Talent or Technology: The Best Solution Against Security Breach

The World Wide Web has come a long way from its inception in the 1980s. As technological innovations transformed this web-like system at CERN to what we know now as the Internet, it shaped how the world is run and influenced how people lived. Sadly, as human nature dictates, not all of this is for the better.

Hackers have continuously devised new ways to adopt and counter developments in cybersecurity, to the point that an IT audit is not probably sufficient to help companies totally safeguard valuable data assets.

According to a Cyber Defense Report by CyberEdge Group, over 70% of organizations reported of having been compromised by a successful cyberattack last year. More than half already expect to be hacked this year.

Thirty-one percent reported that a security breach resulted to at least 8 hours of downtime—costing them up to millions of dollars. In fact, the report found that the average cost of a corporate data breach has reached $3.5 million in the previous year alone.

Servers, where data is stored, are the top target, but user devices and applications are increasingly becoming attractive to hackers. The majority of users operate about 3-4 devices on a daily basis, providing plenty of opportunities as mobile devices and applications are seen as IT security’s weakest link.

With the unintended help of the internet, hackers can launch APT (Advanced Persistent Threat) attacks on any vulnerable entry from networks in IT infrastructure to IT security professionals in companies where BYOD is permitted.

Devices by IT security professionals are not the only target, as staff become prime targets. The report also said that 63% of users admitted that their password has been compromised in their professional life.

Workers become lax about their log-ins over time, creating predictable passwords that hackers can figure out using common combinations. Others intentionally become perpetrators, as the report found that current or former employees caused 72% of incidents at financial organizations.

Cyberattacks will continue as long as there are vulnerabilities that can be exploited. The question now is, how exactly do you combat these ever-present threats, if everything—from people to processes, can be used? Should organizations rely on talent or technology to protect themselves and their customers?

 

Anti-Hacking Technology

 

Unfortunately, there is no single “anti-hacking technology”. IT security professionals have to rely on a variety of tools to help them reduce risks and costs of a security breach. There are simple steps that can be taken, such as putting up a firewall, encrypting data, and ensuring that all systems (offline and online) are patched. However, even these steps are overlooked, as people become unwitting accomplices of a security breach.

People readily share personal information on social media, which hackers can use to figure out their passwords. For example, they’ll try combinations from birthdays because people use numbers they’re most familiar with for personal accounts such as ATM pin codes.

Others can fall prey to simple social engineering tricks through email and social media. As reported in the Telegraph, hackers can “fingerprint” a person’s computer through an image attached to an email request. Once clicked, the hackers will find out everything they need to know about the computer, create malware to take administrative control, and dig up data they can use to blackmail the user.

Internal staff can also make unintentional mistakes. For example, developers who fail in the deployment process of code and employees who leave their laptops open and unlocked.

To avoid human error, you can turn to highly-recommended security tools:

 

• SysInternals and Windows GodMode

SysInternal is a set of Windows applications that enable any PC user to troubleshoot their system. This suite includes Process Explorer, which you can use to dig out Malware hiding behind legitimate Windows processes.

For Windows enthusiasts, there’s GodMode, a nifty tool that enables users to create developer shortcuts. By creating a “Special Folder,” you can have access to a wide range of Windows systems administration tools with a few clicks.

 

• Secure@Source, Q-Radar, ArcSight, Splunk

These four tools have one thing in common: security intelligence capabilities. Using Q-Radar and ArcSight, you can collect and unify data from log generating sources to detect unusual or unauthorized activities as they occur.

Secure@Source and Splunk provide insights that can help you identify vulnerabilities and reduce risks that come with sensitive data.

 

• Privileged Identity Management (PIM)

PIM tools can control administrative passwords and shared business passwords. By changing credentials to cloud applications with critical data, attackers won’t be able to exploit weak passwords made by your human administrators. Best of all, PIM tools monitor and record administrative access to your computers.

 

• Patch Management

Security tools with a patch management solution will keep IT assets up-to-date. More importantly, this will make it harder for hackers, as your online systems are immediately upgraded to fix security vulnerabilities.

 

• Cyphort

Cyphort enables you to detect, identify and contain malware before they can infect your network. The tool can be deployed on a dedicated hardware or virtual machine so that you can avoid threats from the web and email.

 

• Bluebox

Bluebox transforms your iOS or Android app into a self-depending app. Without writing a single line of code, you can prevent hackers from accessing your app data with your own corporate rules, such as encryption and other security controls.

 

• Endpoint Detection and Response (EDR)

As its name suggests, the EDR tool provides complete visibility of all endpoints in your network for shortening the time to detect an APT. You can detect attacks from devices outside your corporate firewall and prevent the execution of all unauthorized codes.

 

• FireEye

With its File Malware Protection System, you can detect and stop malware from spreading through file sharing.

To provide a better picture, you can stop malware from web email, online file transfer tools (such as Dropbox), personal storage devices, and other means that introduce files into your network.

 

• Advanced Security Analytics

Advanced Security Analytics tools provide insights to situations that may potentially compromise your safety or cause a data breach. Examples of these include the previously mentioned FireEye, ArcSight, and Splunk.

You can better assess if a process, such as downloading an email attachment, will introduce malware into the system.

 

Talent Against Theft

 

Technology comes with a variety of nifty tricks to help you combat cybersecurity. Security tools now have user-friendly and intuitive features.

On the other hand, technology comes with a high price tag. After purchasing the tool, more investments would be needed for maintenance and license renewal. More importantly, pricing often depends on the size of your business.

Another way to fight cybersecurity is to leverage talent, because after all, hackers are people too:

 

• Hire a Chief Security Officer

Typically, cybersecurity is not a priority in large organizations. The main job of an IT department is to make sure that all systems are working and available. This mindset is what makes companies vulnerable.

Hiring a Chief Security Officer will ensure that security measures and policies will be established, implemented, and maintained. Companies will have someone they can depend on to navigate the complexities of IT security.

 

• Cybersecurity Awareness

Lack of knowledge and carelessness are among the top causes of security breaches. It is crucial to implement an IT security awareness training for both IT and non-IT personnel.

Done on a regular basis, your staff will become more aware of how their actions – such as losing their security badges – could affect IT security.

 

• Communication and Collaboration Tools

You shouldn’t just stop at annual training programs. Use communication and collaboration tools that will enable IT staff to share their knowledge.

The main reason hackers are able to successfully launch their attack is because they know how to navigate the system. Once your workforce knows how hackers think, they, too, will also be more aware of weak points that can be exploited.

 

Technology or Talent?

 

Technology definitely gives your business a significant advantage. However, not all businesses can afford such Skynet-esque tools.

A start-up with ten employees wouldn’t need such sophisticated intelligence. Manpower is relatively more affordable, but fallibility is part of human nature.

Each worker outside of the IT department has their own priority. Attacks don’t always have to happen online, as hackers can directly extract data from hard drives that are not properly disposed.

As you may have posited by now, both talent and technology are important. Choose a technology solution that fits your business needs and add necessary capabilities as you grow. Include your entire workforce in your IT security strategy and collaborate with your staff.