Implementing cyber security measures is not an option for business today.  The increasing incidence of cyber-attacks and their increasing sophistication are an ever-present threat to business information assets.  Online security is a key weapon in the business arsenal against data loss and damage.

It’s not generally appreciated that the greatest threats to your cyber security come from inside your organisation, not from external hacks or attacks.  Users introduce malware, they try to circumvent security measures and on occasion make attempt to steal information or money.

Remember then that cyber security is not just about malware and cyber-attacks.   A complete strategy will cover all forms of misuse including theft of personal and sensitive information.

Here are three cyber security strategies focussing on managing internal threats to improve your online security.

1. Educate your users

   

   Users will understand the need for cyber security.  There are frequent reports in the media about the latest threat and horror stories about theft of data from prominent online organisations.   Users must also understand that online security is there not just to irritate them, but is a key component of the company’s defences against external and internal threats.

   However, having said that, users can bring malware into a company network on personal devices such as smartphones and flash drives.   Home cut DVDs are also a potential threat.

   Users will also swap logon information, leave passwords clearly visible, even to the extent of writing them on post-it notes and sticking them on their monitors, and allow other users to use their desktop.   All clear breaches of any viable security policy.

   A programme of education alerting users to the dangers of malware in general and proper user logon-information management is essential.   Regular informative updates will provide positive reinforcement. 

   Other techniques include regular forced password changes, and disabling USB and DVD drives.

2. Secure the Desktop

   

   Despite a carefully crafted education programme, users will persist in attaching smartphones, flash drives and portable hard drives to their office computers.  It’s difficult to fully disable them, since users often use flash drives to transfer documents to be printed or to take backups of work-in-progress so they can finish it at home.   DVD drives are not so much of a problem, since most software is now distributed over the Internet.

   Every desktop and laptop that is connected to the office network must have malware protection installed and regularly automatically updated.  The software must automatically scan any attached devices as they are plugged in, preventing their use until they have been scanned and disabling them if they are contaminated,

   Finally, users must not have administrator access to their desktop.  They must not be able to alter system settings or install software.  Many incidences of malware have been brought into company networks by users installing games.   Many companies also restrict access to the Internet and limit the ability to download material.

3. Continual Monitoring

   

   A business may have industrial strength anti-malware software and appliances, but it is still vulnerable to new threats.  As one commentator said, the only secure environment is one that hasn’t been hacked yet.

   The prudent network manager has monitoring tools that provide alerts when an actual or attempted cyber-attack is detected. 

   One area that is often overlooked is monitoring of the activities of users.   Creation of user accounts must be strictly controlled.  Monitor failed log-on attempts to see if someone has simply forgotten their password or is attempting to get around security.

All-in-all Cyber-Security is an ongoing tussle between malware providers, malware preventers and users and hackers trying to subvert online security.  The price of a secure security  environment is eternal vigilance.