7 Most Famous Social Engineering Attacks In History, Be Prepared
Social engineering, in the context of IT, often refers to the manipulation of people to perform actions or give up confidential information.
As long as there has been any proprietary or private information, bad actors have been attempting to steal it. Recently, with the acceleration of technology and the accessibility to the internet, hackers have refocused their strategy. Where, in the past, an assailant would be required to be physically in the room to breach a system, now a simple email is all that is necessary.
The goal of such an attack is to extract information, commit fraud, or gain system access by tricking an unsuspecting user by gaining their confidence.
Naturally, as technology becomes more widely adopted, there has been an uptick in such attacks. Social engineering attacks are worth keeping an eye on. At the very least, to monitor your company’s vulnerabilities.
The Sony Pictures Hack
On Monday, November 24, 2014, many of Sony Picture’s employees began to see skulls appearing on their computer screens with software rendering their machines inoperable. It was quickly discovered that many of Sony’s official Twitter accounts had been compromised as well. A group identifying themselves as the Guardians of Peace took credit for the hack and began to issue demands. They claimed that they were in possession of over 100 terabytes of stolen data and would start releasing it if their demands were not met.
Unfortunately for Sony, the e-mail, outlining the demands of the group, was missed, likely caught up in a spam filter or the daily barrage of messages we are all used to receiving. Shortly after the deadline for the demands had passed, Guardians of Peace began leaking unreleased films to social media. In addition to unreleased content, they also leaked personal information about employees of Sony Pictures including their families, inter-office e-mails, salary information, and more.
Guardians of Peace then demanded that Sony stop production on its upcoming film, The Interview. This film, a comedy produced and directed by Seth Rogan and Evan Goldberg, had a plot to assassinate North Korean leader Kim Jong-un. The group then threatened attacks on movie theaters that were intending to screen the film. Eventually, after much public out-cry and theater chains opting not to screen the film, Sony scrapped the film’s premiere and release.
Though it seems that the main aim was to take down the film, the information leak may be deemed as more disastrous to Sony. Emails showing that female actors Amy Adams and Jennifer Lawrence were paid less than their male co-stars were revealed amongst other embarrassing and racist private emails from producers and (then) Sony Executive Amy Pascal. The Interview was eventually released digitally, for free.
The fallout for this hack continued with multiple government agencies becoming involved. An investigtation on whether North Korea itself had purpotrated the hack was launched. Additionally many organizations such as Color of Change called for the firing of Amy Pascal who was eventually dismissed.
A caveat to the hack, however, is that the gender pay debate quickly became a mainstream conversation.
Target Data Breach
In 2013, hackers accessed over 40 million of Target customers’ credit and debit card information through a large scale social engineering attack on Target’s point-of-sale (POS) systems. The systems were infected with malware, confirming what security experts suspected since the massive data breach was announced in December of that year. What is interesting is that it was discovered that hackers went through another company to get to Target. It was later announced that information such as names, emails, addresses, and phone numbers of an additional 70 million customers had also been stolen.
A PoS attack such as this is often called a “RAM scraper.” The term originates from the way the malware scans a point-of-sale terminal’s random access memory (RAM) for transaction data with the intent to steal it. When a card is swiped, the data encoded on the magnetic stripe is passed along with the transaction request to the payment application and then on to the company’s payment processing provider.
Target made many mistakes that eventually lead to this attack.
First, Target gave remote access to its network to its HVAC vendor Fazio Mechanical Services. This company was then targeted with a phishing email that installed malware onto their system. The hacker then used this to route into Target’s network, installing malware that recorded and extracted the information for every credit and debit card used on an infected machine.
At the end of 2015, Target announced a loss of $162 million due to data breach-related fees.
2016 Democratic National Committee Email Leak
In June and July of 2016, during the 2016 Democratic National Convention, an e-mail leak occurred that was allegedly obtained by Russian intelligence agency hackers. The leak, published by DCLeaks and WikiLeaks, included e-mails from seven key DNC staff members as well as the governing body of the United States Democratic Party, totaling 19,252 emails and 8,034 attachments.
The leaked documents suggested that the party’s leadership had attempted to sabotage Bernie Sanders’ bid for President. In response, the chair of the DNC, Debbie Wasserman Schulz, resigned. Once the convention wrapped, DNC CEO Amy Dacey, CFO Brad Marshall, and Communications Director Luis Miranda also resigned.
Though WikiLeaks founder, Julian Assange, has stated that his source of the e-mails was not Russian, on July 13, 2018, Special Counsel Robert Mueller indicted 12 Russian military intelligence agents allegedly responsible for the attack.
On July 22, 2016, more than 150,000 additional e-mails, stolen from personal Gmail accounts or accounts linked to the DNC hack were released to the DCLeaks and WikiLeaks websites. It turns out that the hack was perpetrated via a simple case of spear phishing. The hackers sent an email that looked just like it had been sent by Google requesting that the user click a bit.ly link to reset their password due to malicious activity on their accounts. This successfully tricked people into entering their information, giving complete access to the hackers. Once they were in, the hackers started to release information.
On August 12, 2016, DCLeaks released information about more than 200 Democratic lawmakers that included personal cell phone numbers.
Associated Press Twitter Accounts
In April of 2013, the Associated Press’ (AP) Twitter account posted a tweet stating, “Breaking: Two Explosions in the White House and Barack Obama is injured” to it’s more than 2 million followers.
In the 3 minutes that the tweet was public and the account compromised, the DOW had plummeted 150 points, equivalent to $136 billion in equity market value.
The Associated Press received an email that appeared to be from others within the company. In fact, the email was from the Syrian Electronic Army. The email included a link that led to a page requesting the login details for the AP Twitter account. That the name in the ‘From’ field of the email didn’t match the name in the signature line was the only clue that the email was fake.
Once the attackers had the login details, the Syrian Electronic Army posted a single tweet, sending the financial market into chaos.
Though the impact of the tweet was quickly contained, there is no telling how devastating an effect on the economy this type of attack can do.
Similar attacks have been used to shift markets with false information. In August of the same year, information began to spread on Twitter that suggested Syrian President, Bashar al-Assad had been killed. This sent the price of crude oil spiking.
RSA SecurID Cybersecurity Attack
On March 17, 2011, it was announced that RSA had been the victims of an “extremely sophisticated cyber attack”.
The breach began with a spam email that purported to come from a recruiter. Four employees at RSA opened the attached spreadsheet where a 0day (zero-day attack) Flash exploit was buried inside. This installed backdoor access to their computers which put the whole system in jeopardy.
RSA initially denied that any information the hackers gained access to could be used against its users. However, there are reports that the breach involved the theft of RSA’s database mapping token serial numbers to the secret token “seeds” that were injected to make each one unique. Further reports that RSA executives were telling customers to “ensure that they protect the serial numbers on their tokens” lend credibility to this theory.
The breach was estimated to have cost EMC, which is the parent company of RSA, $66.3 million.
In April of 2011, there were rumors of L-3 Communications being attacked as a result of the RSA breach. Moreover, in May of the same year, Lockheed Martin thwarted its own attempted breach from the RSA attack.
Yahoo! Security Breaches
In 2016, the one-time internet giant, Yahoo!, reported two significant data breaches had occurred, compromising user data.
The first breach occurred in 2014 and compromised half a billion user accounts. The second, in August of 2013 was initially believed to have affected over 1 billion accounts. In reality, in October 2017, it was disclosed that all 3 billion user accounts were impacted. A simple spear-phishing email to a semi-privileged engineer was all it took to compromise all the customer accounts at the company.
Both breaches, individually and combined, are considered to be the largest discovered in the history of the internet. Compromised details include names, e-mail addresses, phone numbers, security questions (encrypted or unencrypted), dates of birth, and passwords. Furthermore, the breach was used to falsify login data, allowing hackers to grant access to any account without the use of a password.
The data accessed in the incident was put up for sale on the dark web and no doubt used by others for their scams.
Yahoo! has been criticized and publically shamed for the length of time it took to disclose the breach. The breach ultimately impacted the sale of the company to Verizon. Initially, the sale was estimated to be at $4.8 billion but decreased over $350 million after the disclosure.
15 Year Old Kane Gamble & The CIA
He may have been only 15 at the time, but Kane Gamble successfully used social engineering to get into the email accounts of CIA Director John Brennan and James Clapper, Director of National Intelligence, amongst others. This gave him access to highly sensitive military documents and intelligence operations in Iraq and Afghanistan.
Gamble used vishing (phishing via the phone) to persuade Verizon to reveal information about Brennan which he then used to impersonate Brennan when he contacted AOL. His method was simple but efficient, leading him to change security questions and numbers and gain access to many other accounts. He also managed to set up an auto-forward service directing phone calls from Clapper’s home to the Free Palestine Movement.
Gamble’s other targets included:
- Jeh Johnson, the then-Secretary of Homeland Security
- Mark Giuliano, FBI’s Deputy Director at the time
- John Holdren, the senior science and technology adviser to former US president Barack Obama
- Avril Haines, the White House deputy national security adviser
- The US Department of Justice
In April 2018, Gamble was sentenced to 2 years detention, and all his computers were seized.
Get Started With Social Engineering Prevention Today
All of these social engineering attacks show that simplicity is often the best way to gain access to a system. People are the most vulnerable point in any business. Whether the attacker went through some people or just required one person’s details, it is remarkable how quickly any socially engineered attack can escalate.
It’s important to remain vigilant in your security. Question every type of communication you receive and always be on the lookout for potential threats, no matter how small they may seem.
7 Tactics To Prevent DDoS Attacks & Keep Your Website Safe
A massive DDoS attack hits your server. Your basic security systems fail to respond in time.
Suddenly, your business grinds to a halt, and your website is down for hours. You are losing untold amounts of revenue.
You don’t have to look any further than last year’s Dyn incident to see how your business could be reduced to an entity trying to rebuild its reputation and pipeline.
In a single weekend, the worst distributed denial of service attack in history crashed the world’s largest internet services. Twitter, Reddit, The New York Times, and PayPal were just some of the significant sites that went down due to attack.
The reported damage from this malicious attack for Dyn was a loss of 8% of its business. The harshness of the message sent for digital enterprises was immeasurable.
Denial of service attacks are here to stay, and no business can afford to be unprotected.
What are DDoS Attacks? A Definition
DDoS stands for Distributed Denial of Service.
It is a form of cyber attack that targets critical systems to disrupt network service or connectivity that causes a denial of service for users of the targeted resource. A DDoS attack employs the processing power of multiple malware-infected computers to target a single system.
The botmaster, as the lead attacking computer, is called, can act in three primary methods.
Here is a shocking example of a major DDoS attack taking place:
The video opens up a whole new perspective on DDoS data protection, doesn’t it?
It illustrates the possible severity of an attack and also sheds light on the systems that you need to have in place to defend. And the sad reality is the average strength of DDoS attacks continues to grow.
According to Verisign Q1 2018 DDoS Trends Report, the average peak attack size increased by 26% in the reported period. A related study from Neustar suggests that such an attack can cost a company more than $250,000 per hour at risk.
To protect against DDoS, it is essential to understand the most common types of attacks.
Types of DDoS Attacks & How Each Work
Volumetric Attacks
The most common DDoS attack overwhelms a machine’s network bandwidth by flooding it with false data requests on every open port the device has available. Because the bot floods ports with data, the machine continually has to deal with checking the malicious data requests and has no room to accept legitimate traffic. UDP floods and ICMP floods comprise the two primary forms of volumetric attacks.
UDP stands for User Datagram Protocol and refers to the simple transmission of data without checking its integrity. The UDP format lends itself well to fast data transmission, which unfortunately makes it a prime tool for attackers.
ICMP stands for Internet Control Message Protocol, referring to network devices that communicate with one another. An attack focused on ICMP relies on attacking nodes sending false error requests to the target. The target has to deal with these requests and cannot respond to real ones, similar to how a UDP attack works.
Application-Layer Attacks
The application layer is the topmost layer of the OSI network model and the one closest to the user’s interaction with the system. Attacks that make use of the application layer focus primarily on direct Web traffic. Potential avenues include HTTP, HTTPS, DNS, or SMTP.
Application-layer attacks are not as easy to catch because they typically make use of a smaller number of machines, sometimes even a single one. Therefore, the server can be tricked into treating the attack as nothing more than a higher volume of legitimate traffic.
Protocol Attacks
A protocol attack focuses on damaging connection tables in network areas that deal directly with verifying connections. By sending successively slow pings, deliberately malformed pings, and partial packets, the attacking computer can cause memory buffers in the target to overload and potentially crash the system. A protocol attack can also target firewalls. This is why a firewall alone will not stop denial of service attacks.
One of the most common protocol attacks is the SYN flood, which makes use of the three-way handshake process for establishing a TCP/IP connection. Typically, the client sends a SYN (synchronize) packet, receives a SYN-ACK (synchronize-acknowledge), and sends an ACK in return before establishing a connection. During an attack, the client only sends SYN packets, causing the server to send a SYN-ACK and wait for the final phase that never occurs. This, in turn, ties up network resources.
Often, would-be hackers combine these three types of approaches to attack a target on multiple fronts, completely overwhelming its defenses until stronger and more thorough countermeasures can be deployed.
7 Best Practices for Preventing DDoS attacks
The evolution of DDoS attacks shows no signs of slowing. They keep growing in volume and frequency, today most commonly involving a “blended” or “hybrid” approach.
Without early threat detection and traffic profiling systems, it’s impossible to know they’re here. In fact, chances are you know about it only when your website slows to a halt or crashes.
This is especially true for sophisticated attacks, which use a blended approach and target multiple levels simultaneously.
These attacks target data, applications, and infrastructure simultaneously to increase the chances of success. To fight them, you need a battle plan, as well as reliable DDoS prevention and mitigation solutions. You need an integrated security strategy that protects all infrastructure levels.
1. Develop a Denial of Service Response Plan.
Develop a DDoS prevention plan based on a thorough security assessment. Unlike smaller companies, larger businesses may require complex infrastructure and involving multiple teams in DDoS planning.
When DDoS hits, there is no time to think about the best steps to take. They need to be defined in advance to enable prompt reactions and avoid any impacts.
Developing an incident response plan is the critical first step toward comprehensive defense strategy. Depending on the infrastructure, a DDoS response plan can get quite exhaustive. The first step you take when a malicious attack happens can define how it will end. Make sure your data center is prepared, and your team is aware of their responsibilities. That way, you can minimize the impact on your business and save yourself months of recovery.
The key elements remain the same for any company, and they include:
- Systems checklist. Develop a full list of assets you should implement to ensure advanced threat identification, assessment, and filtering tools, as well as security-enhanced hardware and software-level protection, is in place.
- Form a response team. Define responsibilities for key team members to ensure organized reaction to the attack as it happens.
- Define notification and escalation procedures. Make sure your team members know exactly whom to contact in case of the attack.
