Strategies for Data Security Breach: The Panagora Blog

 

Strategies for Data Security Breach

Technology continues to be a boon for entrepreneurs, offering increased mobility, productivity, and ROI at shrinking expense. But as useful as modern innovations such as smartphones, tablet PCs, and cloud computing are, they also present specific security concerns.

When you consider all the important data you store virtually — from financial records, to customers’ private information — it’s not hard to see why one breach could seriously damage your business.

Below are 10 safety tips to help you guard against high-tech failure:

Secure with strong passwords

Many cyber-attacks succeed due to weak password protocols. Access to all equipment, wireless networks, and sensitive data should be guarded with unique user names and passwords. The strongest passwords contain numbers, letters and symbols, and aren’t based on commonplace words, sequences of characters or numbers, or personal dates such as birthdays.

Implementing strong passwords is the easiest thing you can do to strengthen your security. Tip for crafting a hard-to-crack password; use a combination of capital and lower-case letters, numbers and symbols, and make it 8 to 12 characters.

As for how often you should change your password, the industry standard is “every 90 days,” but don’t hesitate to do it more frequently if your data is highly-sensitive.

Another key: make sure every individual has their own username and password for any login system, from desktops to your CMS. Never just use one shared password.

And finally, “Never write it down!” and store it in a secure place.

Design safe systems

Reduce exposure to hackers and thieves by eliminating unnecessary access to hardware and software. It is also important to restrict individual users’ and systems’ privileges only to needed equipment and programs. As much as you can, minimize the scope of potential damage to your networks by using a unique set of email addresses, logins, servers and domain names for each user.

Do not hesitate to install special software to detect unusual patterns of activity in the computer system. For example, software used to monitor outbound communications can make sure that certain information isn’t getting leaked out. For businesses whose employees need remote access to the company’s computer system, require more than just a username and password to gain access — for instance, a token that displays a second password that changes regularly would be essential.

Put up a strong firewall

In order to have a properly protected network, firewalls are a must.

A firewall protects your network by controlling internet traffic coming into and flowing out of your business. They’re pretty standard across the board.

Conduct screening and background checks

While rogue hackers get most of the press, the majority of unauthorized intrusions occur from inside network firewalls. Screen all prospective employees from the mailroom to the executive suite. Beyond simply calling references, be certain to research their credibility as well. An initial trial period, during which access to sensitive data is either prohibited or limited, is also recommended. And it wouldn’t hurt to monitor new employees for suspicious network activity.

Educate your employees

Educating your employees on safe online habits and proactive defense is very important. Countless security breaches occur as a result of human error. You can help build a corporate culture that emphasizes computer security through training programs that warn of the risks of sloppy password practices and the careless use of networks, programs, and devices. All security measures, from basic document-disposal procedures to protocols for handling lost passwords, should be well known by all members of your organization.

Make sure your employees understand how important your company’s data is, and all the measures they can take to protect it.

Caution in clicking unknown e-mail, IM and surfing the Web

Never, ever click on unsolicited email attachments, which can contain viruses, Trojan programs, or computer worms. Before opening them, always contact the sender to confirm message contents. If you’re unfamiliar with the source, it’s always best to take caution by deleting the message, then potentially blocking the sender’s account and warning others to do the same. Phishing scams operate by sending innocent-looking emails from apparently trusted sources asking for usernames, passwords, or personal information. Some scam artists even create fake Web sites that encourage potential victims to input this data themselves. Always go directly to a company’s known Internet address or call their known customer care line before providing such information or clicking on suspicious links.

It’s not uncommon for unsuspecting employees to click on a link or download an attachment that they believe is harmless — only to discover they’ve been infected with a nasty virus, or worse.

You have to be smart when surfing the web. You should take every “warning box” that appears on [your] screen seriously and understand that every new piece of software comes with its own set of security vulnerabilities.”

Hang up and call back: So-called “social engineers,” or cons with a gift for small talk, often prey on unsuspecting victims by pretending to be someone they’re not. If a purported representative from the bank or strategic partner seeking sensitive data calls, always end the call and hang up. Then dial your direct contact at that organization, or one of its public numbers to confirm the call was legitimate. Never try to verify suspicious calls with a number provided by the caller.

Install antivirus protection, and keep all software up-to-date

Whether working at home or on an office network, it pays to install basic virus scanning capabilities on your PC. Many network providers now offer such applications for free. Keeping software of all types up to date is also imperative, including scheduling regular downloads of security updates, which help guard against new viruses and variants of old threats.

Antivirus and anti-malware software are essentials in your arsenal of online security weapons, as well.

Your security applications are only as good as their most recent update. While applications are not 100 percent foolproof, it is important to regularly update these tools to help keep your users safe. Frequently updating your programs keeps you up-to-date on any recent issue that programmers have fixed.

