Articles Master of Science in Information Security and Assurance

Articles

7 High-Level Tips to Help Businesses in Protecting Data

Fingers on the Keyboard of a laptop

When it comes to securing sensitive digital assets, many businesses are aware of the threat posed by cyber criminals, mechanical failures, and even natural disasters. Yet, not every organization follows best practices in backing up their data; in fact, small businesses typically only back up financial data in-house, leaving them vulnerable to breaches and on-site hacks. To prepare their organizations to properly defend its data from even the most unique threats, information assurance personnel must work with management to implement key information assurance strategies. Below are some of the most preventative data security measures currently being used to defend data in many industries.

Establish server virtualization

Some firms have a tendency to repeatedly push their servers to their maximum capacity, without properly weighing the consequences of such actions. For instance, many companies will choose not to expand their network capacity during peak periods, like holidays. In doing so, they overextend their servers and increase the risk of a severe overload that may result in critical data loss. Information assurance professionals can alleviate this issue using server virtualization, which allows organizations to run several server environments using a single physical server. This solution works because cloud-based virtual servers can be expanded to withstand increased capacity and reduced when networking demands are lower. The server virtualization strategy is growing in popularity, as many organizations such as AT&T have plans to transition approximately 75 percent of their servers to virtual hosts.

In addition to mitigating security risks by hosting critical data offsite, virtualization also relieves firms of many administrative and financial responsibilities that are involved with maintaining local servers. Transitioning to virtualized servers can reduce or entirely remove the costs of purchasing, maintaining, storing, and upgrading in-house network infrastructure equipment. The hosts of these virtual data networks maintain their own comprehensive data storage and network infrastructure systems that are complete with security software, which is regularly backed up to cloud storage, helping to eliminate concerns around the safety of private data.

Implement Data Disaster Recovery and Backup Solutions

Disaster recovery solutions can be used to migrate compromised networks to virtual environments, limiting data loss and ensuring that operations can be picked up following a disaster. Whatever the size of an organization, setting up a data disaster recovery solution, like a cloud-based continuous data backup system, is a necessity when it comes to properly securing corporate data. In 2015, an Infrascale survey determined that on average 18.5 hours is needed for businesses to recover operations following a natural disaster, operational disaster, large-scale cyber attack or a human-error-based data disaster. Businesses should implement plans that are designed to reinstate their operations quickly, because during emergency situations, data systems are likely to become significantly more vulnerable, increasing the risks of compromised networks and irreparable data loss.

When a business is operating on a large scale, maintaining in-house servers with the capacity to retrieve, process and store their data at regular time intervals can be a time- and resource-intensive process. To remedy this, organizations can back-up important data, like application software, local data, settings, and memory using virtual machines, allowing them to always have primary copies of their most important data available remotely. As the backup processes are fully automated and regularly record data images of the company’s servers at set intervals, a recent version of vital business information can be available at any time, even following a disaster.

Employ a multi-layered password system

CloudPets, a smart toy company, experienced a significant data breach in 2017, leaking the details of half a million customers. The breach is most attributed to the fact that the company did not have strong parameters in place for user passwords. Using password cracking techniques like brute force cyber attacks, phishing techniques and malware-based attacks, cyber criminals can steal proprietary data such as company financial data or customer identification information. Therefore, information professionals should implement multiple-step password verification systems that require an initial password which must then be verified via mobile device, email, or another online application before allowing access to important data. A multi-layered system adds an extra layer of protection to company data, so even if the initial password system is weak, the hackers will still have to break through that additional security feature, such as the mobile verification system. Implementing this multi-step password strategy is cost-effective and can add just enough protection to help dissuade hackers.

Conduct cybersecurity risk assessment to identify potential vulnerabilities

Another strategy to protect a firm’s data is regularly overseeing a cybersecurity risk assessment. A dedicated security specialist typically understands the ins-and-outs of their company’s digital networks, and are therefore usually positioned to identify dangerous vulnerabilities its information assets. During a cybersecurity risk assessment, a team of information assurance professionals conduct a complete audit of a firm’s data networks.

Conducting a risk assessment on a consistent basis is critical. In order to maintain an effective cybersecurity system, security specialist must ensure that there aren’t any weak points within the system’s protective layers. Digital security systems as a whole undergo constant attacks and probes, and as hackers’ methods advance and progress, older security features will become ineffective. However, with a risk assessment, a team can analyze the overall integrity of a system, ensuring that there aren’t any gaps, breaches, or outdated security layers that hackers could potentially exploit. Using the following five steps for risk assessment, information security personnel can bolster their organization’s information security strategy and reduce potential vulnerabilities.