- Include the list of internal and external contacts that should be informed about the attack. You should also develop communication strategies with your customers, cloud service provider, and any security vendors.
2. Secure Your Network Infrastructure.
Mitigating network security threats can only be achieved with multi-level protection strategies in place.
This includes advanced intrusion prevention and threat management systems, which combine firewalls, VPN, anti-spam, content filtering, load balancing, and other layers of DDoS defense techniques. Together they enable constant and consistent network protection to prevent a DDoS attack from happening. This includes everything from identifying possible traffic inconsistencies with the highest level of precision in blocking the attack.
Most of the standard network equipment comes with limited DDoS mitigation options, so you may want to outsource some of the additional services. With cloud-based solutions, you can access advanced mitigation and protection resources on a pay-per-use basis. This is an excellent option for small and medium-sized businesses that may want to keep their security budgets within projected limits.
In addition to this, you should also make sure your systems are up-to-date. Outdated systems are usually the ones with most loopholes. Denial of Service attackers find holes. By regularly patching your infrastructure and installing new software versions, you can close more doors to the attackers.
Given the complexity of DDoS attacks, there’s hardly a way to defend against them without appropriate systems to identify anomalies in traffic and provide instant response. Backed by secure infrastructure and a battle-plan, such systems can minimize the threat. More than that, they can bring the needed peace of mind and confidence to everyone from a system admin to CEO.
3. Practice Basic Network Security
The most basic countermeasure to preventing DDoS attacks is to allow as little user error as possible.
Engaging in strong security practices can keep business networks from being compromised. Secure practices include complex passwords that change on a regular basis, anti-phishing methods, and secure firewalls that allow little outside traffic. These measures alone will not stop DDoS, but they serve as a critical security foundation.
4. Maintain Strong Network Architecture
Focusing on a secure network architecture is vital to security. Business should create redundant network resources; if one server is attacked, the others can handle the extra network traffic. When possible, servers should be located in different places geographically. Spread-out resources are more difficult for attackers to target.
5. Leverage the Cloud
Outsourcing DDoS prevention to cloud-based service providers offers several advantages. First, the cloud has far more bandwidth, and resources than a private network likely does. With the increased magnitude of DDoS attacks, relying solely on on-premises hardware is likely to fail.
Second, the nature of the cloud means it is a diffuse resource. Cloud-based apps can absorb harmful or malicious traffic before it ever reaches its intended destination. Third, cloud-based services are operated by software engineers whose job consists of monitoring the Web for the latest DDoS tactics.
Deciding on the right environment for data and applications will differ between companies and industries. Hybrid environments can be convenient for achieving the right balance between security and flexibility, especially with vendors providing tailor-made solutions.
6. Understand the Warning Signs
Some symptoms of a DDoS attack include network slowdown, spotty connectivity on a company intranet, or intermittent website shutdowns. No network is perfect, but if a lack of performance seems to be prolonged or more severe than usual, the network likely is experiencing a DDoS and the company should take action.
7. Consider DDoS-as-a-Service.
DDoS-as-a-Service provides improved flexibility for environments that combine in-house and third party resources, or cloud and dedicated server hosting.
At the same time, it ensures that all the security infrastructure components meet the highest security standards and compliance requirements. The key benefit of this model is the ability of tailor-made security architecture for the needs of a particular company, making the high-level DDoS protection available to businesses of any size.
How to Stop a DDoS attack? Monitor for Unusual Activity
Early threat detection is one of the most efficient ways to prevent the attack.
Denial of service can come in multiple forms, and it is critical to recognize its most common telltale. Any dramatic slowdown in network performance or an increase in the number of spam emails can be a sign of an intrusion. These should be addressed as soon as they are noticed, even if deviations do not look that important at first.
Businesses also need to understand their equipment’s capabilities to identify both network-layer and application-layer attacks. If you do not have these resources in-house, you may want to work with your ISP, data center, or security vendor to get advanced protection resources.
With proper systems to detect and react to all types of attacks, you already set your business for a successful defense.
What to Look For In a DDoS Mitigation Service
When possible, it is beneficial to choose a DDoS mitigation service that keeps engineers and network administrators on site continuously monitoring traffic. By doing so, it enables a faster response time than having to do work remotely.
Another factor is whether the service deals with SSL attacks. Sites that provide commercial transactions run on SSL, and a successful attack against this protocol can cost thousands of dollars in lost revenue.
The more comprehensive the mitigation plan, the better off networks are when it comes to protection against DDoS attack. Many different services exist on the market.
Always Be Prepared For Denial of Service Attacks
DDoS attacks are painfully real and are no longer massive corporations problem only. Small and medium-sized companies are increasingly the targets. This trend has sparked even greater demand for multi-layered security solutions that can provide full protection of sensitive workloads.
While the threat landscape continues to develop, so do security technologies. Following that trend, we recently released the fourth phase of DDoS enhancements for all our services. We will be increasing our focus on educated businesses on the most common cyber threats and best security strategies to defend.
Ready to take the next step and ensure business continuity? Contact our cloud security experts to find out more and stop the next DDoS attack from happening to your business.
What is UPnP or Universal Plug and Play? A Little Known Security Risk
Universal Plug and Play (UPnP) was marked as a significant technological advance.
But, it comes with its share of drawbacks that might leave your systems vulnerable to potential cyber-attacks. In fact, it is enabled by default on millions of routers.
This article will discuss what UPnP is and the risks it poses to your network’s security.
What is Universal Plug and Play (UPnP)?
Universal Plug and Play is a set of networking protocols. It enables network devices such as computers, Internet gateways, printers, media servers, and Wi-Fi access points to discover each other’s presence on the network and create functional network services for data sharing.
UPnP was intended for private networks that do not have enterprise connectivity.
This technology operates under the assumption that a network runs IP (Internet Protocol) after which it leverages SOAP, XML, and HTTP so that it can provide service/device description, data transfers, actions, and eventing. Advertisements and device search requests are enabled by running HTTP in addition to UDP – port 1900 – using HTTPMU (multicast). Search requests’ responses are usually sent over the UDP.
This technology was endorsed by the UPnP forum which is an industry initiative to promote robust and straightforward connectivity to personal computers and stand-alone devices from different vendors. The panel comprised of over 800 vendors who were involved in everything from network computing to consumer electronics. But as from 2016, Universal Plug and Play is managed by the Open Connectivity Foundation.
In concept, Universal Plug and Play is supposed to extend plug and play (a technology that dynamically attaches devices directly to a machine) to zero-configuration networking for SOHO and residential wireless networks.
Thus, UPnP devices are archetypical plug and play. When they are connected to a network, they automatically seek and create working configurations with other hardware.
What Does UPnP Do?
If the above definition seemed a bit complex, then let us use a printer as an example.
In an office setup, the first step would be to connect it physically to the network router – even though you can do it via Wi-Fi today. In the past, you would have to search for the printer manually and then set it up so that other devices within the network can find the printer. Today, however, this process happens automatically thanks to Universal Plug and Play.
Once they are connected, the devices on that network will continue communicating with each other by receiving and sending data. As such, a computer can instruct the printer to print documents; a media center can transmit audio data, while mobile devices can mount themselves onto the computer. The possibilities are endless.
This is why it is called plug and play. You plug in a device and can start playing it right away without having to go through the hassles of setting up and configuring the connection. This makes it one of the most convenient networking technologies that are available to us.
However, UPnP technology has serious security flaws.
For instance, if a computer or some other device connected to the router exploited, the attacker may gain remote control of all devices and security systems. Thus, allowing access to your passwords and access all the other devices that are connected to the network. Additionally, once a device has been compromised, it can be utilized as part of a botnet to issue DDoS (distributed denial of service) campaigns to take down sites while hiding the attacker’s location. It might also provide them with a starting point for other attacks.
Some of the most significant cyber-crimes in recent history have leveraged internet-based devices to launch major DDoS attacks.
With more and more devices utilizing this technology to get connected to the internet, they are the ideal targets for hackers who have to accumulate devices so that they can overwhelm a business network.
Security Risks of Universal Plug and Play
A security survey by Akamai discovered that hackers are actively exploiting the weaknesses of this technology as a starting point for more prominent attacks.
For example malware distribution, DDoS, credit card theft, and phishing attacks.
The evidence found suggested that over four million devices were potentially susceptible to being used in a DDoS attack. This number accounts for approximately 38 percent of the 11 million internet-facing UPnP devices that are being used all over the world. This serves as a big pool for hackers to leverage what would have been small and local attacks into serious threats.
Primarily, these cybercriminals exploit this technology’s weaknesses to reroute the traffic in your business repeatedly until it is untraceable. And in spite of the industry’s knowledge about these vulnerabilities, hackers continue to take advantage of the general apathy towards strengthening the technology.
By default, this technology does not employ authentication.
This means that to ensure security, the devices in the network have to incorporate the additional Device Security Service or the Device Protection Service. There is also a non-standard solution that exists known as Universal Plug and Play – User Profile (UPnP-UP) which proposes an extension to enable user authentication and authorization techniques for UPnP-applications and devices. Sadly, most universal plug and play device implementations do not have authentication methods because they assume that local systems and their users can be trusted.
If authentication techniques are not implemented, firewalls and routers that run the UPnP-protocol become vulnerable to attacks.
Don’t Overlook Securing Your Network
The purpose of Universal Plug and Play technology is to make devices on a specific network to be easily discoverable by other utilities on the same network. Unfortunately, some Universal Plug and play control interfaces can be exposed to the public internet thereby enabling individuals with malicious intent to locate and obtain access to your devices.
A device that is compromised is nothing short of a ticking time bomb for your business network. Because of the complicated nature of these attacks, detecting one as it happens can be very difficult for the user.
In our current world where a fluid work culture is ideal, more and more employees are taking connected devices to and from their workplaces. There is no room for error when it comes to your business’s cybersecurity.
The takeaway here is that you should ensure that your UPnP router settings are disabled.
What is an MSSP, Managed Security Services Provider?
Every company prioritizes cybersecurity. However, many struggle to prioritize their security needs. Sound familiar?
A managed security service provider (MSSP) can ensure your companies data is safe and secure.
Managed Security Service Provider Definition
A managed security service provider (MSSP) provides outsourced management and monitoring of security devices to protect companies’ digital infrastructures.
IT security services involve some combination of:
- Secure Web Application Firewalls
- Intrusion Detection
- Spam Blocking
- Virtual Private Networks (VPN) System Management
- Virus Protection
- Identity and privileged access management
One consistent benefit is that the managed service model provides clients with peace of mind. So, while some companies may already use advanced firewalls and anti-virus systems, companies that hire an MSSP for their enterprise security services, ensure round-the-clock protection.
6 Benefits of Working with an MSSP
Every year, a growing number of headlines announce the newest company victimized by cybercrime. According to the Identity Resource Center’s 2017 Annual Data Breach Year-End Review, the threat is multiplying, too. Between just 2016 and 2017, incidents grew up 44.7%.
Still, many businesses react to this growing threat by adding new best practices their security operations team. They may initiate new protocols aimed at network security.
Others realize it’s time to find a strategic partner and outsource their company’s protection to the experts.
1. Security Expertise
Most organizations can’t compete with an MSSP when it comes to the expertise they have on staff. Think about your business for a moment: the vast majority of your team dedicates their time to selling products or service offerings.
At managed security companies, their entire staff is dedicated to understanding how to keep companies like yours safe from cybercrime.
While every security partner is different, they all have teams based around specific needs. One team specializes in vulnerability management, while another is in charge of handling cyber security incident responses.
Hiring the same kind of expertise isn’t realistic for most businesses. Just as important, these experts are tasked with staying up-to-date on the evolving threat landscape. The reason criminals victimize many companies is that new threats debut every year. Without experts who continuously monitor this complex field, it’s impossible to defend against them.
2. Affordability
Plenty of companies do have the resources to hire these kinds of specialists and create those kinds of teams. However, they still hire MSSPs.
One reason is that a managed network security service comes at a much lower price. Organizations can protect their budget and their network at the same time. Of course, with the average cost of a successful data breach topping $3.8 million, any price for an MSSP is affordable.
3. Adaptability and Scalability
If your company is like most, it changes regularly. Every year, your technology also needs to update to keep pace.
When you contract Security as a Service (Saas) providers, you’re investing in your company’s ability to change at will. If you want to scale, but realize you’ll need better computer forensics, MSSP companies are there to help.
If you create new web applications, you have a group of dedicated experts who will test it for vulnerabilities.
You can wait until your company can support this move with better technology and expertise. Alternatively, you could scale and hope that a cyber threat doesn’t end up costing you.
A managed security service provider also serves in an advisory role. They’ll let you know where you need to make changes to support specific goals. You don’t need to worry that chasing new goals will leave you vulnerable.
4. Constant Monitoring and Risk Management
Unfortunately for business owners, cybercriminals don’t call it a day when you do. The good news is: neither does an MSSP.
They will keep watch over your company 24/7/365. Knowing experts are protecting your company around the clock should give you priceless peace of mind.
5. Customizable Service Offerings
Relying on a security service vendor doesn’t mean outsourcing all of your needs, either. It certainly can, but it all depends on your organization’s unique needs.
Many organizations need data centers with added security or assistance with managing their private network. Others may need to leverage specific information or security administration services.
Typical examples of these include:
- Provisioning
- Security Updates
- Education and Training
- Privileged access management (PAM)
- Role-Based Access Control Fulfilments
- Cybersecurity Management Reporting
- Security Strategy
- Compliance Reporting
6. Information Security Policy Development and Maintenance
All the hardware and software in the world can’t save you from a network threat if you don’t have the right policies in place.
A company’s employees are usually one of their most significant vulnerabilities. A cyber attack doesn’t necessarily need to be exceptionally advanced to hit its mark.
MSSP’s can help you develop one from scratch. Most importantly, they’ll tailor it to your company’s unique traits. You shouldn’t try to retrofit a “boilerplate” version of something this important.
Managed security services can also monitor to make sure your staff is following this policy. As time goes on, changes and updates will be necessary.
It could be due to scaling, or that new safeguards are necessary to ensure employees don’t leave an organization open to attack. Your security provider will proactively recommend these changes and even implement them on your behalf.
How to Choose a Managed Security Provider
Given the benefits, it should come as no surprise that managed security service providers are in high demand. If you’re in the market for one, you’ll have no lack of options.
Nonetheless, picking the right one for your company is essential. Here’s what to look for when making your choice.
1. Relevant Service Offerings
Don’t settle for a solution that doesn’t offer every single service your company needs—save for those you wish to keep in-house. This includes the expertise you need for your specific industry.
For example; you may need an MSSP that has experience working with companies that must abide by the GDPR. If you work in healthcare, you would most likely want an MSSP that understands HIPAA compliant hosting.
At the same time, don’t pay for any additional services that your company won’t use. You can always add new services in the future, as they are required.
2. Thorough Assessments
Even if you have your IT team to help, look for a managed security provider who offers assessments.
