{"id":59943,"date":"2022-03-04T12:42:00","date_gmt":"2022-03-04T17:42:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=59943"},"modified":"2022-10-18T18:58:27","modified_gmt":"2022-10-18T22:58:27","slug":"shields-up-remember-your-cyber-security-fundamentals","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/shields-up-remember-your-cyber-security-fundamentals","title":{"rendered":"Shields Up: Remember Your Cyber Security Fundamentals"},"content":{"rendered":"\n
It\u2019s an uncertain and troubling time in the world. Geopolitical conflict has enveloped Eastern Europe, but the frontlines aren’t restricted to that region. Cyber attacks can swiftly cross international borders. Nation states, as well as hacktivists,<\/a> could adopt cyber warfare as a tactic to extend the battlefield, everywhere. This is a sensitive topic, and it\u2019s important to stay vigilant in times like these and review your security best practices in preparation for any major escalation in these attacks.<\/p>\n\n\n\n It\u2019s been said that unintended consequences are among the only certainties in war. A discussion about cybersecurity is appropriate given the velocity and worldwide reach of these events. Your organization\u2019s best defense is to proactively plan and implement security best practices. Taking the time to review your cybersecurity posture limits the potential for unintended consequences.<\/p>\n\n\n\n The threat environment is so concerning that The Department of Homeland Security (CISA) has advised organizations of all sizes to put their \u201cshields up<\/a>.\u201d You don\u2019t have to be a government agency to (hope for the best\u2026 but) prepare for the worst. Just begin with the basics. Cyber security is more approachable when it\u2019s broken down into three essential concepts:<\/p>\n\n\n\n Remember the Colonial Pipeline hack? It occurred due to poor IT hygiene<\/a>, which is catch-all terminology for inappropriately configuring and maintaining all of your user accounts, apps, and devices throughout their life cycles. The pipeline attack wasn\u2019t an example of master spycraft: it happened because old user credentials were unmanaged and had access to resources that enabled attackers to pivot onto bigger things. Tip: don\u2019t be like them, follow <\/em>Zero Trust Security<\/em><\/a> instead.<\/em><\/p>\n\n\n\n Zero Trust Security is a concept that trusts nothing and verifies everything<\/em>, which in essence states that in order for all<\/em> users to be authenticated and authorized to access resources, they must be continuously challenged inside and outside of your organization. <\/p>\n\n\n\n For example, the old security paradigm was \u201cBen trusts Katie, and Katie trusts Tyrone, so Ben trusts Tyrone.\u201d That\u2019s no longer satisfactory given the scope and omnipresence of today\u2019s cyber threats. Configure your systems with the belief that \u201cnothing is secure\u201d and you\u2019ll be far better off. These are some of the steps that you should take to implement Zero Trust:<\/p>\n\n\n\n Devices and users only need access to the minimal permissions to get their job done. No PC user should be operating as an administrator day-to-day, even IT admins themselves. Know who your users are and what they have access to.<\/em><\/p>\n\n\n\n Software is complex, and you should assume that there\u2019s vulnerabilities present in operating systems and down the stack. Applying fixes to bugs, on schedule, and maintaining up-to-date licensing and support reduces the risks that these will be exploited. A device might be logging into your systems with appropriate credentials, but it carries risk forward if it\u2019s not being regularly patched.<\/p>\n\n\n\n \u201cLive and let live\u201d is not an acceptable security control on devices and with people. All devices within your fleet should be deployed \u201chardened\u201d, that is to say, that rules are applied to limit what changes can be made to settings. Unmanaged devices provide attackers with greater surface area to find their way in. Policies may also apply to how strong your users\u2019 passwords are and whether MFA is enabled. Policies also apply to your staff, such as mandatory vacation time or limiting access to network hardware.