View
49
Download
0
Category
Tags:
Preview:
Citation preview
Network SecurityWHAT EVERY BUSINESS OWNER NEEDS TO KNOW
“There are two kinds of big companies in the United States. There are those who’ve been hacked…and those who don’t know they’ve been hacked.” - FBI Director James Comey
The dam has broken for small companies when it comes to security. Jeremy Grant, an adviser at the Department of Commerce’s National Institute of Standards and Technology, says in the past two years he has seen "a relatively sharp increase in hackers and adversaries targeting small businesses."
According to the security company Symantec, cyberattacks on small businesses rose 300 percent in 2012 from the previous year.
INK MAGAZINE JANUARY 2014
www.digitalattackmap.com
New York TimesPlus many more!
Cyber Security can feel overwhelming
Our objective today is to empower you to do something
Items to cover today
1. Why would a hacker target your business?
2. What Data should you protect?
3. Avoiding Security Negligence
4. What can I do to protect my company?
What do Hackers attack?
Cause Disruption
Personal Information
Banking information
Access
Gateway to bigger fish
Ransom
Intellectual Property
Personal Information
Free Credit!
SSN of kids
Drivers license
numbers
Social Security numbers
Ransom
Typically comes through email
Encrypts drives, even network drives
Demands a ransom to unencrypt your data
- typically have just a few days
- typically hundreds of dollars
Sometimes will give you a “sample” to prove they have integrity
CryptoLocker, TorrentLocker, CryptoFortress …
To Cause Disruption
Questions to consider
1. If you no longer had access to your company data how long would you be able to function as a business?
2. How long until it becomes really painful?
3. How many past employees would cause you harm if given the chance?
What data should I secure?
Any data that if no longer available would disrupt your business
Any personal information
Data with liability under compliance laws (PCI, HIPAA …)
Intellectual property
Where is your data?
Company data
Local drives
Smart phones
Personal devices
Tablets
The Cloud
Avoid Security Negligence
Failure to use reasonable care, resulting in damage or injury to another.
Indiana Law
The Office of the Indiana Attorney General is committed to enforcing the Disclosure of Security Breach law to better protect Hoosiers from identity theft. This law requires Indiana businesses inform their customers about security breaches that have placed their personal information in jeopardy. The Office can seek up to $150,000 for data breaches that have not been properly disclosed to Indiana customers.
http://www.in.gov/attorneygeneral/2410.htm
What if I have a breach?
Avoid Security Negligence
1. Protect your data to the best of your ability
2. Consider an outside evaluation
3. Review and update plans and policies frequently
4. Consider data breech insuranceFailure to use reasonable care, resulting in damage or injury to another.
What can I do to protect my company?
Level 4 – Data breach could
potentially harm lives; security
breach simply must not happen
Level 3 –Personal/Identity,
compliance, intellectual
property – i.e. account
information, credit card or social
security numbers, HIPAA, PCI,
Sarbanes Oxley, etc.
Level 2 – Some sensitive data but
not relative to health, personal
info, or credit card info
Level 1 – No sensitive data
Detection Prevention
User Policy
Perimeter
End Point
Access
Access
1. All patches, especially security patches must be up to date on your server.
2. Access Policy enforcement – setup employee access to only those areas where they should have access and restrict the rest.
3. Password Policy enforcement –server access should be set to follow your policy. Note guideline in handouts.
4. Centralized Data – keep as much data in one central location as possible for better control.
5. Business continuity plan – create a plan, test and review regularly.
End Point
1. Good Anti-virus program◦ Example: Eset
2. Anti–Malware program◦ Example: Malware Bytes
3. Patching – all software especially the Operating system should have all patches up to date.
4. Restrict ability to install software to Admin only
What I use to get to my data
Perimeter
Firewall◦ Restricted or monitored Internet access
◦ Another layer of Anti- Malware and Anti-Virus at Gateway
Wireless Access points◦ Public access separated from private access
Cable access◦ Every cable goes somewhere
Create a barrier from outside access
Policy and Procedures
1. Use Policy
2. PC/Laptop Policy
3. BYOD (bring your own device) Policy
4. Password policyCreate and enforce
Policy and Procedures
1. New user procedure
2. Terminated user procedure◦ employee
◦ Leader
◦ IT employee or company
3. Hardware disposal procedure
4. Hardware refresh guideline
Create and follow
Summery
1. Access – Secure your data and limit access
2. End Point – Protect yourself from users
3. Perimeter – establish a barrier from the rest of the world
4. Policy and Procedures – this allows for the beginning of education.
5. Review and update regularly
Questions
Recommended