You want an expert to inspect your company’s digital infrastructure, so they know exactly what’s required to keep it safe.
3. Onsite Security
One of these companies could become a significant liability if they don’t have their own security needs covered.
The best providers have onsite security guards who actively patrol their facility—inside and out. Yours should have a security team staffed by veterans or former police officers. That’s how important the facility’s security is.
Remember, a data center is dedicated to many other clients as well. Even if you are under the assumption that your server is not under security threat, that doesn’t necessarily mean it’s safe.
Onsite network security is an effective deterrent against this worst-case scenario.
4. Disaster Avoidance Solutions
Disaster recovery is a standard service among MSSP security providers.
However, you also want to work with a company that can avoid disaster in the first place.
Ideally, they should be headquartered in a “disaster-free zone,” where threats like earthquakes or flooding are nonexistent. Otherwise, one disaster could be enough to derail your enterprise security services. It could also be a long time before you’re able to get them back.
Your security service provider should also have data center locations worldwide. This is just further protection against the worst possible disasters.
No matter what happens, your company’s Recovery Point Objective (RPO) will remain intact.
Start Your Search for Managed Security Services
Now that you understand what an MSSP does and how to find the right one, it’s time to begin your search. Even if you’re not sure about your company’s specific needs yet, it’s worth consulting with one of our experts. Protection is too critical to wait.
Start today, and you’ll soon enjoy the peace of mind that comes from having managed security solutions defending your company.
Data Security In Cloud Computing: How Secure Is Your Data?
This article is an expert-level account of our security services by phoenixNAP’s own Anthony Dezilva. Anthony is a 25yr industry veteran, with a background in virtualization and security. He is the Product Manager for Security Services at phoenixNAP.
Leadership and Partnership In Cloud Security
Definitions are critical; essential even. The term “leadership”, for example, is defined simply by Google dictionary, as “The action of leading a group of people or an organization”. At phoenixNAP, leading in our industry is part of our DNA and culture. We define leadership as creating innovative, reliable, cost-optimized, and world-class solutions that our customers can easily consume.
In that vein, the term “Cloud Infrastructure” (or its predecessor “Cloud Computing“) tend to represent multiple different scenarios and solutions, drummed up by overzealous marketing teams. Without a clear definition, clarity around the terms is convoluted at best. “Cloud Security,” however, is more often described as representing concerns around data confidentiality, privacy, regulatory compliance, recovery, disaster recovery, and even vendor viability. We aim to bring clarity, specificity, and trust into this space through our Data Security Cloud solutions.
The Road Ahead: The Security Landscape
According to Heng & Kim (2016) of Gartner, by 2020, 60% of businesses will suffer a failure of some sort, directly attributed to their internal IT team’s inability to manage risk effectively. 87% of nearly 1200 global C-Level executives surveyed by E&Y say they needed 50% more funding to deal with the increased threat landscape. Compound that problem by the fact that we are facing a global skills shortage in technology and security services. These issues directly impact the ability of organizations to maintain and retain their Information Technology and now their Cybersecurity staff.
While the industry prepares for this potential security epidemic, predictions state that a consolidation of the vast number of security services providers is going to take place, along with an increased focus and reliance on automation and machine learning tools. Despite public concern, this may not be such a bad thing. The growing sophistication of these tools, the ability to perform analytics and correlation in many dimensions, and the automation capabilities, could create efficiencies or potentially, advancements in our defensive capabilities.
Industry-leading providers in this space are not standing idly by. As such a provider, phoenixNAP is at the forefront of many initiatives, ranging from local to international. For example, it is critical that we begin to foster knowledge in children as young as grade school to gain an interest in the field. Working with industry organizations, we sponsor events and take leadership roles in organizations to support curriculum development and awareness. We are leading efforts in threat intelligence sharing, and the use of disparate dark web data sources, to create a predictive analysis that can be operationalized for early threat vector identification. Additionally, we have partnered with the United States Armed Forces and U.S. Department of Veteran Affairs to provide pathways for those service members interested, to have a low barrier of entry, and to have a dedicated support system, so that they can successfully transition into cyber roles as civilians.
“Leadership,” we view as our social responsibility and our contribution to enhancing the security posture of our market segment.
Why is this relevant to security in the cloud?
A Gartner study from 2015 predicted a 16% year-over-year annual growth rate. The reality is that as we approach the 2020 mark, we see a 32% increase in IT spending on cloud services. That same study identified that about 40% of IT budgets are now allocating for cloud or SaaS related services.
“These growing statistics are relevant because this is going to influence your existing cloud strategy dramatically, or if you don’t have one, this should alert you that you will soon require one.”
Secure Solutions From Our Unique Perspective
It is safe to assume you are already in the cloud, or you are going there. Our focus is to educate on what we believe are the most significant components of a secure cloud infrastructure, and how these components complement and support the security needs of modern business. Just as the path-goal theory emphasizes the importance of the relationship to the goal achievement, as a technology service provider, we believe in partnering with our customers and going the extra mile to become mutually trusted advisors in product creation and sustenance. The cloud is in your not-too-distant future. Let us keep you safe and secure, and guide you along the way.
At phoenixNAP, we have a unique perspective. As an infrastructure provider, we offer a service portfolio of complementary tools and services to provide organizations with holistic, secure, cloud-based solutions. With that in mind, we identified a gap in the small, and medium-sized business space (SMB), and their barriers to entry, for access to cutting-edge technology such as this. We knew what we had to do: we developed the tools to help these businesses with access to a world-class secure cloud-based solution offering, which met and supported their regulatory needs. We set the bar on performance, recoverability, business continuity, security and now compliance pretty high. Our passion for small to medium-sized businesses and dedication to security is why we built the Data Security Cloud. Our Data Security Cloud is an aspiration to create the world’s most secure cloud offering.
We wanted a way to build a solution that would be the Gold Standard in security, but also entirely accessible to everyone. For that to happen, we needed to commoditize the traditionally consultative security services offerings and offer it at an affordable OpEx cost structure. That is exactly what we did.
Cloud Security is a Shared Responsibility
The 2017 Cloud Adoption Survey found that 90.5% of respondents believe that Cloud Computing is the future of IT. As many as 50.5% of these respondents still identified security as a concern. Of those concerns, the following areas were of particular interest:
-
- Data and application integration challenges
- Regulatory compliance challenges (54% indicated PCI compliance requirements)
- Worries over “lock-in” due to proprietary public cloud platforms
- Mistrust of large cloud providers
- Cost
We architected our solution from the ground up, with these perspectives in mind. We identified that we needed to monitor, actively defend, and resource a Security Operations Center, to respond to incidents 24×7 globally. We designed a solution where we partner with each of our customers to share in the responsibility of protecting their environment. Ultimately, this strategy contributes to protecting the privacy and confidentiality of their subsequent customers privileged, financial, healthcare, and personal/demographic data. We set out to design a system to empower your goals towards your security posture.
Our challenge, as we saw it, was to commoditize and demystify the types of security in cloud computing. We have invested significant resources in integrating tools and pushed vendors to transition from a traditional CapEx cost model to an OpEx pay-as-you-grow model. Ultimately, this strategy enables pricing structures that are favorable for this market segment and removes any barrier of entry, so that our customers can access the same tools and techniques formerly reserved for the enterprise space.
What are Cloud Services?
When speaking of Cloud Services, we have to define the context of:
Private Cloud
-
- A Private Cloud typically represents the virtualization solution you have in-house or one you or your organization may host in a data center colocation.
- Optimizing the use of idle time on a typical compute workload, by aggregating multiple workloads onto a single host, the Private Cloud will take advantage of the resource overprovisioning inherent of a bare metal hypervisor platform.
- You own your Private Cloud. It is technically in your facility, under your operational control. The confidence in the security controls are therefore high, yet dependent on the skills and competency of the operators and their ability to keep up with proper security hygiene.
- The challenge, however, is that you still have to procure and maintain the hardware, software, licensing, contingency planning (backup and business continuity), and even the human resources described above. Including the organizational overheard to continuously develop and manage these resources (training, HR, medical/dental plans, etc.).
Public Cloud
-
- A public cloud is an environment where a service provider makes a virtualization infrastructure available for resources such as virtual machines, applications, and/or storage. These resources are open to the general public consumption over the internet. The public cloud is typically an environment operated under a pay-per-use model, where the customer pays only for what they have subscribed and/or committed to.
- We can categorize public cloud further as:
- Software-as-a-Service (SaaS). A great example of SaaS is Microsoft’s Office 365. Although you can use a lot of the tools via the internet browser itself, you can also download the client-facing software, while all the real work happens within the cloud environment.
- Platform-as-a-Service (PaaS). A solution where the cloud provider delivers hardware and software tools, typically in an OpEx model.
- Infrastructure as a Service (IaaS). When we refer to the public cloud, this is typically the service most people refer to. A typical scenario is when you visit a website and order a virtual Windows Server; with X amount of processors, Y amounts of RAM, and Z amounts of Storage. At phoenixNAP, we offer this style of service. Once provisioned, you install IIS and Wordpress, you upload your site, and now you have an internet-facing server for your website. Consumers drawn to this model are typically cost-conscious and attempting to create their solution with the least expenditure. Things like an Internet-facing firewall could be overlooked or entirely skipped. Strong system architecture practices such as creating separate workloads for web platforms and database/storage platforms (with an internal firewall) may also suffer. What might be obvious at this point is that this is one of those areas of intense focus when we created our solutions.
- Our value proposition is that this type of cloud platform reduces the need for the organization to invest and maintain its on-premise infrastructure, resources, or even annual service contracts. Although this will reduce resource needs, it will not eliminate them. As most licensing costs are either included via the provider and most likely available at significantly reduced price-points through the provider’s economies of scale, you are also guaranteed to get some of the best pricing possible.
The following table contrasts the shifting cost allocation model:
Traditional IT
Asset Costs
-
- Server Hardware
- Storage Hardware
- Networking Hardware
- Software Licensing
Labor Costs to Maintain Infrastructure
Physical Data Center Costs
-
- Power
- Cooling
- Security
- Insurance
Outsourcing/Consulting Costs
Communications/Network Costs
Public Cloud
Virtual Infrastructure Costs
-
- Server Costs
- vProcs
- vRAM
- vStorage
- Software License Costs
- Professional Services
- Bandwidth Costs
- Managed Services Costs
- Server Costs
Hybrid Cloud
-
- Consider the Hybrid Cloud as a fusion between the Private and Public Cloud. The desired goal is for workloads in both of these environments to communicate with each other, including the ability to move these workloads seamlessly between the two platforms.
- Though this is also possible in the other scenarios, in the case of the Hybrid Cloud, it is typical to see a public cloud environment configured like an on-premise environment. This scenario could have proper North-South traffic segmentation, and in the rare case, proper East-West traffic segmentation facilitated by either virtual firewall appliances or most recently VMware NSX based micro-segmentation technology.
What Role Do Control Frameworks Play?
Control Frameworks are outlines of best practices. A strong and defined set of processes and controls that help the provider adhere to proper security posture. Posture that can be evaluated, audited and reported on, especially when subject to regulatory requirements verified by an audit process. What this means to a consumer is that the provider has built a standards-based solution that’s consistent with the industry. They have not cut corners, they have made the effort to create a quality product that’s reliable and inter-operable should you need to port-in or port-out components of your infrastructure. A standards-based approach by the provider can also be leveraged for your own regulatory compliance needs, as is may address components on your checklist that you can assign to the provider.
Partnering With the Best
Market share numbers are a quantitative measure, although subject to a level of alpha, it is still statistically sound. Intel and VMware are clear leaders and global innovators in this space. Product superiority, a qualitative measure, is a crucial asset when integrating components to create innovative solutions in a highly demanding space. At phoenixNAP, we are proud of our ongoing partnerships and proud to develop products with these partners. We believe in the value of co-branded solutions that innovate yet create stable platforms due to longevity and leadership in the space.
Developing our Data Security Cloud (DSC) product offering, we had the pleasure of working with the latest generation of Intel chipsets and early release VMware product code. We architected and implemented with next-generation tools and techniques, not bound by the legacy of the previous solutions or methodologies.
We incorporated VMware’s vRealize Suite and vCloud Director technologies into a world-class solution. At phoenixNAP, we not only want to empower our customers to manage their operational tasks themselves but by using the industry standard VMware as a platform, we can create hybrid cloud solutions between their on-premise and Data Security Cloud implementations.
Starting Fresh
As we wanted to design a secure cloud service offering, we chose not to be influenced by legacy. Starting with a whole new networking platform based on software-defined-networking, we created and built a flexible, scalable, solution, incorporating micro-segmentation and data isolation best practices. We designed this level of flexibility and control throughout the entire virtualization platform stack and the interconnecting communications fabric.
Design Methodology
We drew upon our extensive background in meeting compliance goals; incorporating a framework approach, using industry best practices, anticipating the needs and limitations inherited with achieving industry and compliance certifications such as PCI, HIPAA Compliance, and ISO 27002 (coming soon). We designed a flexible, yet secure architecture, supplemented by a VMware LogInsight log collection and aggregation platform, that streams security-related incidents to a LogRhythm SIEM, monitored by our 24×7 Security Operations Center (SOC).
We Proved It
What better way to prove that we achieved our goals in a security standard than to have the most respected organizations validate and certify us. We had TrustedSec evaluate our environment, and have them attest that it met their expectations. However, we didn’t stop at just achieving compliance alone. Additionally, as security professionals, we audited our environment, going over and beyond the regulatory standards. We designed our framework to have a “no compromise approach,” and our fundamental philosophy of “do the right thing” from a technical and security perspective. Proved by our PCI certification of this secure cloud platform.
The Launch of our Security Services Offering
After years of extensive testing and feedback from our customers, we built our Security Risk Management and Incident Response capabilities into a service offering, available to our entire customer base. We enhanced our Security Operations through the integration of advanced Security Orchestration and automated testing tools, and through strategic partnerships with public and private Information Sharing and Collaboration (ISACs) organizations. Enhanced by our ability to gather threat vector data globally, in real-time from our own systems, member organizations, and the dark web, we utilize unique enrichment techniques, to do predictive profiling of the social structure of this society; with a goal create, actionable intelligence or early warning systems, to support our defensive posture.
What this means is that we are building advanced tools to detect threats before they impact your business. We are using these tools to take preventative action to protect customer networks under our watch. Actions which could see the latest threat pass you by without including you in its wake.
Layered Approach to Creating a Secure Cloud Infrastructure
Proven Base
phoenixNAP has a long and proven history in designing, developing, and operating innovative infrastructure solutions. With a parent company in the financial transactions sector, we have extensive knowledge and expertise in the secure operations of these critical solutions. As an operator of global data center facilities, we have established a trustworthy reputation and operational process, to support the needs of our diverse and vast client base.
