doesn't need to be big, or difficult; it can take multiple forms which may work better for your company culture.

Some example areas to focus on:

• How to identify a phishing email or bad email attachment.
• How to safely provide files to (and receive files from) a client or supplier.
• How to know if a website is compromised.

Training can take many forms, including:

• Online security training portals.
• Helpful hints sent to all staff fortnightly or monthly.
• One-on-one sessions with IT support staff if they are unsure of anything.

The goal is to create a cyber aware culture through the whole business to decrease the chance of events, and to spot issues before they become major incidents.

Action Item #4 - Managed, Monitored, and Maintained computer systems

To protect against malware, hacks, ransomware and more it is important to have a fully maintained computer system. This includes a few different elements:

• Updates to applications and operating systems as or as soon as possible after release.
• Updates to firmware on all devices (especially network equipment) as or as soon as possible after release.
• Vetting software before it is installed for any issues (and making sure they are integrated into the backup solution for the firm).
• Physical Firewalls and Security Gateways are updated and configuration monitored.
• Antivirus installed to all computers and updated everyday (every three hours where definitions are on that cycle).
• Software firewall or Internet filter deployed to all portable devices that may not be protected by the physical firewall of the place of business
• Identification of threats that may be operating within your computer network (like unsupported Windows Operating systems, or rouge software).
• Extended management of other IT assets (user accounts, server hardware, and more).

Once you have the above basics in place, the next priority is to monitor and maintain in an ongoing basis. This often takes the form of a managed IT service from a MSP company.

Action Item #5 - User Access Controls

Limiting access to areas of the business computer systems that staff don't need in order to do their job helps segment risk.

An example is if a receptionist computer is taken down by malware, only the files that person has access to would be compromised. Because the receptionist doesn't have access to other files - in most cases - this would also protect those files.

This also protects from other threats to business data like internal espionage and data theft.

Staff should also be warned to not share their passwords/passphrases and not keep passwords in easily obtainable locations (ie. post-it note on their desk). As staff members leave the company, their accounts should be disabled as soon as possible.

In most cases, the least privilege a user needs to complete their role is what should be granted, to achieve this protection. Access level controls be be extended onto:

• Networks
• Applications
• Files
• Data
• Services (web hosting, etc).

In all cases, Administrator privileges should not be granted to any staff except a dedicated IT person and/or their company representative. 

Action Item #6 - Two-Factor Authentication (2FA)

Two-factor authentication (2FA) is a powerful tool to enhance traditional passwords which aren't always a strong defence.

It works by requesting, in addition to a password, a code which changes continually from an app on a mobile phone (like Google Authenticator / Microsoft Authenticator), text message, or physical token. Both the password and code are required to be entered in addition at login, to grant access to a computer system.

With 2FA, even if a password is stolen or guessed, you also need the 2FA code before gaining access to the computer system in question.

2FA is available on most platforms now, and is fast becoming an industry standard across the board.

Common business applications two-factor authentication can be enabled on include Xero, MYOB, Banks, Office 365, and more.

Action Item #7 - Safer emails with Phishing filters, and Managed Antivirus

Email is a major point of entry into business systems for malware, and often socially engineered like phishing attacks on companies. Because of this, it's important to deploy additional security tools to protect email services in your domain.

Most email services (like Office 365, Google Mail, and others) have in-built tools that help with basic protection. These includes tools like whitelists, IP address filters, and usually all preconfigured. They can be altered to provide better protection, but usually the best way forward is via more advanced third party tools focusing on email security.

These types of services include:

• Email antivirus filters for mail servers. These use enterprise-grade antivirus services to scan emails coming in at the server-level, before emails are handed off to end users);
• Phishing and social threat filters for mail servers. These services determine the likelihood of an email being real more effectively than standard tools. However, even these A.I. powered solutions aren't 100% accurate (false-positives), which is why...
• Phishing Threat Training tools are really good. They can help simulate a phishing attack on your own company and identify whether you should spend more time training your staff against this type of threat.
• Email Archive / Managed Service. These server-level email archive tools are really good because they backup emails as the server receives them. If a staff member deletes the email on their own account (or it is attacked), it doesn't matter, as you have it saved in a separate archive.

Part 5:
Always be vigilant with cyber security

1. Staff training, and a culture of security
2. Access control limitations
3. Updates of all computer systems
4. Regular, ongoing maintenance
5. Passphrases instead of passwords
6. Two-Factor Authentication
7. Backups (backups, backups!)
8. A good cyber threat response plan for your business
9. Managed, Audited environment
10. Safer emails (spam, phishing tools)
11. Cyber insurance for your business
12. A strong relationship with an IT provider.

Cyber threat evolution