As data breaches become more commonplace, littering the headlines on a daily basis, businesses of all types and across all industries need to work on the assumption that they are a target, says ICT services and solutions provider, Dynamic Recovery Services (DRS).<\/p>\n
Because of this, organisations, especially those who house sensitive, valuable and proprietary\u00a0 data, need to ensure that they have a solid security strategy, as well as an incident response plan in place.<\/p>\n
\u201cAny good security strategy needs to be a combination of technology, people and processes. Moreover, the strategy needs to be tested on a regular and ongoing basis,\u201d said MJ Strydom, managing director at DRS.<\/p>\n
He said this is where penetration testing comes in. \u201cWhat better way is there to prepare for an attack, than to have experts, who have the same skills that the cyber criminals do, see if they can breach your defences. This will ensure that the right protocols can be put into place should any real-world attacks happen.\u201d<\/p>\n
Penetration testing (or pen testing) is essentially running controlled hacking exercises against a business network and systems in order to show how threat actors might be able to get in.\u00a0 It can see any number of manual and automated tests being performed on corporate networks, systems as well as individuals to determine if they are susceptible to an attack. \u00a0<\/u><\/u><\/p>\n
According to Strydom, the intelligence gleaned during these exercises can then be used to highlight and sort out any weaknesses that are found. This helps organisations to close any security gaps, and shut off possible attack vectors.<\/p>\n
\u201cIt also helps them to truly understand how attacks work so that they are better equipped to handle any actual threats that may occur in the future.\u201d<\/p>\n
He cautioned that there is no silver bullet solution when it comes to security. \u201cThe chances are that any hacker who is determined enough will eventually get in. At its core, security is nothing if not an exercise in lessening the attack surface to the very possible minimum.<\/p>\n
“Cyber criminals will always take the path of least resistance, and go for the low hanging fruit. The best a business can hope for is to make themselves a less attractive target than the next business.\u201d<\/p>\n
He said companies should also follow the basics, and ensure that security efforts are concentrated on the most valuable assets first.<\/p>\n
\u201cA lot of services, for example, don\u2019t need to be directly accessible to the internet. Think before having a blanket approach to all resources. In addition, have two, or even three-factor authentication in place, especially for any services that would be high value should the business be compromised.\u201d<\/p>\n
Also, don\u2019t just have a stringent password policy in place, actually enforce it, he added. \u201cA company can say they insist on strong passwords, but someone will always go the easy and memorable route. Insist on the strongest possible passwords, and make sure they are changed on a regular basis.\u201d<\/p>\n
Humans are often the weakest link in s company\u2019s security chain. \u201cEven the most security savvy employee can open a malicious attachment, or click on the wrong link. We all make mistakes, we all get distracted. Add to that the slew of devices flooding the enterprise thanks to BYOD, and the borders of the network get wider, and harder to control,” Strydom said.<\/p>\n
“Find out as soon as possible, and on a regular basis, where your weak points are, and where security posture needs to be improved. Any robust security strategy needs to be bolstered by thorough and ongoing testing, to make sure that confidential and proprietary data is better protected from increasingly complex and cunning cyber criminals.\u201d<\/u><\/u><\/p>\n
\n