Our certifications in SOC-1, SOC-2, and SOC-3 establish a baseline for physical and logical access control, data security, and business continuity management and procedures. Our Type II designation verifies these capabilities in practice. Our PCI-DSS certification establishes our commitment and credibility to “doing the right thing” to create an environment that exemplifies your concerns for the highest level of security posture.
Redundant Global Communication Fabric
At phoenixNAP, we believe that every customer deserves the highest form of security and protection. At our most consumer level, our customers benefit from an Internet Service riding on top of a six-career blended connection, with technologies such as DDoS mitigation built into the communication fabric. Every one of our customers receives this exceptional level of protection out-of-the-box. Piggy-backing on our datacenter availability expertise, we designed a meshed switching fabric that is resilient as it is fast, eliminating single points of failure that gives us the confidence to offer a 100% Service Level Availability (SLA) guarantee.
Highly Scalable Hardware Platform
“A new platform that represents the largest Data Center Platform advancement in a decade”
Lisa Spellman – Intel VP/GM of Xeon and Datacenter
Secure at the Foundation
-
- Root of trust module (TPM)
- Built-in instruction sets for verification (Intel TXT)
- Fast, high-quality random number generator (RDSEED)
- Firmware assurance (BIOS Guard)
Built-in Ecosystem
-
- Efficient provisioning and initialization (Intel PTE)
- Scalable management with policy enforcement (Intel CIT)
- Direct integration with HyTrust and VMware, etc.
A New Level of Trust
-
- Secure, Enterprise Key Management
- Trusted connectivity
- Remote attestation fo the secure platform
- Compliance and measurement at the core
Designed around the latest Intel Xeon processor technology alongside our extensive expertise in managing highly scalable workloads in our other cloud offerings, we built a computing platform that achieved 1.59X performance gaines over previous generations. These increases that are passed down into our customer’s workloads, providing them with better performance, and a higher density environment to optimize their existing investment, without any capital outlay; in most cases without any additional OpEx commitments.
Advanced Hypervisor Technology
We build a foundational commitment to VMware, and our commitment to integrate the latest tools and techniques to empower our customers to do what they need, whenever they need it.
Using Hybrid Cloud Extender we can help customers bridge the network gaps to hosted cloud services while maintaining network access and control. Tools like VMWareNSX allow for the creation of logical security policies that can be applied to a Virtual Machine regardless of location (cloud or on-premise). The integration of the latest Intel Cloud Integrity Toolkit allows for platform security with unmatched data protection and compliance capabilities.
Our vRealize Suite and vCloud Director integration is no different. We provide our customers with direct access to the tools they need to manage and protect their hybrid cloud environments effectively. In the event the customer wishes to engage phoenixNAP to perform some of these tasks, we offer Managed Services through our NOC and 3rd party support network.
Segmented Components
Experience has taught us how to identify and prevent repeat mistakes, even those made by strategic or competitive partners in the industry segment. One of those lessons learned is the best practice to section and separate the “Management” compute platform, from the “User compute platform.” Segmentation will significantly minimize the impact of a “support system” crash, or even a heavy operational workload, from impacting the entire computing environment. By creating flexible and innovative opportunities, we train our teams to reflect, communicate and enhance their experiences, creating a knowledgeable and savvy operator who can step onto the batter’s box ready to do what’s asked of them.
Threat Management
We believe that we have created a state-of-the-art infrastructure solution with world-class security and functionality. However, the solution is still dependent on a human operator. One, that based on skill or training, could be the weakest link. We, therefore, engage in continuous education, primarily through our various industry engagements and leadership efforts. This service offering is designed to be a high touch environment, using a zero-trust methodology. A customer, who is unable to deal with the elements of an incident, can see us engage on their behalf and resolve the contention.
If all else fails, and the environment is breached, we rely on 3rd party pre-contracted Incident Responders that deploy in a rapid format. The proper handling of cybersecurity Incident Response requires a Crisis Communication component. One or more individuals trained in handling the details of the situation, interfacing with the public and law enforcement, and based in the concepts of psychology, are trained to be sensitive and supportive to the various victim groups of the situation.
As we bundle backup and recovery as a core service in our offerings, we can make service restoration decisions based on the risk of overwriting data vs. extended downtime. Using the cloud environment to our advantage, we can isolate systems, and deploy parallel systems to restore the service, while preserving the impacted server for further forensic analysis by law enforcement.
It’s All About the Layers
Hierarchy of Virtual Environment Security Technologies
Security solutions are designed to defend through depth. If one layer is compromised, the defense process begins by escalating the tools and techniques to the next tier. We believe that a layered approach as described creates a secure and stable solution that can easily be scaled laterally as the needs and customer base grows.
Why Does This All Matter?
In one of his articles in the CISO Playbook series, Steve Riley challenges IT leaders not to worry that migration to the cloud may require relinquishing total control but encourages them to embrace a new mindset. This mindset is focused on identity management, data protection, and workload performance.
The primary is likely a reference to the cost savings achieved from consolidation, and transfer of responsibility to a service provider.
-
- Converting CapEx expenditure to OpEx ones can surely improve cash flow to those in the SMB market space.
- Reducing technical overhead through the elimination of roles no longer required, can provide far more operating capital, and
by re-focusing core-resources to concentrate on core-competencies, create business advantages in the areas that are important to the organization.
According to Gartner, the benefits of cloud migration include the following:
-
- Shorter project times: Cloud IaaS is a strong approach for trial and error, offering the speed required to test the business model success.
- Broader geographic distribution: The global distribution of cloud IaaS enables applications to be deployed to other regions quickly.
- Agility and scalability: The resource is pay-as-you-go. If an application is designed correctly, then it is simple to scale the capability in a short period.
- Increased application availability: As described, we have demonstrated the highest levels of security and reliability. If you have the right application design, you can develop application availability accordingly.
What’s Fueling the Cloud-First Strategy?
We hear many organizations adopting a cloud-first strategy, where they default to a cloud-based solution, until it proves unable, or not feasible before they consider other options. Factors driving this trend include:
-
- Reduced infrastructure and operational costs. From a reduction in capital expenditures, using the elasticity of cloud services, lower overall software costs and potential reduction of IT staff, organizations report approximately 14% in savings.
- Flexibility and scalability to support business agility. Agility is defined by the ability to bring new solutions to market quickly. The ability to control costs, leverage different types of services, and being flexible to adapt to market conditions.
- Cloud services tend to use the latest in innovation. Being able to leverage the high rate of innovation in this space, an organization can benefit by incorporating it as part of their business strategy.
- A cloud-first strategy can drive business growth through a supportive ecosystem.
Things to Consider
Not every workload is appropriate or destined for cloud-based compute platforms. The scoping part of any cloud migration project should start by identifying and selecting workloads that are easily migrated and implemented in multi-tenant cloud implementation.
The customer needs to understand the profile and characteristics of their workloads. For many years we would have never considered moving database workloads off of physical hardware. This is a similar case where high I/O or hardware timer reliant workloads (such as GPS or real-time event processing) may be sensitive to being in a shared, multi-tenant computer environment.
-
- More importantly, cloud services predominately revolve around x86-based server platforms. Therefore, workloads that are reliant on other processor architecture, or even specialized secondary processing units or even dongles, do not make ideal cloud candidates.
In contrast, cloud-based infrastructure allows for:
-
- Business Agility – for rapid deployment, and even rapid transition from one platform to another, with low transition costs.
- Device Choice – The flexibility to deploy, tear down, and redeploy various device configurations in a matter of clicks.
- Collaboration – Cloud providers typically provide an expert-level helpdesk, with direct access to a community of experts that can support your needs.
There are many reasons to consider a hybrid strategy where you combine workloads. What needs to stay on bare-metal can remain on bare metal servers, either in your facility or a colocation facility such as ours, while staying connected to the cloud platform via a cross-connect, gaining the benefits of both scenarios.
Cloud computing security consists of a broad set of concerns. It is not limited to data confidentiality alone, but concerns for privacy, regulatory compliance, continuity and recovery, and even vendor viability. Staying secure in the cloud is, however, a “shared responsibility.” It requires partnerships, especially between the customer and their infrastructure service provider. Nobody needs to be convinced that data breaches are frequent, and often due to management or operator neglect. Customers are becoming tired of their data being disclosed and then used against them. Most recently, abused via an email-based threat vector, where the bad actor quotes a breached user ID and password, as a way to convince the target recipient to perform an undesired action, behind the mask of perceived authenticity.
Any organization that accepts Personally Identifiable Information (PII) of its customer base establishes with that customer, an implied social contract to protect that information. At phoenixNAP, we have demonstrated leadership in the infrastructure space on a global scale, through partnerships with customers, solution aggregators, and resellers. We have created innovative solutions to meet the unique challenges faced by businesses, going above and beyond to achieve the goals desired by the target organization.
Notes from the Author: Elements of a Strong Security Strategy
Over the years, I have learned many important lessons when it comes to creating solutions that are secure and reliable. Here are some final thoughts to ponder.
-
- There is no substitute for strong architecture. Get it right and you have a stable foundation to build upon. Get it wrong and you will play whack-a-mole for the rest of that life-cycle.
- Have detailed documentation. Implement policies and procedures that make sense. Documentation that supports the business process. Security policy cannot burden the users. If it does, it just becomes a target for shadow IT. It needs to be supportive of the existing process while implementing the control it absolutely needs. A little control is better than no control due to a workaround.
- Plan for a breach, plan to be down, plan for an alien invasion. If you plan for it, you won’t be caught in a state of panic when something undoubtedly happens. The more off-the-beaten-path a scenario seems, the better you can adopt for when real-life scenarios arise.
- You can’t protect what you don’t know you have. Asset management is the best thing you can do for your security posture. If it’s meant to be there: document it. If it’s not meant to be there: make certain that you have a mechanism to detect and isolate it. Even to find out who put it there, why and when.
- Now that you know what you have: monitor it. Get to know what normal behavior is. Get to know its “baseline.”
- Use that baseline as a comparative gauge to detect anomalies. Is this system showing inconsistent behavior?
- Investigate. Have the capability to see the alert triggered by that inconsistent behavior. Are you a 24/7 operation? Can you afford to ignore that indicator until the morning? Will your stakeholders, including your customers accept your ability to detect and respond to the Service Level Agreement (SLA) you extend to them? Can you support the resourcing needed for a 24/7 operation, or do you need to outsource the Threat Management component at least in a coverage extension model? The best SIEM tools are useless without someone actioning the alerts as soon as they pop up. Machine learning helps, however, it cannot yet replace the operator.
- Mitigate the problem or be able to recover the environment. Understand what your Recovery Point Objectives (RPOs) and your Recovery Time Objectives (RTO). Do your current solutions meet those goals? Can those same goals be met if you have to recover into a facility across the country, with no availability from your current staff due to the crisis being faced? How will you communicate with your customers? Do you have a crisis communicator and incident handler as part of the response team?
- Take your lessons learned, improve the process and do it all over again.
No single vendor can provide you with a “silver bullet.” Any vendor that tells you such, is someone you should shy away from. Every customer’s needs are unique. Each situation takes a unique blend of solutions to be effective. Hence your vast network of partner relationships, to provide you with the solutions you need, without trying to make you fit onto one of their offerings.
The offer is always on the table. At phoenixNAP, we will gladly take the call to discuss your concerns in this area, and provide advice on what our thoughts are on the topic of interest. Promoting and supporting properly secured environments is part of our social responsibility. It is part of our DNA and the core philosophy for building products in this segment. Let us be your partner in this journey.
Use of Reference Architectures
One of the benefits of a cloud-based, secure infrastructure such as our Data Security Cloud, is the ability to implement battle tested reference architectures that in some cases go above and beyond the standard capabilities of what’s possible in the physical environment.
In what we would consider an extreme case; an architecture as depicted above creates multiple layers of security with various gateways to get to the prized databases that most bad actors are after. Let’s not ignore the bad actors that want to take control of the web infrastructure to infect visitors with infectious payloads; however, the real prize sits inside those databases in the form of PII, PHI, or PCI data. While the various levels of defensive components are designed to make it difficult for the bad actors to storm the castle, the 24×7 Threat Monitoring will undoubtedly catch the multiple attempts and anomalous behavior, triggering an investigation and response activity.
Through a robust combination of tools, technology, services, and a cost model that’s supportive of the needs of the SMB space, we believe we have demonstrated our leadership, but more importantly, we have created a solution that will benefit you; our SMB customer. We aim to have created a complete security solution that you can take forward as you further define your cloud strategy.
Our Promise
We have assembled a world-class team of highly experienced and skilled leaders, who are passionate about cloud security. As global thought leaders, we design for the world and implement locally. We create sustainable solutions, understanding a customer’s appetite and limited budget. Let us show you how we can benefit your goals through our solutions offerings. Keeping with our promise to “do the right thing” as it involves finding the best solution for you.
Get Started with Data Security in Cloud Computing Today
Contact phoenixNAP today.
Complete the form below and our experts will contact you within 24 hours.
2020 Disaster Recovery Statistics That Will Shock Business Owners
This article was updated in December 2019.
Data loss can be chilling and has serious financial implications. Downtime can occur at any time. Something as small as an employee opening an infected email, or as significant as a natural disaster.
Yet, 75% of small businesses have no disaster recovery plan objective in place.
We have compiled an interesting mix of disaster recovery statistics from a variety of sources from technology companies to mainstream media. Think of a disaster recovery plan a lifeboat for your business.
Hardware failure is the number one cause of data loss and/or downtime.
According to Dynamic Technologies, hardware failures cause 45% of total unplanned downtime. Followed by the loss of power (35%), software failure (34%), data corruption (24%), external security breaches (23%), and accidental user error (20%).
17 more startling Disaster Recovery Facts & Stats
1. 93% of companies without Disaster Recovery who suffer a major data disaster are out of business within one year.
2. 96% of companies with a trusted backup and disaster recovery plan were able to survive ransomware attacks.
3. More than 50% of companies experienced a downtime event in the past five years that longer than a full workday.
Recovering From A Disaster Is Expensive
When your business experiences downtime, there is a cost associated with that event. This dollar amount can be pretty tough to pin down as it includes direct expenses such as recovery labor and equipment replacement. But, also indirect costs such as lost business opportunity.
The cost can be staggering:
4. Corero Network Security found that organizations spend up to $50,000 dealing with a denial of service attack. Preventing DDoS attacks is critical.
4. Estimate are that unplanned downtime can cost up to $17,244 per minute, with a low-end estimate of $926 per minute.
5. On average, businesses lose over $100,000 per ransomware incident due to downtime and recovery costs. (source: CNN)
6. 40-60% of small businesses who lose access to operational systems and data without a DR plan close their doors forever. Companies that can recover do so at a much higher cost and a more extended timeframe than companies who had a formal backup and disaster recovery (BDR) plan in place.
7. 96% of businesses with a disaster recovery solution in place fully recover operations.