<\/p>\n\n\n\n User lifecycle management is no less important than how well devices are secured. Who has access to what and whether there\u2019s assurance that they\u2019re who they say they are (working from a location that\u2019s acceptably secure) is vital to IT hygiene. Modern IAM systems require more than one level of authentication, may use single sign-on (SSO)<\/a>, have the capacity for conditional access, and more closely manage group memberships.\u00a0<\/p>\n\n\n\n Practicing security awareness isn\u2019t a technical control, but it\u2019s no less vital. Your employees, an administrative control, should serve as human firewalls who know when to speak up and \u201csay something\u201d when they encounter unusual activities. That could be as simple as contacting the sender of a suspicious email using a different medium.<\/p>\n\n\n\n You don\u2019t need limitless resources to implement Zero Trust security. It\u2019s within reach by combining technical, administrative, and physical controls<\/a> to mitigate or reduce your risks. You ultimately should have a formalized security program<\/a>, but don\u2019t get discouraged. You already \u201cknow enough to be dangerous<\/a>\u201d and can begin to introduce better IT hygiene to your organization. <\/p>\n\n\n\n Security tools and services are expressly designed to help mitigate risks, but SMEs should take care to avoid security tool sprawl<\/a>. Some systems require intensive resources that smaller organizations simply don\u2019t possess. Master the tools that you have, partner to extend those capabilities when it makes sense, and consider vendors that can more externally handle those risks on your behalf. Some examples of tools that you should<\/em> consider using are:<\/p>\n\n\n\n We used to just call this antivirus software, but EDR solutions have evolved to analyze system behavior and even block common methods of attack. These systems are manageable and will help to secure devices. EDR software isn\u2019t sufficient security as a standalone control: your organization should form a defense in depth<\/a> using people, operations, and technology.<\/p>\n\n\n\n Monitoring ranges from logs and reporting to robust enterprise-grade systems that take every event into account within your environment and across domains. It\u2019s not practical to expect an SME to have the resources to fully staff advanced security information and event management (SIEM) and Security Operations Centers (SOCs) that run threat hunting on data lakes. However, anomalous behaviors can be detected if you know what you\u2019re looking for and don\u2019t lose focus. Otherwise, you\u2019ll just be spending a lot of your budget on a glorious post mortem. <\/p>\n\n\n\n Consider outsourcing this capability if your IT budget<\/a> provides for it, or select vendors that perform these activities to secure the services that you\u2019re purchasing from them.<\/p>\n\n\n\n Next generation firewalls, VPNs, and a software-defined perimeter (SDP)<\/a> are other tools that can secure your network. Remote workforces won\u2019t necessarily utilize all of these, so it\u2019s also important to think about how you\u2019re going to secure and manage your users everywhere <\/em>they\u2019re working, whether within a domain or in the domainless enterprise. <\/p>\n\n\n\n There\u2019s no universal elixir for better security: every organization has different requirements. However, there\u2019s always a benefit to following best practices, such as having good backups. Every organization should have a plan to respond and recover from a cyber incident.<\/p>\n\n\n\n Security is a process, not only \u201cstuff\u2019. Incident response and understanding what happens following an attack are crucial. That\u2019s where your backups might come into play. We recommend working with an MSP partner or other experts to create, adopt, and practice what your organization will do if it\u2019s attacked, otherwise known as a cybersecurity tabletop exercise<\/a>. <\/p>\n\n\n\n Cyber insurance<\/a> is another option, but be mindful that there are some pre-existing conditions<\/a> that make it more difficult to obtain coverage. Following good IT hygiene mitigates that risk.<\/p>\n\n\n\nSecurity Best Practices<\/h2>\n\n\n\n
Practicing Good IT Hygiene<\/h3>\n\n\n\n
Master <\/em>Your <\/em>Security Tools and Services<\/h3>\n\n\n\n
Endpoint Detection and Response (EDR)<\/h4>\n\n\n\n
Monitoring<\/h4>\n\n\n\n
Network Hardware and Software<\/h4>\n\n\n\n
Incident Response and Business Continuity<\/h3>\n\n\n\n
Additional Resources<\/h3>\n\n\n\n