October is Cyber Security Awareness Month, and as spring arrives in Melbourne, it’s the perfect time for a little spring cleaning in your cyber security strategy. With attackers finding more and more creative ways to “live within the seams” of your defences, here are five quick essential spring cleaning tips to ensure your security posture isn’t left in the dust:
- Encrypt your data: Encrypting your data is a simple yet powerful step in bolstering cyber security. The process is straightforward, whether it’s data at rest on your devices’ drives or in transit.
- Data at rest: Drive encryption is offered free on Windows and Mac. Itcan be easily enabled across an organisation using a variety of tools, from paid device management platforms like Intune, to tools included in domain management toolkits like Group Policy. Android and iOS both offer encryption, which can be set as a compliance requirement for devices
- Data in transit can be encrypted by ensuring data is transmitted over secure protocols like TSL and HTTPS. Various settings can be enabled on workstations to ensure that data is communicated across secure protocols only.
- Implement Multifactor Authentication (MFA): MFA adds an extra layer of authentication on top of users’ login credentials, preventing attackers from gaining access with stolen credentials by requiring a user to approve an access request within MFA application on their mobile device. These MFA applications can then require biometrics (such as fingerprints or face recognition) to ensure that the user who owns the device is physically approving the request. MFA can be quickly and easily enabled across Microsoft 365 environments, usually at no additional cost. Third-party products also exist to implement MFA across on-premise environments, securing access to internal applications.
- Patch Vulnerabilities Before They’re Exploited: Patching software has long been a staple for both IT operations and Cyber Security teams. With attackers exploiting vulnerabilities in software, vendors are constantly releasing patches to mitigate these exploits. A comprehensive vulnerability management system helps organisations know what vulnerabilities currently exist in their environment’s software. Knowing what’s vulnerable to attacks is half the battle won. Patching these vulnerabilities can be as simple as rolling out Windows updates, third-party application updates or device firmware updates.
- Educate Your Users to Recognise and Report Threats: Your users are the first line of defence when it comes to Cyber Security. CrowdStrike’s 2024 Global Threat Report found that “Identity-based and social engineering attacks shaped the threat landscape in 2023”. Educating users can not only help stop attacks from occurring, but also provide support to a sometimes overstretched cyber security team. You team should understand the importance of maintaining secure passwords, being wary around clicking links in unknown emails, and, most importantly, feel comfortable expressing concerns with security teams.
- Secure the remote workforce: The digital world has changed significantly in the past five years, and remote work has now established itself as the new normal. With many users now able to perform their roles remotely, the challenge many organisations face is enabling users to continue to work efficiently without compromising security. Securing access via remote corporate devices can be accomplished with tools such as Conditional Access policies, allowing only devices that meet certain criteria access to your organisation’s data. For users accessing via BYO devices that are unable to meet these criteria, other avenues are available, such as secure Enterprise Browsers, enabling remote users access to an organisation’s data via managed browser session with controls in place to prevent data from leaving the browser.
Stay ahead of attackers and make security a top priority this October.