Numbers Behind Security Breaches and Attacks
9. In a 2017 survey of 580 attendees of the Black Hat security conference in Las Vegas, it was revealed that the more than half of the organizations had been the target of cyber attacks. 20% of those came from ransomware attacks.
10. 2/3 of the individuals responding to the survey believe that a significant security breach will occur at their organization in the next year
11. More than 50% of businesses don’t have the budget to recover from the attack.
The Human Element Of Data Loss
Cybercriminals often utilize a human-based method of bypassing security, such as increasingly-sophisticated phishing attacks.
12. Human error is the number one cause of security and data breaches, responsible for 52 percent of incidents.
13. Cybersecurity training for new employees is critical. Only 52% receive cybersecurity policy training once a year.
14. The painful reality is that malware can successfully bypass anti-spam email filters, and are mostly ineffective against a targeted malware attack. It was reported that in 2018, malware attacks increased by 25 percent.
Evolving Security Threat Matrix
15. By 2021, cybercrimes will cost $6 trillion per year worldwide.
16. Cybersecurity spending is on the rise; reaching $96 billion in 2018.
17. Cryptojacking attacks are increasing by over 8000% as miners exploit the computing power of unsuspecting victims.
Don’t Become a Disaster Recovery Statistic
The good news is that with adequate planning, you can minimize the costs regarding time and lost sales that are associated with disaster recovery.
Backing up and securing your data and systems and having the capability to maintain business as usual in the face of a disaster is no longer a luxury, it is a necessity. Understanding how to put a disaster recovery plan in place is essential. Read our recent article on data breach statistics for 2020.
Creating a Secure Website: Simple Guide to Website Security
Experts predicted that in 2019, business websites would fall prey to ransomware attacks at the rate of one site every 14 seconds.
In 2018, the damage to websites attacked by cyber criminal exceeded 5 billion dollars.
Every year, these attacks grow in size, and before you know it, it could be your website that is affected.
Why You Need To Keep Your Website Secure
Every website is potentially vulnerable to these attacks.
You need to keep yours safe. An unsecured site can be compromised. Your customer’s data might be stolen. This can lead to lost revenue, costly website coding repairs, and many other problems.
You can protect your website from hackers. We’ll start off with a few basic descriptions of the types of attacks that you might encounter. This is followed by the eleven tips to secure your website.
Potential Web Attacks/What To Prepare For
Whaling / Spear-Phishing
Phishing attacks are used to get people to give away their personal information, such as a social security number or bank account pin number. These attacks aim at broad audiences in hopes of fooling as many people as they can. Typically, phishing is done by email.
For example, a hacker sends out an email that looks like it comes from a bank, causing the recipient to click on the link in panic. That link takes the person to their standard looking banking site. But it is a site only designed to look like the real one. Someone who falls for one of these tricks and fills out the form on that site accidentally gives away their information.
Spear-phishing is similar, but it targets one specific person, not a lot of people in general. Hackers choose a particular target and then try to get them to give away their sensitive information.
Whaling is similar to spear-phishing. Only, in this case, a critical executive, at a company is targeted. That person is called a “whale” due to their influence and power. Hackers try to lure in whales, hoping to gain high-level access to company websites and bank accounts.
Server-Side Ransomware
Ransomware hits everyone from the average computer-user to those who operate websites.
These attacks consist of a hacker taking control of a computer and refusing to allow the user to access even the most basic commands. Server-side ransomware works similarly, except the hacker, gains control of a website server. Access to every website on that server is lost until the hackers are overridden or have their demands met.
IoT Vulnerabilities
IoT stands for Internet of Things. The term refers to the large number of devices that connect to the internet, such as smartphones and tablets that link to the internet and access sites.
The main IoT vulnerabilities are privacy issues, unreliable mobile interfaces, and inadequate mobile security. All of these stem from websites that don’t have the right protective measures installed or those that aren’t optimized for mobile devices. Hackers can take advantage of these issues and use them to gain access to your website.
Securing Your Website, The First Steps
Protecting your website from being hacked can be achieved in a simple 11 step process.
1. Use Secure Passwords
The best website security starts with a secure password. The backend (the developer side) of every website is password protected. Although it’s tempting to use an easy to remember password; don’t.
Instead, pick something that is extremely secure and tough for anyone but you to figure out. A good rule of thumb for passwords is to include a mix of capital letters, punctuation, and numbers, or use a strong password created by a password manager. Never use something that is easy to guess. This goes for everyone in your organization.
2. Be Careful When Opening Emails
Many phishing attacks appear in emails. Hackers also send viruses via email. Every one of your employees (including you) needs to be careful when opening emails from people you don’t know, especially if those emails have an attachment. Spam guards aren’t infallible. A hacker can compromise website security with a virus, wreaking havoc on your website.
Even attachments that are scanned and declared to be “clean” can still contain harmful viruses. Train your employees to use security precautions when opening emails with attachments.
3. Install Software Updates
Manufacturers keep operating systems and software running efficiently with regular updates. It can be tempting to push those updates aside to save time. After all, many of them require a complete system restart and some installation time which eats into productivity. This is a dangerous practice, as those updates contain crucial new security patches. You need to install these updates as they are available to keep your entire system secure.
4. Use a Secure Website Hosting Service
Your web hosting service plays a vital role in the security of every website under their jurisdiction. Choose yours wisely.
Before you build or move your site to a host, ask them about their security platform. The best hosts work with or hires experts in the internet security field. They understand the importance that their customer’s websites aren’t vulnerable to attack.
Make sure they include a backup option. You could lose valuable information due to a hacker. It is easier to rebuild your site from a backup than it is from scratch.
Managed options are also available, such as Security as a Service (Saas).
5. An SSL Certificate Keeps Information Protected
The letters in “https” stand for Hypertext Transfer Protocol Secure. Any webpage that uses this protocol is secure. Those pages exist on a specific server and are protected. Any page that contains a login or asks for payment information needs to be on this secure system. With that said, it is possible to set up your entire website using https.
Google has started marking sites in the Chrome browser as unsecured that do not use SSL Certificates or encrypt data.
6. Secure Folder Permissions
Websites consist of folders and files that contain every piece of information necessary to make your site work properly. All of these live on your web server. Without the right privacy protections and security measures, anyone with the right skills can get in and see this information.
Prevent this from happening by assigning security permissions to those files and folders. Go to your website’s file manager and change the file attributes.
In the section for “numeric values” set the permissions to these options:
- 644 for individual files
- 755 for files and directories
7. Run Regular Website Security Checks
A good security check can identify any potential issues with your website. Use a web monitoring service to automate this. You need to run a test on your site’s programming every week (at minimum). Monitoring services have programs that make this easy to do.
Once you receive the report, pay close attention to the findings. These are all of the vulnerabilities on your site. The report should contain details on them. It may even classify them according to threat level. Start with the most harmful and then fix these issues.
8. Update Website Platforms And Scripts
We already covered the importance of keeping your computer software up to date. The same is true of your web hosting platform, and your plugins and scripts, such as Javascript.
If you use Wordpress, ensure that you are running the most updated version. If you are not, then update your version by clicking on the button on the upper left side of the screen. It is imperative to keep a WordPress site current to avoid any potential threats.
For people who don’t use Wordpress, check your web hosts’ dashboard for updates. Many of them will let you know which version of their software you’re running and keep you informed of any security patches.
You also need to check your plugins and tools.
Most WordPress plugins are created by third-party companies (or individuals.) Although they are safe, for the most part, you are relying on those third parties to keep their security parameters up to date. Set aside time to check for plugin updates at least once a week, and keep an eye out for anything that may seem strange, such as a plugin that ceases to work correctly. This could be a sign that it’s compromised.
9. Install Security Plugins
There are several options here, depending on what type of website you run. For those based on WordPress, there are specific WordPress security plugins that provide additional protection. Examples include Bulletproof Security and iThemes Security. If your site is not on WordPress, protect it with a program like SiteLock.
Security plugins prevent hackers from infiltrating your site. Even the most up to date hosting platforms have some vulnerability. These plugins ensure that no one can take advantage of them.
SiteLock monitors your site continually looking for malware and viruses. It also closes those vulnerable loopholes, providing additional security updates.
10. Watch Out For XSS Attacks
XSS is cross-site scripting. An XSS attack is when a hacker inserts malicious code into your website, which can change its information or even steal user information. How do they get in? It’s as simple as adding some code in a blog comment.
Prevent XSS attacks by inserting a CSP header into your website code. CSP stands for Content Security Policy. It limits the amount of Javascript on your website, keeping foreign, and potentially contaminated scripts from running. Set it so that only the Javascript added to the page by your or your web developer works.
11. Beware of SQL Injection
SQL stands for Structured Query Language. It’s a type of code that manages and allows people to search for information in databases.
Here’s an example of an SQL Attack: if you have a search form on your website, people can enter terms to look for specific new information. Now imagine that someone got into your database files and inserted a code designed to mess them up.
That code can delete information and make it tough for the website to find what it needs to run. Hackers get in through URL parameters and web form fields and wreak havoc. Keep this from happening by setting up parameterized queries and make sure to create secure forms.
Now You Know How To Secure a Website from Hackers
Hopefully, now you understand the importance of creating a secure website. You also understand the eleven necessary steps to follow to prevent hackers from gaining access to its code and elements.
Leaving your website vulnerable to hackers can destroy your livelihood, especially if you run a web-based business. All that it takes is one lapse, and years of years client information can be compromised. This makes your company look bad and creates negative press attention. You’ll lose customers, many of whom may not come back.
Don’t allow this scenario to happen. Instead, focus on website security using the tips presented here.
What Is Cloud Security & What Are the Benefits?
When adopting cloud technology, security is one of the most critical issues.
Many Organizations still fear that their data is not secure in the cloud environment.
Companies want to apply the same level of security to their cloud systems as their internal resources. It is essential to understand and identify the challenges of outsourcing data protection in the cloud.
What is Cloud Security?
Cloud security is a set of control-based safeguards and technology protection designed to protect resources stored online from leakage, theft, or data loss.
Protection encompasses cloud infrastructure, applications, and data from threats. Security applications operate as software in the cloud using a Software as a Service (SaaS) model.
Topics that fall under the umbrella of security in the cloud include:
- Data center security
- Access control
- Threat prevention
- Threat detection
- Threat mitigation
- Redundancy
- Legal compliance
- Security policy
How Do You Manage Security in the Cloud?
Cloud service providers use a combination of methods to protect your data.
Firewalls are a mainstay of cloud architecture. Firewalls protect the perimeter of your network security and your end-users. Firewalls also safeguard traffic between different apps stored in the cloud.
Access controls protect data by allowing you to set access lists for different assets. For instance, you might allow specific employees application access, while restricting others. A general rule is to provide employees’ access to only the tools they need to do their job. By maintaining strict access control, you can keep critical documents from malicious insiders or hackers with stolen credentials.
Cloud providers take steps to protect data that’s in transit. Data Security methods include virtual private networks, encryption, or masking. Virtual private networks (VPNs) allow remote employees to connect to corporate networks. VPNs accommodate tablets and smartphones for remote access.
Data masking encrypts identifiable information, such as names. This maintains data integrity by keeping important information private. With data masking, a medical company can share data without violating HIPAA laws, for example.
Threat intelligence spots security threats and ranks them in order of importance. This feature helps you protect mission-critical assets from threats.
Disaster recovery is key to security since it helps you recover data that are lost or stolen.
While not a security component per se, your cloud services provider may need to comply with data storage regulations. Some countries require that data must be stored within their country. If your country has this requirement, you need to verify that a cloud provider has data centers in your country.
What are the Benefits of a Cloud Security System?
Now that you understand how cloud computing security operates, explore the ways it benefits your business.
Cloud-based security systems benefit your business through:
- Protecting your business from threats
- Guarding against internal threats
- Preventing data loss
Top threats to systems include malware, ransomware, and DDos.
Malware and Ransomware Breaches
Malware poses a severe threat to businesses.
Over 90 percent of malware comes via email. It is often so convincing that employees download malware without realizing it. Once downloaded, the malicious software installs itself on your network, where it may steal files or damage content.
Ransomware is a form of malware that hijacks your data and demands a financial ransom. Companies wind up paying the ransom because they need their data back.
Data redundancy provided by the cloud offers an alternative to paying ransom for your data. You can get back what was stolen with minimal service interruption.
Many cloud data security solutions identify malware and ransomware. Firewalls, spam filters, and identity management help with this. This keeps malicious email out of employee inboxes.
DDoS Protection
In a DDoS or distributed denial of service attack, your system is flooded with requests. Your website becomes slow to load until it crashes when the number of requests is too much to handle.
DDoS attacks come with serious side effects. Every minute your website is inaccessible, you lose money.
Half of the companies that suffer DDoS attacks lose $10,000 to $100,000. Many businesses suffer from reputation damage when customers lose faith in the brand. If confidential customer data is lost in a DDoS attack, you could face legal challenges.
Given the severity of these side effects, it’s no wonder that some companies close after DDoS attacks. Consider that one recent DDoS attack lasted for 12 days and you sense the importance of protection.
Cloud security services actively monitor the cloud to identify and defend against attacks. By alerting your cloud provider of the attack in real-time, they can take steps to secure your systems.
Threat Detection
Security for cloud computing provides advanced threat detection using endpoint scanning for threats at the device level. Endpoint scanning increases security for devices that access your network.
Computing Security Considerations Require Team Effort
Cloud partners offer clear advantages over in-house data storage. Economies of scale allow a cloud service to invest in the latest security solutions, such as machine learning. As cloud solutions are scalable, your business can purchase what you need with the ability to upgrade at any time.
Now that you know what cloud security is, you have a better understanding of how service providers keep your big data safe.
Remember, a strong security policy should outline what strategies the service uses. You should ask questions to compare and ensure that you are protecting your critical business resources.
HIPAA Compliance Audit: Expert Security Guide To Stay Compliant
With stories about security breaches, computer hacking, and stolen personal data making the news daily, we are all concerned about the safety and security of our medical data.
Results of the 2019 HIPAA audits were troubling, and they only appear to be getting worse.
Only 14% of the covered entities and businesses scored a 1, the highest rating, for content breach notification. Only 1% of the covered entities and enterprises scored a 1 for right-of-access. No covered entities and businesses scored a 1 for HIPAA security risk analysis.
To ensure the safety and privacy of personal medical data and protected health information, the United States government passed the Health Insurance Portability and Accountability Act of 1996. HIPAA is United States federal legislation covering the data privacy and security of medical information.
The public has a right to demand privacy for personal medical data. We trust healthcare providers with our health. It’s only fair to be able to trust them with our protected health information and medical data. HIPAA sets expectations and guidelines, also known as HIPAA compliance, for healthcare providers to protect our medical data.
The Health and Human Services Office For Civil Rights manages HIPAA. They conduct audits to ensure compliance with the covered entities and businesses that handle medical data.
