Cyber Assessments

• Human errors can lead to security breaches (e.g. improper handling of data and documents, insider threats)

• Improper password policy implementation (e.g. using weak or easily guessed passwords, reusing passwords across multiple services, sharing passwords with other people, writing down passwords and storing insecurely)

• Poor system configuration can expand the potential attack vectors that can be exploited.

• Connecting systems to an unsecured network can open new doors for adversaries to exploit

• Development errors can introduce flaws into hardware and software systems that increase the risk of exploitation.

• The vulnerability of a system is proportional to the complexity of that system. The more features and capabilities available, the more avenues to exploit

• Improper risk management policy and implementation may lack coverage

• Lack of cyber training to staff increases the risk of human errors and security incidents

Cyber threats come in all shapes and sizes, but they typically are grouped in the following categories:

• Disgruntled employees
• Business competitors
• Industrial spies
• Hackivists
• Organized crime groups
• Terrorist organizations
• Nation states and national governments

The challenge in the cyberspace domain is the dynamic nature and scale of the environment.  An organization should consult a professional cybersecurity team to help identify and implement effective controls for their situation, like us!  However, here are some basic tips to get you started:

1. Know your network.  It is important to identify and track what hardware, software and users are apart of your environment.
2. Backup everything.  An organization should implement a layered backup strategy that includes onsite and offsite solutions.
3. Encrypt sensitive data and limit access.  It is important to securely store sensitive data and limit who has access to those files.
4. Unique password per service or application.  Password reuse is very common for the average user, but that also makes it easy for an adversary.  Using a trusted password manager service can help ease this practice.
5. Avoid untrusted software.  It is important to validate software before installing it on your computer devices and networks.  By cautious of freeware and shareware, these tend to contain malicious code inside.
6. Implement cyber defense safeguards.  Look into implementing firewalls, intrusion detection and prevention systems, web filtering, and endpoint protection to help mitigate common threats.
7. Train employees.  Ensure that you are providing recurring cybersecurity training that helps inform employees of the potential threats and what to look out for.
8. Assess your cyber posture.  It is important to conduct recurring cyber assessments against your cybersecurity program to help identify vulnerabilities before they can be exploited. Ensure that you have the legal authority to conduct assessments or hire a professional service.