WHAT MAKES SECURITY SYSTEMS VULNERABLE TO CYBER-ATTACKS?

Everyone claims to have network security in place. This doesn’t mean that everyone has network security that works. Unverified, untested cybersecurity is better than none at all, but it isn’t enough.

Many businesses are stuck in a system of protection that no longer works, if it ever did. Verizon’s 2018 Data Breach Investigations Report suggests that the Internet faces “an information security dystopia.” According to the report, “cybercriminals are still finding success with the same tried and tested techniques, and their victims are still making the same mistakes.”

Poor security puts the personal information of individuals at risk. Industries, such as healthcare, have seen repeated failures. HIPAA Journal reported in March 2018 that data breaches had subjected more than 41 percent of the people in the United States to exposure of their personal information.

Common Mistakes in Security

The mistakes most commonly found in security systems include using ineffective solutions, expending too much effort in the wrong places, or working from a good idea but not following through consistently.

Here are some examples:

• An inadequate or non-existent patch management program. Simply urging employees to keep their software up to date isn’t a patch management program. Without a systematic approach, people will overlook critically outdated software components. Sometimes, people avoid updating software because they’re afraid it will break. Sometimes, a component goes unnoticed because no one has been assigned the responsibility for it. A systematic approach is necessary to make sure nothing is left behind.
• Lack of vulnerability scans. Prioritizing software updates requires knowing where the critical weaknesses are. A vulnerability scan identifies software that has known weaknesses and ranks the problems by severity. Without vulnerability checking, serious security holes will go unnoticed.
• Inadequate account protection. Many organizations don’t have a policy defining and requiring strong passwords, or they don’t enforce it. They don’t purge expired accounts. They grant privileges too freely. They don’t limit login attempts. There’s no move to multi-factor authentication. Without these protections, life is easy for people trying to break into accounts.
• Insufficient application-level protection. Protection only at the network level overlooks threats, which are tailored to applications. Web servers and other public-facing applications need their own filtering and threat detection.
• Incomplete network coverage. An inadequate security system doesn’t cover all devices. Common mistakes include letting mobile and Wi-Fi devices in without restrictions and allowing telecommuting without setting up a VPN or equivalent protection. Getting into the network may be as easy as using a laptop in the parking lot.
• Lack of testing and monitoring. A security system may sound strong when its authors talk about it, but without independent verification, there’s no way to be sure. No protection is perfect, and intrusion detection is as important as prevention. The Verizon report states that two-thirds of system compromises go unnoticed for months or even longer.

An effective cybersecurity system takes a multilayered approach. It protects the entire network perimeter, including user-owned and cloud connections. It limits the ports and services, which are available by direct Internet access. It monitors all systems for signs of intrusions and malware. There’s no single point of failure; an attacker has to jump through multiple hoops to do any damage.

The consequences of inadequate security are expensive. System downtime and data loss have direct costs. Beyond that, failure to take adequate precautions can be evidence of negligence. Regulatory fines, such as those under HIPAA, can be huge if a breach is due to lack of care. People whose information was compromised can take legal action.

If your network’s security system hasn’t had a thorough review recently, it needs one to make sure it can face today’s many threats. Orenda Security can help with risk assessment, penetration testing, and DAST.

Contact us today to request a quote!