Unfortunately, some businesses struggle with HIPAA compliance guidelines. Healthcare providers have been reluctant and slow to protect data or upgrade their systems. Medical data-based ransomware attacks and healthcare cybersecurity breaches are rampant. Studies show that it costs more than $250,000 and upwards of six months to become HIPAA-compliant. However, many in the healthcare industry don’t have the time or resources to manage the process correctly.
There are steps you can take to prepare for HIPAA compliance audit.
We’ll look at the compliance rules and HIPAA auditing protocols. Then, go over the steps you can take to meet the demands of an audit and ensure compliance with HIPAA regulations.
Also, we prepared a complete checklist for HIPAA Compliance.
What is a HIPAA audit?
The OCR works closely with health care providers, covered entities and businesses to ensure compliance with HIPAA regulations the HIPAA privacy and security. HIPAA audits are conducted to track progress on compliance and to identify areas where improvement is needed.
To avoid expensive Hipaa violations and fines, secure protected health information. Providers should conduct a risk assessment and take steps to prepare for HIPAA compliance audits.
What Is HIPAA Title II?
While there are five separate sections covered in HIPAA, Title II is the section focused on protecting individual medical information.
Achieving compliance with HIPAA requires meeting the guidelines in Title II. The privacy rule in Title II focuses on Protected Health Information (PHI). It provides laws and standards that protect personal health information, detailing the covered entities and businesses required to abide by HIPPA.
The security rule, the other piece of HIPAA Title II, focuses on the safeguards and protection that must be implemented to safeguard PHI, especially regarding electronically protected health information (also called ePHI). This includes administrative, physical, and technical safeguards as well as organizational requirements and documentation standards. Data security plans and information technology infrastructure are critical to the security rule, which is an area where many healthcare providers struggle.
HIPAA Audit Requirements: 6 Steps To Be Prepared
1. Focus on HIPAA training for employees
Staff training is critical for an understanding of HIPAA compliance requirements. Employees who haven’t been trained or don’t have experience with compliance regulations can increase the risk of a failed audit.
Document your training to show the OCR (Office of Civil Rights), that you are dedicated to employee instruction. Create and publish policies that make training and education a priority. Make sure your team is thoroughly trained before the audit because OCR will ask questions to ensure everyone understands HIPAA regulations and compliance rules.
2. Create a Risk Management Plan and Conduct a Risk Analysis
A risk management plan and a risk analysis are required.
A HIPAA risk analysis looks for any security risks your company might be exposed to – all risks. The risk management plan is a strategy to address those risks.
In conducting the risk assessment, you should also prepare your security documents. Compliance rules state reports should be recorded, written, and kept in an easily accessible location. Rules should be specific to all aspects of your business, and not isolated to one area.
For example, all policies regarding the HIPAA privacy and security rule should be documented. Documents that cover incident response, breach notification, IT and firewalls, and physical security should be included. These documents will not only help in the audit process but provide clear direction in the operation of the business.
3. Select a Security Assessment and Privacy Officer
HIPAA requires a security and privacy officer for each covered entity and business. This does not have to be a new hire, but you do need someone responsible for the security and privacy of PHI. They are responsible for showing the effort being made to meet regulations.
The officer should also review business associate agreements. The OCR will discuss the third-party relationships that involve electronic protected health information. Create a list of vendors and suppliers, and the security and safeguards they have in place through the business associates agreement.
This officer should schedule a regular review of security policies and conduct a risk analysis on IT systems and data security. They should also have a record of any breaches or incidents. Don’t try to hide any problems or data breaches during the audit. Be honest. Incidents happen, and the OCR wants to know how you responded to the security breach.
4. Review Policy Implementation
As important as it is to document policies and procedures, it’s also important to see how those policies are being implemented. The OCR will review how those policies and procedures apply to the daily business operation, and if they are implemented consistently.
Talk to your team to see how the policies are working. If employees are struggling to follow policy, then take the time to analyze the problems and make adjustments as needed. Create an implementation schedule to include in the audit. The OCR wants to see the policies in action. If you are still implementing the plans, then show them the schedule, so that they know progress is being made.
5. Conduct an Internal Audit
An internal audit program is the best way to identify problems in your system before the OCR audit. Regularly conducting internal audits will not only help you solve problems before they turn into a fine, but also keep your team sharp and take pressure off during the actual review.
It’s often a good idea to work with an organization that specializes in compliance or data security to help conduct the internal audit. They can review your security and compliance standards and take a close look at your risk analysis and risk management plan. With an outside perspective, they may be able to identify problems that didn’t show up in your internal risk assessment. Partnering with an IT and data security provider will help ensure a complete and thorough internal audit.
As a best practice, review your policies and procedures as the auditor might. Consider if the policies are meeting the intent of the regulation and improving patient privacy and security. By critically analyzing these methods, you can find areas of improvement in both business operations and HIPAA compliance.
6. Create an Internal Remediation Plan
Once you’ve gone through the above steps and conducted an internal audit in preparation for your HIPAA audit, you should create a remediation plan to reduce risks and correct findings. Attach a schedule with timelines to the remediation plan and be prepared to discuss the plan with OCR during the audit.
While HIPAA sets guidelines and standards for protected health information, it’s also essential to see HIPAA as a continual process. A remediation plan and a schedule help to keep covered entities and businesses on track and compliant, even between audits.
Finally, make sure you limit your internal audit concerns to the policies and procedures of your business. While the business associate agreements are an important part of HIPAA, focusing on vendors and suppliers can leave your operations at risk. Your primary concern with the remediation plan and audit should be internal processes.
Start Preparing For Your HIPAA Compliance Audit
Risk analysis is a critical first step to achieve compliance with HIPAA. Compliance rules are not just crucial for meeting regulations but should be standards of ethical business operation.
Taking the steps above is critical for HIPAA compliance. Work with a HIPAA security compliance expert to review your IT infrastructure. Conduct a risk analysis and identify problems early, before the audit.
As the OCR prepares for the next phase of HIPAA audits, make sure you are ready. Protect your business and the private medical information you are entrusted to keep safe and secure.
Best Cyber Security Certifications To Grow Your IT Career
The need for cybersecurity professionals is on the rise.
We live in a world where corporate security could mean a reliable and dependable reputation or becoming the next disgraced headline. In a field that is as competitive as online security, a degree is all but a starting point. Companies are looking for more developed, more polished, and more dedicated employees.
While a cyber security degree and an internship might have edged out the competition in the past, what you need now, is a robust portfolio of relevant and up-to-date certifications.
The industry’s most trusted certifying bodies include CompTIA, EC-Council, (ISC)^2, EC-Council, and Cisco. Whether you intend to work on government or private contracts, industry employers require cyber security certifications to meet rigorous compliance criteria. As with any certification, it is essential to narrow down your professional direction.
Knowledge and experience aside, a robust portfolio of certifications will add to your pedigree if you’re looking to enter the cybersecurity space. Below, are some of the most crucial security certifications.
What do you need to take you to the next level?
The Basics of IT and Network Cyber Security Certifications
Cyber security training comes in all possible shapes, sizes and graduated levels of difficulty. They cover topics ranging from penetration testing, ethical hacking, why Janet in accounting’s “Password123” is not a strong password and is a vulnerability.
Entry-level certifications are designed to teach the fundamentals of industry best practices, current technologies, basic principles, and essential tools. Use these courses as an introduction to the world of cyber security.
Intermediate to expert-level certifications are designed for the security professional with detailed experience within the industry.
Course difficulty aside, understanding the particulars of security certifications is essential. First, security certifications from the accrediting organizations above, are often valid across multiple organizations and industries. They routinely expire after three to four years and need recertification to remain current.
The certification process naturally involves a final exam after completed coursework. Finally, continuing education credits are a requirement for re-accreditation.
Expected Cost and Time Commitment of Information Security Certifications
Certification costs vary by level, exam, and where you register but are often quite reasonable as far as IT certifications go. Expect most cybersecurity exams to cost anywhere from $300 for entry-level certifications to upwards of $600 for the more advanced programs.
If you are enrolled in higher education, it is worth contacting your academic advisor to see if your college or university offer a discount for information security certification exams. If you are already in the technology industry, employers will often provide reimbursement for the coursework that could benefit the company.
It is worth mentioning; cybersecurity coursework can be completed at any stage in your career. Certification does not require previous education or a specific degree. By attaining a cyber security certification, you dramatically increase your chances of landing a position within the security industry. The need for qualified cybersecurity professionals within sectors such as computer forensics, security administration, security analysis, security architecture, security auditing, security engineering, etc., is at an all-time high.
Depending on your experience within the computer and information security industry, the expectation is that most cybersecurity courses will range from three to nine months. Most security certifications are through correspondence. Therefore, self-study includes online coursework from reputable training centers or purchased books to learn the materials for the exam. If you are a recent college graduate or have already begun a career in IT, make sure to check to see which certifications your targeted employers require or recommend for certain cybersecurity positions.
Choose The Right IT Certification For Your Career Goals
The appropriate certification can make or break an employment opportunity. The last thing you want to do is spend time, effort and money for a certification that’s either not recognized or isn’t the right fit.
Choose a certification that is right for you, to evaluate what area of expertise you are working to achieve.
Are you a beginner, recent graduate, or a seasoned professional? While a college degree is an excellent and recommended step toward starting a career in IT, many industry hiring managers use security certifications in their screening and weight them seriously in their hiring process. Software that crawls through a stack of resumes will often pick up certification keywords.
If you are starting your career in the field of IT, you can select certifications from EC-Council, CompTIA, and CISCO.
Some of the certifications you may wish to pursue are the GIAC Security Essentials Certification, CompTIA Security +, or the Systems Security Certified Practitioner. Make sure you have also researched which of these or other certifications employers you wish to work for will accept.
Job opportunity examples for each certification.
GIAC Certified Incident Handler: This certification is ideal for those looking to detect, respond, and fix security incidents.
Certified Ethical Hacker: This is the ideal certification for a white hat hacker or penetration tester.
Certified Information Systems Security Professional (CISSP): This is an advanced certification for security managers and policy managers. Security professionals with this certification earn well over six figures and are in high demand across nearly any industry.
CompTIA Advanced Security Practitioner (CASP): Among one of the newest certifications in the list, the CASP is now recognized as an IAT Level III DoD approved baseline certification. Government employers will accept a CASP for virtually any level of security or IT professional.
Certified Information Security Manager (CISM): This certification is significant for those in managerial positions in industry jobs such as a CIO.
We strongly suggest having at the very least, an entry-level exam under your belt from one of the accrediting authorities mentioned. However, if you prefer to jump into the deep end right away, have at least five years of experience in the field, so you are set up for success.
Doublecheck with the accrediting body on whether they require any prerequisites for intermediate or advanced certifications. For example, the EC-Council’s Certified Ethical Hacker certificate requires at least two years of relevant security experience.
Details about the industry’s best and highest recommended cyber security certifications are below:
EC-Council IT Cyber Security Certifications
The EC-Council is one of the industry’s leading accrediting authorities. The EC-Council offers a variety of IT security certifications. They include knowledge of networks, information security, and internet security. EC-Council provides online training to all their certificate programs through live instructors.
The Certified Ethical Hacking (CEH) certification is the EC-Council’s most sought-after certificate.
A CEH certificate focuses on ethical, lawful, and legitimate hacking techniques. Employers who hire penetration testers regularly require this certification. The main reason is to ensure certified individuals understand the minimum standards in ethical hacking measures. Obtaining the CEH shows an individual meets and exceeds the knowledge of these minimum standards. CEH certificate holders possess the demonstrated understanding that ethical hacking is unique and self-regulating.
About the CEH:
The CEH exam consists of 125 questions. Individuals have 4 hours to take the multiple choice exam. The prefixes of the exam are 312-50 (ECC) and 312-50 VUE.
When you take the online CEH course through the EC-Council, you will have access to over 140 labs developed by industry experts that mirror real-life scenarios to give you an experience of what it is like to experience attacks. You will also be able to access nearly 1700 graphical slides to help you understand complex security concepts in the 5-day hands-on class.
CEH Blueprint:
The CEH blueprint consists of seven sections each weighing differently on the total score with a different number of questions.
A summary of the blueprint is as follows:
| Section | Demonstrated knowledge | Weight | Questions |
|
1 Background |
Networking and systems technologies, malware operations, telecommunication technologies | 4% | 5 |
| 2 Analysis/Assessment | Data and systems analysis, risk assessments, technical assessments | 13% | 16 |
| 3 Security | Firewalls, cryptography, threat modeling, physical security, and more | 25% | 31 |
|
4 Tools/Systems/Programs |
Network, host-based intrusion, network and wireless sniffers, etc. | 32% | 40 |
| 5 Procedures/Methodology | Public key infrastructure, security architecture, etc. | 20% | 5 |
| 6 Regulation/Policy | Security policies and compliance regulations | 4% | 5 |
|
7 Ethics |
Professional code of conduct and appropriateness of hacking | 2% | 3 |
The path to CEH certification requires you to become a master of hacking technologies and remain an ethical hacker. You will learn several different methods to achieve ideal security in your organization. This method includes five phases of ethical hacking and different approaches to targets and how to succeed. Specific stages include reconnaissance, enumeration, maintaining access, gaining access, and covering your tracks.
The CEH training offers advanced ethical hacking techniques, tools, and procedures in 18 relevant security domains required to move into advanced computer security. Individuals can take the exam without taking the official CEH training. However, you will need to have at least two years of information security experience and pay a non-refundable application fee of $100. There is no guarantee of passing the exam whether or not you take the official training, so make sure you’ve studied the material well. Nobody wants to retake an exam.
The EC-Council Certified Security Analyst (ECSA) is the next level of EC-Council certifications once you complete the CEH training and certification. The ESCA is a globally accepted, hands-on penetration at an expert level. Training and accreditation increase your knowledge of exploitation by demonstrating you can apply the skills learned from the CEH. This program centers on penetration, testing methodology through hands-on learning.
About the ECSA:
This exam involves a multiple choice question exam in addition to a penetration testing report based on a challenging scenario you have 60 days to submit to the EC-Council. You will be involved in a 5-day class before activating the ECSA Dashboard. You have 30 days to finish pentesting challenges in an iLabs portal.
The complete exam includes two stages: a written report and a proctored multiple-choice exam. The written portion will require you to perform various penetration testing exercises in iLabs before submitting your penetration report. The multiple-choice exam consists of 150 questions from which you will have 4 hours to complete a minimum score of 70% to pass.
The ECSA course outline includes such topics as:
- TCP IP Packet Analysis
- Automated Software and Application Testing
- Pre-penetration Testing Steps
- Security Analysis and Penetration Testing Methodologies
- Information Gathering Methodology
- Internal Network Penetration Testing Methodology
- External Network Penetration Testing Methodology
- Firewall Penetration Testing Methodology
- IDS Penetration Testing Methodology
- Web Application Penetration Testing Methodology
- SQL Penetration Testing Methodology
- Mobile Device Penetration Testing Methodology
- Cloud Security Testing
- Report Writing and Post Test Actions
- Vulnerability Analysis
Unlike the CEH, you will not be able to take the exam based on your previous knowledge and experience of penetration testing. The ECSA requires students to meet specific eligibility requirements. To be eligible, you must pass a detailed penetration test through the EC-Council’s Cyber Range iLabs environment. Upon successful completion of the pre-eligibility, you will be allowed to take the ECSA exam.