Stay paranoid. Shred everything, including documents with corporate names, addresses, and other information, including the logos of vendors and banks you deal with. Never leave sensitive reports out on your desk or otherwise accessible for any sustained period of time, let alone overnight. Change passwords regularly and often, especially if you’ve shared them with an associate. It may seem obsessive, but a healthy dose of paranoia could prevent a major data breach.

Secure your mobile phones, laptops and other systems with encryption software

Because of their portable nature, laptops are at a higher risk of being lost or stolen than average company desktops. It’s important to take some extra steps to make certain your sensitive data is protected. Encryption software changes the way information looks on the hard drive so that, without the correct password, it can’t be read.

One should also stress the importance of never, ever leaving your laptop in your car, where it’s an easy target for thieves. If you must, lock it in your trunk.

Smartphones hold so much data these days that you should consider them almost as valuable as company computers — and they’re much more easily lost or stolen. As such, securing them is another must.

The must-haves for mobile phones:

·        Encryption software

·        Password-protection (enabling a specific “lock-out” period, wherein after a short amount of time not being used, the phone locks itself)

·        Remote wiping enabled

Encryption is also important for protecting a company’s internal information— personnel files, financial accounts, product information and other data. It can foil a hacker who has gotten into the company’s computer system but can’t decipher the information.

Backup regularly

Scheduling regular backups to an external hard drive is a painless way to ensure that all your data is stored safely.

The general rule for backups: servers should go through a complete backup weekly, and incremental backups every night; personal computers should also be backed up completely every week, but you can do incremental backups every few days if you like.

Getting your data compromised is a painful experience — having it all backed up so you don’t completely lose it will make it much less painful.

Monitor diligently

One very good monitoring tool is data-leakage prevention software, which is set up at key network touch-points to look for specific information coming out of your internal network. It can be configured to look for credit card numbers, pieces of code, or any bits of information relevant to your business that would indicate a breach.

If you don’t monitor things, it’s a waste of time and a waste of resources, and you won’t know that you’ve been compromised until it’s far too late.

Consequences of hacked systems

Ruined Reputation

Once you put something on the web, you can bet that it will live on forever – no matter how hard you try to erase it. If you send something through email that you would rather prefer not to have the public know about, it could easily be made public if your account is hacked. If you keep private documents online, they could easily be made public if your computer is hacked.

Vandalism

Vandalism is the planting of false information and a tactic that major hacking groups like to use. By planting false information, your company’s reputation could be ruined in a matter of minutes if customers or others find poor information brazenly placed on your site.

Loss of customer confidence

Being caught up in a data breach undermines consumers’ confidence in their future financial well-being, as well as their opinion of the breached company, research shows. Following a data breach, 45 percent of affected consumers said they were extremely worried about becoming victims of identity theft, and 48 percent said their identities would remain at risk for years or even forever.

A survey of retail customers by Retail Perceptions found that after a data breach, 12 percent of retail customers said they would stop shopping at the affected retailer. Additionally, 79 percent of those who would continue the relationship would never again use credit or debit cards to make purchases there, and 26 would spend less with the retailer. In a survey of nearly 2,000 American consumers, software buying consultancy Software Advice found that nearly 50 percent said that if their personal information were compromised in a data breach, there is nothing a breached company could do to win back their confidence.

If hackers are able to get into your website or network, you can guarantee they will be able to access your bank account information. A prime example would be the Citibank security breach which occurred over the summer.  Following the same principle, this is exactly the reason why you should never leave your home networking system open and unsecured. Following the same thought process, you should never leave your business network unsecure either — this could lead to potentially disastrous situations such as classified documents being leaked, trade secrets being revealed, etc.

But data security is more than an information technology issue. It is a marketing issue, because providing great customer service implies the protection of all customer data.

Think of the incident as a violation of trust. It is not just loss of trust by current customers, but it has a ripple effect in terms of negative word-of-mouth – especially in the age of social media.

Revenue Lost

If a hacker gets into your site and crashes it or causes an extended period of downtime, your operations will cease and you will lose revenue. The longer your site stays down the more you will lose as well, as you will begin to look unreliable and potentially lose credibility.

When a data breach occurs, the monetary costs can be horrific for the affected company. The Target cyber-attacks cost the retailer more than $17 million, the Washington Post reported. The breach of health insurance company Anthem earlier this year is already running cost estimates in excess of $100 million.

Yet, even when the monetary costs are incredibly high, they’re not the most damaging effects of a data breach. The loss of consumer confidence can be even more devastating.

Damaged Intellectual Property

While stealing your identity and money can be incredibly bad, stealing your intellectual property can be just as damaging to a business. If a hacker gets in and steals ideas, plans, or blueprints, you could miss out on being able to fully implement new products or designs – which could keep your business from expanding.