Another year is almost over and there is still no let-up in the level and volume of cybercrime. To mitigate these continued cyber attacks, MetaCompliance suggests five cyber security best practices in 2023.
In 2021, surveys and reports exploring the cyber threat landscape offered some stark warnings: IBM recorded in “Cost of a Data Breach Report 2021” that cyber attacks this year resulted in the highest costs ever associated with security breaches in the 17 years of the report’s history; a further report found that ransomware had almost doubled in the first half of 2021; and phishing continues to be the “top action” variety of attack, according to Verizon, to the point that email security was determined to be the top IT project of the year.
All this activity sets the scene for what is to come next year and the vulnerabilities your organisation will be up against. Learning lessons from the last few years we can develop some best practices to help our organisation withstand cyber attacks in 2023 and beyond.
Stolen Credentials and Phishing Still Favoured by Cybercriminals
The analyst reports and surveys over the last year have found common ground in stolen credentials that then lead to data breaches. Tactics and techniques are chained together to form the cyber attack:
Phishing of employees leads to stolen credentials that lead to unauthorised access that leads to data breaches, malware, and ransomware infection.
IBM’s Cost of a Data Breach report analysed the data breaches of over 500 organisations. The report found that the repercussions from the COVID pandemic, such as home working and increased use of cloud-based services, have led to increased cyber attacks that were more costly. Much of this was due to IT security being unable to keep up with the sudden shift to new working patterns and technology.
The study found that stolen credentials were the most common cause of information security breaches. The report also noted that 82% of individuals reuse passwords across multiple accounts, leading to credential stuffing attacks and account takeover.
In November 2021, industry publication Dark Reading, carried out a survey into the types of cyber threats over the previous 12 months. The results show that phishing remains the number one cause of a data breach, with over half of companies surveyed revealing they were a victim of a breach.
5 Cyber Security Best Practices in 2023
The cyber security best practices in 2023 below offer ways to take on the spectre of cyber attacks, head-on:
1. Make 2023 the Year Your Security Policies Come to Life
Security policies should not be a tick box exercise. Having a well-thought-through and actionable security policy is the basis for a sound approach to data security and the development of a positive security posture.
In 2023, move the security policy dial by engaging your employees in the deployment and enforcement of your policy needs. Policy management software can help you achieve this by engaging your employees with the important aspects of the policy that affect them. A robust and actionable policy will also protect your company’s reputation and standing in terms of security standards and data protection regulations.
2. Engage Your Staff in the Fight Against Cyber-Threats
The UK’s National Cyber Security Centre (NCSC) has stated:
“People should be at the heart of any cyber security strategy”
2023 needs to be the year where organisations create strength through education.
Your employees are central to the fight against cyberattacks. Hackers often leverage socially engineered scams to gain access to sensitive information and successfully trick employees into inadvertently performing tasks on behalf of the fraudster.
These tricks are wrapped up in fraudulent emails, stolen passwords, social media scams, Business Email Compromise (BEC) scams, and so on. Accidental Breaches are also a common form of data exposure. Whether accidental or deliberate, both cause an organisation embarrassment, costs to rectify and place them into non-compliance with regulations.
The fight against hacking must be performed on both fronts to mitigate insider and external threats. In 2023, make sure your organisation builds a culture where employees understand how security events happen and how to prevent them from harming your company. Build a human firewall based on well-educated employees and your staff will be less likely to pull the security trigger and become your best defence.
3. Automate Your Security Awareness Training
Automation of security awareness programs allows an organisation to be more efficient and effective in delivering quality security educational content to employees. Automation platforms are designed to set up ongoing training programs that also provide analysis of program metrics to continuously optimise the training.
4. Get Smart About Security
Smart security is about taking on the changing threat landscape using adaptive and versatile security solutions.
Be smart about:
Changing threats: security threats are increasingly difficult to detect and prevent. An answer to this is smart security solutions that automatically keep up to date with changes in cyber security trends. These smart tools use artificial intelligence to adapt to updated threats and can be deployed as-a-Service or via an MSP.
Employee login: make sure that, whenever possible, you implement robust login credentials, such as two-factor authentication and risk-based login. These measures are not foolproof but they help to protect access to corporate apps and other resources.
Network and endpoint maintenance: keep all your applications, endpoints, and server software patched and up to date. Set up automated patch management to perform this task so human error is removed from the equation.
5. Get Skilled-Up
A study by (ISC)2 found that over half of organisations expect increased cyber risk because of staffing challenges. If you cannot recruit skilled security professionals, there are two options:
- Train up your staff: offer all employees ongoing Security Awareness Training to ensure they have the knowledge to help prevent a cyber attack. Also, offer to send interested employee(s) on certification courses. These trained employees can help to manage and deploy Security Awareness Training to the rest of the workforce.
- Outsource your cyber security needs: specialist companies can offer managed services such as simulation exercises, consultants, and/or can provide support to train staff in security awareness.
Make 2023 the Year You Win Against Cyber-Threats
Cybercriminals keep challenging organisations the world over by taking advantage of employees and business associates. In 2023, focus on changing the dynamics of cyber attacks by reducing staff vulnerabilities and being cyber security smart.