In the challenge scenario, you will receive a brief background about a (hypothetical) professional in a large organization. You will face a troublesome situation in which you are tasked to protect multiple organizational units. The scenario may provide the infrastructure available to the professional and a specific challenge. Your task would be to submit a response as to how you would handle the situation if you were the individual.
In addition to the CEH and ECSA, the EC-Council offers more specialized training related to the ethical hacking and penetration testing industry. You can pursue options such as:
Computer Hacking Forensic Investigator
EC-Council Certified Security Analyst
EC-Council Certified Incident Handler
EC-Council Certified Secure Programmer
EC-Council Certified Disaster Recovery Professional
Chief Information Security Officer
Certified Secure Computer User
These additional EC-Council cyber security training programs did not make our “Best of 2019” list just because they target individual career paths. The EC-Council’s CEH and ECSA are the best cybersecurity certifications to complete as they are a requirement for many cybersecurity careers. The additional certification programs are great as long as you have a specific need for them.
CompTIA Security Certifications
CompTIA certifications are some of the industry’s most sought-after certifications because the Department of Defense (DoD) requires several for nearly any IT related position. All of the above CompTIA certificates are valid for three years and must be renewed to stay active and current.
CompTIA certifications work in four steps:
- Select your certification path.
- Begin training and learn about the certificate you wish to pursue.
- Familiarize yourself with the certification exam.
- Register and take your certification exam.
Unlike the EC-Council, CompTIA does not require you to take training directly with them to become certified. Many people who go through the CompTIA exam process do self-study by purchasing a book that covers the course material. Additionally, online training is available through lectures and briefings. Expect to spend anywhere from three to six months studying for any selected CompTIA exam.
CompTIA Security + Certificate
The most popular CompTIA exam is the Security+ certificate. It is the most globally trusted certificate to showcase core IT security training knowledge that is vendor-neutral. Security+ is the baseline network certification any IT professional should obtain because it combines the principles of network security and risk management.
The Security+ is approved by the DoD to meet the Directive 8570.01-M requirement. Security+ also meets the requirements under the Federal Information Security Act (FISMA).
CompTIA does not offer instructor-led training. Instead, they suggest a CompTIA Authorized Quality Curriculum (CAQC) training manual to help prepare for the exam. You can contact your local college or university to see if they offer CompTIA training.
CompTIA requires you to take their proctored exam through a certified testing center. You can find a test center and schedule your exam through Pearson Vue or find a CompTIA Authorized Training Provider Partner through the CompTIA website based on your location. You will not be allowed to take anything into the test room with you other than a pen, pencil, and a few sheets of paper. The proctor may ask you to leave all cell phones and other electronic devices in your vehicle or outside the testing lab. Do not attempt to sneak a smartwatch or other electronic devices into the exam room.
The Security+ is considered one of the most robust certificates you can get to complete. As of this writing, there are currently two Security+ exams you can take: SY0-501 and SY0-401. The SY0-401 is offered through July 31, 2019, after which it will be sunsetted. The SY0-501 is a new version of the certificate that validates the foundational skills required to perform core cybersecurity functions.
The certificate emphasizes the knowledge of hands-on practical skills you will see used by junior information systems auditor, systems analysts, systems administrators, penetration testers, network administrators, security administrators, and many other IT-related careers.
While CompTIA suggests starting off with their A+ and Network+ certificates, we recommend starting off with Security+. As long as you understand the basics of networking, and you have practical experience, you should not need to start off with A+ or Network+.
Security+ Exam Description
The Security+ exam consists of 90 multiple-choice and performance-based questions. You must obtain a passing score of 750 points out of the 900 possible. The exam lasts for 90 minutes. CompTIA’s performance-based test questions enable you to demonstrate your practical knowledge of the material in a simulated lab environment.
With the exam being only 90 minutes, you will have to manage your time efficiently and strategically. Otherwise, you will exhaust your time or become pressed for time to finish the rest of the exam. Unanswered questions are considered abandoned and marked as incorrect.
Most performance-based questions will appear at the start of the exam. You won’t be able to see a clock when working on these so make sure you keep an eye on the time. If you are unsure about your answers, move to the next question and click “done.” You can mark the item for review and return to it later if you need to.
CompTIA offers a list of FAQs on their performance-based questions. These questions cover such things as the instructions window, the reset button, what the “done” button does, the timer, and more.
Renewing your Security+ and other CompTIA Certifications
CompTIA requires you to renew your CE program every three years to continue validating your expertise and expand your skillset. The CE program enables you to restore your certification through various training and activities related to your Security+ certification.
You can renew by participating in various training programs and activities to include higher certifications. You must collect 50 Continuing Education Units (CEUs) in three years and upload them to your certification account to automatically renew your Security+ certification.
Cost of the Security+ exam
CompTIA offers three purchase options for the Security+ exam. The base Security+ is $330, the Deluxe Bundle is $409, and the Premier Bundle is $499. The base exam is the cost of one exam voucher. The Deluxe Bundle offers an exam voucher retake and the CompTIA CertMaster for Security+. The Premier Bundle includes everything from the Deluxe Bundle plus a $100 CompTIA Marketplace e-Gift Certificate.
CompTIA CASP
The CompTIA Advanced Security Practitioner (CASP) is the highest level certification over Security+. Individuals seeking this exam should have at least five years of IT experience and at the minimum, similar knowledge level of security as taught in the Security+.
It is not required to take the Security+ exam before the CASP exam, but you should expect to study much more for the CASP than you would for Security+. Many of those who have taken CASP to reference it as “Security+ on steroids.” With CASP, you will be required to have a deeper understanding of network security training across a broad spectrum of security disciplines.
As with the Security+, CASP meets the ISO 17024 standard and is approved by the DoD to fulfill the 8570.01-M requirements. Career paths that use the CASP include cybersecurity professionals, security architects, IT specialists, information security analysts, and more. Among the employers that use and require CASP are the U.S. Army, the U.S. Navy, the DoD, and many others within the government realm such as DoD contracting agencies.
CASP Exam Details
The two current versions of the CASP are CAS-002 and CAS-003. The CAS-002 version will be sunsetted in October 2018.
The CASP exam covers technical knowledge and skills required to engineer, conceptualize, integrate, and implement secure solutions across complex computer networking environments in support of a resilient enterprise. You will have 165 minutes to complete the 90 question test. The test consists of a mixture of multiple choice and performance-based questions.
The CASP exam is pass/fail, and you will not see a scaled score on your test results. As previously mentioned, CompTIA recommends you have at least five years of hands-on IT experience or a minimum of ten years of experience as an IT administrator. However; these are not required, and you can take the exam if you are confident in your knowledge of the material.
The cost of the exam is $439 directly through CompTIA. If you are a college student, check with your school to see if they offer a discount with CompTIA for exam vouchers. Depending on your employer, they may be willing to pay for the exam up front, reimburse your exam fee once you pass, or offer group training classes with exam vouchers included.
Study Prep for CASP
As with the Security+ and other CompTIA exams, CompTIA does not directly offer training but recommends you use CAQC training materials to help you prepare. CompTIA also offers a book you can purchase to study for the exam by the publisher Logical Operations. The book is available for both the CAS-002 and CAS-003 versions of the test. The text is an ebook that includes a LearnTO video to reinforce essential content, checklists, and assessments at a price of $126.
In addition to the ebook, you can purchase online training by SkillSoft Corporation from the CompTIA website. Currently, the training is only available for the CAS-002 version of the exam. The training includes self-paced online eLearning videos for support and instruction, practice and assessments with feedback, bookmarking and transcripts, tablet support, personal live mentoring, and a simulated practice exam with answers for a price of $351.
(ISC)² Certified Information Systems Security Professional (CISSP)
The CISSP is a standalone certification offered by (ISC)² and is a certification that demonstrates your solid foundation in digital security. The CISSP carries the same weight as the CASP in many DoD organizations but is required in more advanced positions that vary by organization. The skills you will learn while studying for the CISSP are essential for individuals who need to engineer, design, and implement security systems.
While you can take the CISSP exam at any stage of your career, it is highly recommended you have at least five years of experience in a position related to cybersecurity. You must know two of the eight domains in the study material or a standard body of knowledge.
The exam will be receiving an update on April 15, 2018, with changes to the domains and weights. Most individuals study for the exam with self-prep materials for at least three to six months. Make sure to routinely check the (ISC)² website to find updates to the exam outline. The site currently offers an exam outline after April 15, however; it is a best practice to keep checking to make sure you receive the most current framework.
The eight domains mentioned above are:
- Risk and Security Management
- Asset Security
- Security Engineering
- Communications and Network Security
- Identity and Access Management
- Security Assessment and Testing
- Security Operations
- Software Development Security
CISSP Exam Details
The length of the 100 – 150 question exam is 3 hours. The exam consists of multiple-choice and advanced innovative questions. You must achieve a passing score of 700 out of 1000 points. You must take the exam at an (ISC)² Authorized PPC or PVTC Select Pearson VUE Testing Center. The cost is $599.
The current exam weights in each of the different domains up through April 15, 2019, is as follows:
- Security and Risk Management – 16%
- Asset Security – 10%
- Security Engineering – 12%
- Communications and Network Security – 12%
- Identity and Access Management – 13%
- Security Assessment and Testing – 11%
- Computer Security Operations – 16%
- Software Development Security 10%
CISSP Training
(ISC)² offers various methods of cybersecurity training and prep for the CISSP exam. You can choose from classroom-based training, online instructor-led training, online self-paced, and private on-site training. All training is different and is tailored to fit your preferred method of learning and prep for the exam.
All training costs are in addition to the $599 exam fee and vary by the type of training you need. For example, the classroom-based training is in-person training for five days. The classroom training schedule is displayed around the world at various locations.
Online instructor-led training offers a more flexible way to prepare for the CISSP certification exam. You can choose from weekday, weekend, or evening courses delivered over a period of 3-5 weekdays, 3-5 weekend days, or two 2.5 hour sessions weekly over 5-8 weeks. If you prefer the self-paced online training, you can register for a seminar and have up to 120 days to complete the training. The final option is available through (ISC)² and is five days long.
ISACA Certified Information Security Manager (CISM)
CISM is another cybersecurity certification that will provide you with a competitive advantage over other career candidates. The CISM is among one of the most sought-after certifications. Individuals who pass the CISM exam have demonstrated they have the knowledge and experience required to manage and develop enterprise information security programs.
The certification is built for IT security managers, those aspiring to become an information security manager, and IT consultants that support information security program management.
Similar to other certification exam requirements, the CISM calls for individuals to have at least five years of experience in the information security field with at least three years of management experience in three or more content areas. This certification is not for recent college graduates and is considered a senior level exam. You must gain your information security experience within a ten-year time frame before your application date or within five years from the date you pass the exam.
Preparation for the CISM exam
You can download the ISACA Exam Candidate Information Guide from the ISACA website to help you prepare for the exam. The guide includes information about the exam registration, dates, deadlines, and essential candidate details for the day you take the exam.
Also, ISACA offers a job practice area, online review course, virtual instructor-led training courses, and additional study materials. ISACA also offers a CISM exam study community you can join. The online community was created to help individuals share thoughts, ideas, experiences, and questions with others looking to take the CISM exam.
CISM exam details
The exam consists of a 200 – 800 point scale with a passing score of 450 or higher. The score is a conversion of the raw score from a standard range on the exam.
The CISM is only available during certain times of the year. For 2019, you can take the exam during these time-frames:
1 February – 24 May
1 June – 23 September
1 October 2019 – 24 January 2020
You can register for the exam at a PSI testing location. You can visit www.isaca.org/examlocations to find a listing of the exam sites. The testing vendor is PSI. You must register for the CISM exam online and expect to pay $545 for the exam fee if you are not a member of the ISACA or $415 if you are already a member. You must pass the exam and apply for certification.
You are required to adhere to ISACA’s code of professional ethics. Once you obtain certification, you must comply with the Continuing Education requirements as with CompTIA. You must have a minimum of 20 continuing professional education (CPE) hours each year, and pay the CE maintenance fee. You will also have to complete 120 CPE hours within a fixed 3-year certification cycle.
The exam covers four information management security areas. The domain areas and weights include:
- Information Security Governance – 24%
- Information Risk Management – 30%
- Information Security Program Development and Management – 27%
- Information Security Incident Management – 19%
Conclusion: The Best Cyber Security Training Programs For Your Career
We have presented some of the most sought-after cyber and IT security certifications. As an information security professional, new college grad, or information technology professional, you will want to take some of the exams in this list. Many government jobs require at least an entry-level certification such as the Security+ to work on any information system.
Exam providers such as the EC-Council and CompTIA offer several other certifications. While many of the other certification exams provide valuable, in-depth information to expand your knowledge and skillsets, it is recommended you explore which certifications your employer recognizes.
If you are doing self-study for a certification exam, make sure you are studying current and up-to-date materials. Make sure your study material is either approved or recommended by the approving authority of the certification. Make sure to put a plan together of when, where, and how you plan to study for the exam. There are great study guides available online to get you started. The last thing you want is to either be underprepared or run out of time before taking the exam itself.
Make sure to use practice tests offered by approved resources such as the accrediting body’s website or affiliate partners.
Good luck!
What are HIPAA Violations? What Are The Fines or Penalties?
Signed in 1996, the Health Insurance Portability and Accountability Act (HIPAA) is legislation that provides data privacy and security provisions for safeguarding medical information. Essentially, if you’re handling, transmitting, in possession of, or responsible for any health records; you’re going to need to be in compliance with HIPAA.
Regulation around HIPAA is strict and specific. However, what happens if HIPAA guidelines aren’t followed to the letter?
It’s important to know what constitutes a HIPAA violation for the sake of personal data.
Did you know that there are stiff penalties and fines for a violation? A breach could also destroy your business and your credibility within the healthcare community.
Who Needs to Worry About HIPAA Compliance?
The short answer is that everyone within the healthcare industry must be compliant. Anyone handling PHI must receive proper authorization and commit to full HIPAA compliance. HIPAA’s prime directive is to protect individually identifiable health information and to become the standard for the healthcare industry.
The standards are in place to protect both sides of the information: the patient and the establishment. These violations and the potential for a poor public reputation could be disastrous. Being aware of your requirements and standards is essential. If the guidelines aren’t followed, HIPAA violation penalties can be assessed
Organizations are required to secure all information and data on-site according to all relevant guidelines. They are also expected to remain compliant with their vendors and service organizations, known as Business Associates (BA). The secure sharing of protected electronic medical records is vital to providing quality medical care.