1. Identify current information assets – Document what types of sensitive information are frequently being processed by the company, prioritizing each item based on what needs to be protected the most.
2. Locate current information assets – Record the location of each information asset, whether they are based in servers, laptops, portable physical storage, virtual networks, or databases.
3. Classify current information assets – Label each information asset based on the following descriptions. Each label identifies a different level of harm that could be caused to the organization if data in that classification is compromised.
a. Public data (contact information)
b. Internal, non-secret data (office policies)
c. Sensitive internal data (business plans)
d. Compartmentalized internal data (important financial data)
e. Regulated data (classified data)
4. Conduct a threat modeling exercise – Identify the probability of incurring threats that may result in spoofed identities, tampered data, repudiated transactions, information disclosures, denials of service (DDoS) and undesired elevation of privileges. Then determine the probability of each threat actually being carried out against each individual information asset and articulate the impact a successful breach of that data would have on the company.
5. Finalize data and strategize – Using the information that was gained during the assessment process, firms can determine where they need to focus their information assurance efforts, allowing them to build protective solutions that reduce the risks of cyber-attacks and data loss.

Create secondary control points around extremely vulnerable data

Companies should also consider establishing a secondary line of defense around especially critical or vulnerable data. While a secondary defense system is not meant to be the primary means of defense against attackers, it can help to stall hacks that do manage to break through the initial wall, giving a company’s IT team the chance to reorganize and develop a new strategy to combat the breach.

This secondary line should feature a detailed security option, like a firewall, that boasts a limited number of access points. This not only allows a select few to access the data at any one time, but it also gives security professionals the opportunity to monitor everyone who tries to obtain the information. Establishing secondary control points can make it far more difficult for unregistered users or hackers to steal vital data.

Develop a multi-layered response plan

According to the National Archives and Records Administration, more than 90 percent of companies that experience at least seven days of data center downtime go out of business within a single year. Therefore, it is important for every firm to direct their information technology team to develop a multi-level response plan. This plan should not only stop an attack as quickly as possible, but also be entirely transparent and easy to follow—all of an organization’s employees and stakeholders should be aware of how to manage a security incident properly and efficiently. When setting up a response plan, information security professionals should consider the following:

1. Decide on a response plan program manager. The program manager should decide:
a. Who should be involved within the plan
b. Who needs to be notified when there is a break
c. What is the order in which people should be notified

2. Conduct an analysis of how a break or theft in data would impact the company.

3. Write a comprehensive plan that identifies the level of employee training that will be necessary to implement the plan, how the organization will conduct crisis communications with employees, clients, and outside stakeholders, and how this response will be organized. The plan should also include contact information for the stakeholders who need to be notified of critical data loss or unexpected network downtime.

4. Run a test exercise of the emergency response plan for the entire organization.

5. Assess the results of your emergency response plan and look for ways to improve.

Today’s information security professionals need to have a vigilant eye for digital threats that may compromise the integrity of essential company data. Knowing what preventative measures and strategies to implement can be vital to defending network infrastructure. Enhancing one’s knowledge and skills in this field is important for helping protect the critical data and operations of an organization, and earning a degree in information assurance can be an essential step in developing the needed expertise.

Learn more

As the nation’s oldest private military college, Norwich University has been a leader in innovative education since 1819. Through its online programs, Norwich delivers relevant and applicable curricula that allow its students to make a positive impact on their places of work and their communities.

At Norwich University, we extend a tradition of values-based education, where structured, disciplined, and rigorous studies create a challenging and rewarding experience. Online programs, such as the Master of Science in Information Security & Assurance, have made our comprehensive curriculum available to more students than ever before.

Norwich University has been designated as a Center for Academic Excellence in Cyber Defense Education by the National Security Agency and Department of Homeland Security. Through your program, you can choose from the five unique concentrations that are uniquely designed to provide an in-depth examination of policies, procedures, and overall structure of an information assurance program.

Recommended Readings:
The Importance of Implementing Security Protocol, Practices and Awareness
Career Outlook: Computer Network Architect
5 Tips for Managing an Information Assurance Team

Sources:

https://www.sba.gov/blogs/4-ways-safeguard-and-protect-your-small-business-data

https://www.wired.com/insights/2014/05/protecting-crown-jewels-digital-age/

http://www.pwc.com/us/en/increasing-it-effectiveness/assets/byod-1-25-2012.pdf

https://www.infosecurity-magazine.com/opinions/comment-cybersecurity-requires-a-multi-layered/

http://www.gartner.com/newsroom/id/3315817

http://www.serverwatch.com/server-trends/slideshows/top-10-virtualization-technology-companies-for-2016.html

https://www.sba.gov/blogs/got-backup-finding-best-backup-option-your-small-business-data\

https://www.sba.gov/managing-business/running-business/emergency-preparedness/sbas-disaster-preparedness-and-recovery-plan

https://www.ready.gov/business

https://www.theguardian.com/technology/2017/feb/28/cloudpets-data-breach-leaks-details-of-500000-children-and-adults

http://searchsecurity.techtarget.com/feature/BYOD-security-strategies-Balancing-BYOD-risks-and-rewards

http://www.techradar.com/news/computing/what-is-byod-and-why-is-it-important-1175088

http://www.computerweekly.com/feature/Backup-and-disaster-recovery-in-the-age-of-virtualisation

-
August 2017