Cybersecurity Awareness Month: Level Up Your Defenses
Welcome to the second week of Cybersecurity Awareness Month! We’ll be going beyond the steps in last week’s Cover Down the Basics post with more ways to enhance your organization’s security posture.
To level up your cyber defenses, we’ll be covering three cybersecurity practices: encrypting data, backing up data, and logging system activity.
Encryption
Your organization has valuable data! That’s why hackers are after it and why you put defenses in place—so it doesn’t end up in the wrong hands. Both when it’s stored and in-transit, that data should be encrypted in order to keep it confidential. In other words, the data should only be accessible by authorized individuals.
The use of modern cryptographic hashes and digital signatures should be utilized to protect the confidentiality and integrity of data when communicated over a network. Requiring network protocols to utilize Transport Layer Security (TLS) and configuring your systems to only use version 1.2 or higher are highly recommended!
When important data is at rest, it should be encrypted using modern cryptography—ideally a quantum-resistant cryptographic mechanism! In terms of day-to-day security, sensitive information such as credentials should never be stored in a plaintext file, but rather in a password manager or an encrypted file (like we talked about last week).
Data Backups
What happens to your data if lightning strikes the transformer outside company HQ and fries your file server? In the event of data loss, it’s crucial to have a plan to restore data!
Backing up your data is important for organizations of every size and industry to ensure they can recover from such a situation and continue operations. This can be having data in both local and cloud storage or having a secondary site which can be restored from the backup in case of an emergency. Two important factors to take note of when developing a backup strategy are frequency and integrity.
First, define the frequency for scheduled backups based on criticality of systems & data. If all your employees work from a single file server, you may want to back it up daily because of how frequently data changes. On the other hand, an internal application server used by a small group for non-critical data could be backed up on a weekly or monthly basis instead.
With regard to integrity, organizations should check restoration assets for potential integrity issues before storage or restoration so data is verified for accuracy and reliability. Consider creating immutable backups (ensuring backup data can’t be modified) to protect against potential threats to your backups like ransomware.
Establishing an approach to data backups is an essential part of broader contingency planning so that if the worst happens, an organization can recover without experiencing a dramatic loss.
Activity Logging
In addition to encryption and backups, organizations should configure systems to log activity—and to detect anything which may be malicious! At minimum, systems should log activity by privileged accounts (e.g., administrators) as well as changes to system configurations.
The information from logs can help investigators determine exactly what happened if there’s an issue, such as whether a system crash was a benign failure or an indicator of compromise by a threat actor. We won’t get into every type of information which should be logged, but a quick search will turn up useful recommendations like OWASP’s logging cheat sheet.
Beyond manual review of logs, tools like intrusion detection/prevention systems (IDS/IPS) can be used to monitor systems and streamline responses, but they depend on having accurate logs to do so! All of these are reasons to ensure activity logging is performed on IT systems.
You're Halfway through Cybersecurity Awareness Month!
Now that you’re informed about three more methods to level up your organization’s cybersecurity posture, you’re halfway through our series on understanding what every person and organization should be practicing in today’s digital age!
Next week, we’ll be diving even deeper into how organizations can be prepared for when an incident occurs (spoiler alert: hoping one doesn’t happen isn’t a viable strategy!). Stay tuned!
About Triumvirate Cybersecurity
Triumvirate Cybersecurity is a CyberAB Registered Practitioner Organization (RPO) which specializes in cyber compliance for small and mid-size government contractors. Based in Dayton, Ohio, we help organizations make sense of requirements, implement effective security programs, and achieve compliance with confidence so they can get back to what they do best!
Ready to level up your journey towards compliance? Reach out through our Contact page or directly via email to info@triumviratecyber.org.