The intersection between healthcare professionals and the IT/Security industry means that many teams are working tirelessly behind the scenes to remain HIPAA compliant.
Here is a sampling of situations where HIPAA compliance is necessary at all times:
-
- IT vendors that access hospital information systems (containing patient data) to install, update and maintain malware protection and other security services.
- Organizations that hire outside cleaning, security or HVAC services. These services could view unattended documents and/or computer rooms while being unauthorized.
- Software companies that locally host programs that use or process Protected Health Information.
- A consultant granted local network access to PHI records to review compliance, quality or competitive metrics.
- Healthcare organizations that are instructing and monitoring BAs that handle PHI.
- A local or international data center or HIPAA web hosting company that has a focus on compliance for many regulations.
What Constitutes a HIPAA Violation?
You and your team have all of the HIPAA pieces in place: you’ve studied up on the rules, regulations, implementation, and even spoken to your external vendors. But what happens if you think you have missed something and you’re concerned about a violation. What do you need to know and what do you have to watch out for?
As long as you’re vigilant and detailed, you should be able to avoid some of the most common HIPAA violations:
- Sending texts containing PHI.
- Improper mailing or emailing of PHI. Is Gmail Compliant?
- Failure to monitor and maintain PHI access logs.
- The omission of a HIPAA-compliant Business Associate (BA) agreement with vendors before allowing access to the information system containing PHI.
- Accessing patient information on a personal device or home computer.
- Inadequate or lack of limitations as to who may view PHI.
- Failure to remove access authorization to employees who no longer have a reason to access PHI.
- Poor training to ensure that employees understand the many HIPAA requirements and guidelines.
- Lack of documentation of HIPAA compliance efforts.
Lost or Stolen Devices
Professionals in the healthcare industry often travel for work to attend security seminars and conferences. A smartphone, tablet, or laptop is a prime target for theft when left unattended.
A physician or hospital administrator has access to PHI. Therefore, if their device is lost or stolen, it is a direct violation of HIPAA. It is vitally important to keep track of your mobile devices. It’s also worth having remote-wipe systems in place in case a device goes missing.
Employee Disclosure of PHI
Employees must understand that discussing a patient’s condition, medications, or any personal data with co-workers or friends is a direct violation of HIPAA regulations.
Employees must also remain mindful of their environment when discussing a patient with authorized colleagues. Take extra care when discussing anything about a patient.
Improper Disposal of Medical Records
Employees must physically shred all records before placing them in the trash or recycling bin.
Electronic information that is deleted must be tracked and logged.
When in doubt, employees should seek the advice and training of their IT or compliance team to properly dispose of PHI records.
Mishandling of Records
Photocopiers are a high-risk zone for mishandling of PHI.
Most photocopiers feature a storage drive that saves and collects a document to let employee retrieve it at their desk or to re-print at a later time.
If the person creating the resulting document forgets to close their session, the following employee
Failure to Conduct a Risk Analysis
The HIPAA Security Rule and the HHS mandate that healthcare organizations perform a risk analysis. The risk analysis helps organizations discover opportunities and vulnerabilities in their computing system.
If the results indicate issues with confidentiality, integrity, and availability of electronic PHI held by the healthcare organization, the organization may correct the issue.
Left uncorrected, the findings may result in HIPAA violations.
HIPAA Penalty & Fine Structure
What are the consequences of violating HIPAA?
There are four tiers of HIPAA violations:
-
- Tier 1. Lack of awareness where a covered entity or individual was unaware that the act in question was a violation. Fines start at $100 and go up to $50,000 per violation, topping out at $1.5 million each year.
- Tier 2. Reasonable cause to believe the individual or entity knew about the rule or regulation. Issues at this tier are considered a lack of due diligence. The fines range from $1,000 to $50,000 per violation. The maximum fine is $1.5 million per year.
- Tier 3. The HIPAA violation was performed with willful neglect. The party then corrected the violation within the required time period of 30 days after discovery. Fines at this tier start at $10,000 and go to $50,000. The maximum penalty is $1.5 million per year.
- Tier 4. At this tier, the violation was made with willful neglect of HIPAA Rules. Further, the entity made no effort to correct the violation. There is a standard $50,000 fine per violation at this tier with a maximum fine of $1.5 million each year.
There are also criminal penalties for HIPAA violations and potential jail sentences:
-
- Unknowingly or with Reasonable Cause. The person may receive a jail sentence of up to one year.
- False Pretenses may result in a five years’ maximum jail sentence and a fine increase to $100,000 per violation.
- Personal Reasons or to Commit Fraud or a Crime. Malicious intent such as data breaches may lead to a jail sentence of up to 10 years and a fine up to $250,000 per violation.
As you can see from the HIPAA fines chart, the penalty structure for violations can act as a strong deterrent for healthcare organizations.
Recent HIPAA violations cases reported by federal law enforcement include:
-
- Memorial Healthcare System received a fine of $5,500,000 in 2017
- Children’s Medical Center of Dallas incurred a penalty of $3,200,000 in 2017
- Advocate Health Care Network’s violation warranted a $5,500,000 fine in 2016
How Are HIPAA Violations Uncovered?
The most common way that HIPAA violations are uncovered is through internal compliance audits performed by HIPAA-covered entities.
From an internal perspective, risk analysis is a powerful tool in discovering issues with HIPAA compliance. Risk analysis audits give organizations a chance to identify the violation source and correct it before an inspection takes place.
Employees often self-report when accidentally committing a HIPAA violation.
Finally, the Department of Health And Human Services Office for Civil Rights (OCR) may receive a direct complaint or tip on a potential HIPAA violation.
If a HIPAA private rule violation has occurred, there’s a safe bet that it will be uncovered sooner than later. It’s best to abide by all guidelines and regulations to avoid any issue.
Preventing HIPAA Violations
There are a few key steps to staying in-the-know and preventing HIPAA violations:
- Develop a strong PHI policy for employees that reflects current HIPAA rules and regulations. Optimize and update this policy regularly as HIPAA regulation will also change.
- Make sure all BAs sign the necessary PHI agreement.
- Perform regular audits of security systems and procedures.
- Hire an auditing team to perform the appropriate risk assessment to identify and correct potential security risks.
- Regularly monitor HIPAA compliance updates and changes.
With these steps in mind, you can avoid steep HIPAA violation fines.
Avoid Risking Compliance Fines and Penalties
The more you know about HIPAA guidelines and regulations, the better your organization will be when it comes to remaining compliant. The last thing you want is to unknowingly (or knowingly) walk into a situation where you’re handed an avoidable violation face a large fine.
The most important tool at your disposal is information. With the right strategy and training, your organization can stay on track for complete and consistent HIPAA compliance.
Is Gmail HIPAA Compliant? What You Need to Know
Most industries rely on email to communicate, whether that is for status updates, meeting requests, or general information. The healthcare industry is no exception. Doctors, nurses, and specialists have to speak to one another about patient care just as regularly as the rest of us have to schedule that critical brunch meeting. What you might not have considered is that healthcare professionals must take an extra level of care to keep your private information safe.
Email within the healthcare industry must be HIPAA compliant and have compliant cloud storage and backup, especially when discussing patient-related issues. With over 281 billion e-mails sent worldwide every day, it is vital to maintaining HIPAA compliance for any medical industry.
As the largest email provider in the world, Google’s free service, Gmail, is available to everyone. But can it be used to maintain HIPAA compliance?
Let’s discover how e-mail works with Gmail, HIPAA compliance requirements, and if Gmail can function as a modern and efficient system for managing healthcare correspondence.
HIPAA Compliant Email Defined
Being HIPAA compliant goes back to People, Process, and Technology. “People” need to appropriate training to protect and handle Personal Health Information. “Processes” need to be supportive and simplistic to use, so people don’t circumvent them for more straightforward solutions. Finally, “Technology” should provide a platform that supports all of the above using the latest, auditable technology tools. In other words, you need to be able to capture usage logs, history, etc. into a long-term archive. We break it all down in our HIPAA Compliance Checklist.
Before determining whether an email service is HIPAA compliant or not, you should have a basic understanding of what HIPAA compliance in e-mail is. The Health Insurance Portability and Accountability Act (HIPAA), exists to protect the sensitive personal data of patients. HIPAA laws regulate how insurance and healthcare providers can disclose and use their Protected Health Information (PHI).
In theory, this should mean that if you are following all HIPAA standards and procedures, that e-mail can, in fact, be HIPAA compliant.
One of those standards is a robust level of multi-factor encryption. The goal is to guarantee that the communication between the provider and the patient is limited to those two parties and no one else. Therefore, even an encrypted email accessible by someone else (ex. a family member) who should not have seen it, theoretically is a HIPAA violation. That said, file encryption puts email text in a sort of code that cannot be read without decrypting the content—something that is done by the end user when the email is opened, and the user’s password is entered.
Gmail Itself is Not HIPAA Compliant
It’s easy enough to get a Gmail account. With over a billion active users, it’s clear that Gmail is the most active e-mail service in the world. Here-in lies the issue: this type of personal email is not compliant.
What makes email HIPAA compliant?
To be compliant, an email provider must sign a Business Associate Agreement (BAA). A BAA is a contract between the healthcare provider and anyone they do business with that will have access to protected health information.
Email, or more specifically an email server, is a perfect example of a third party who would have the opportunity to gain access to patient information. Therefore, any email provider that wants to support a healthcare institution must be willing to sign a BAA.
The issue with using an out-of-the-box Gmail account that you or I can sign-up for is that Google is unable to sign a business associate agreement baa. Not having a BAA means you’re not HIPAA compliant.
Introducing G Suite for Business Users
Fortunately, Google offers additional services to businesses. GSuite is a collection of the most-used Google apps for business, including Gmail, Google Drive, and Google Calendar, specially packaged for enterprises. GSuite must be associated with a domain that the user owns and is a paid service.
Although GSuite gives users access to Gmail, the most significant difference lies in Google’s ability to sign a BAA. This means that healthcare providers who wish to use Gmail as an email service for their company have the opportunity to purchase GSuite, link it to their company’s domain, and handle the technology component of the solution triad.
But not so fast: this does not create a HIPAA compliant solution. There’s more to do after a BAA is signed to ensure that all patient data that would be shared over email is protected. Encryption is a critical component of verifying that patient information is safe when being transmitted via email.
Think of it in terms of achieving two goals:
-
- Validate that you are only communicating with the intended party. This falls under the Privacy Component. By using PKI infrastructure and the encryption of the email using the patients Public Key, you can increase the level of confidence in the “privacy” of this communication.
- Confirm that the transmission cannot be intercepted. This component falls under Confidentiality. This is where encryption plays a role. As the communication is encrypted via the patients Public Key, only the patient can decode the message using their Private Key.
Third Party Encryption is Necessary for Full Compliance
While it is possible to encrypt emails using GSuite, this does not meet the encryption requirements to remain HIPAA compliant. Google uses Transport-Layer Security (TLS) to help encrypt e-mails in transit, but by Google’s own published statistics, 10% of emails sent and received remain unprotected. This is well under any limit that is acceptable to comply with HIPAA standards.
Users should be aware that even for GSuite, Google will automatically scan emails for spam and necessary security prevention. In 2017, Google eliminated scanning public e-mails for keyword research.
For Gmail to be genuinely HIPAA compliant, you need to use third-party encryption. A third party service will encrypt emails from inbox to inbox, allowing health providers to remain confident that their emails are compliant with HIPAA laws and keep their patients’ data as protected as possible.
Should You Also Obtain Consent from Patients?
You may want to consider having your patients fill out a consent form if you plan on communicating with them via email. Remember that households often still use shared e-mail addresses. A patient needs to sign off that it is okay to send such an email where others can potentially access the information. With today’s advances in technology and the busy lifestyles that people lead, email is often preferred over other forms of communication when it comes to confirming appointments or sending lab test results. However, patients should be aware that even despite extensive efforts on the part of the healthcare provider to protect sensitive information, no email is 100% safe.
When you obtain written consent from patients, you ensure that your patients are not only aware of the possibility that their data could be compromised when sent over email, but you obtain their permission to do so.
While some people believe that a written consent takes the place of purchasing a G Suite account and working with a third-party encryption service, this is not recommended. Even if your healthcare facility obtains approval from patients to send their data over secure email, you should still make every effort to ensure that data is encrypted and protected.
Sending HIPAA Compliant Email With a Signature
In the past, an email signature would be used to remind the recipient that the email may contain Protected Health Information. It would prompt them to delete the email if they believed that it was not intended for them.
While this in no way guarantees that an email received in error will be removed, it is one more step to show patients and lawmakers that as a healthcare provider, you are making every reasonable attempt to protect patients’ private data.
However in today’s market, if the e-mail is encrypted appropriately, the recipient would never see the footer, to begin with. These types of “security rules” are not considered acceptable and would never be compliant whatsoever.
You should use an email signature to remind patients how they can contact you and have their email removed if they should decide they are no longer comfortable sending and receiving emails that may contain their PHI. Making it easy for patients to opt out is another way to make sure that the only patients who receive emails are those who want to and have accepted the potential risks.
Compliant Email—It’s A Requirement In 2018
With the technology that is available today, there are very few legitimate reasons why a healthcare provider would not employ them to ensure that patient data is safe over email and all reasonable efforts have been made to make Gmail HIPAA compliant.
Not only are HIPAA violations and fines costly, but they can also be detrimental to the reputation of a practice. A healthcare provider that has been saddled with one or more fines due to violating HIPAA laws may find it more challenging to grow their patient base once word gets out.
Simply put, all healthcare providers who plan to use Gmail as an email service to communicate with insurance companies, patients, and other professionals, should use every available resource to protect their patients’ personal health information. Google makes signing up for G Suite and obtaining a business associate agreement is simple. You can even fill out the agreement online. Additionally, working with a third party encryption service is also a fast and straightforward process.
On the one hand, there would appear to be little to fear in regards to sensitive patient data being compromised when the proper steps are taken to ensure emails are as secure as possible.
However, most security assessment professionals would not necessarily agree that utilizing Google services for HIPAA is ideal. It is always going to be a shared platform that the user does not control. It does not provide the expected metadata and logging that is required among other things.
That said, it is better than nothing. When it comes to your data and your healthcare information, it’s always worth taking extra steps to remain private, secure, and compliant.
Start a Cyber Security Awareness Training Program Your Staff Can't Ignore
Corporate cybersecurity is a mindset as much as it is a strategy.
According to Verizon’s 2018 Data Breach Investigations Report, internal actors still account for an alarming number of data breaches. Last year, 28% of attacks involved insiders.
Although adequate security systems are vital, these findings point to the importance of educating employees on cybersecurity best practices. To efficiently protect their data, organizations need to develop a security culture throughout the company. The best way to do so is to introduce relevant, engaging, and regular security training for employees.
For those who tried to do so but failed and for those who are not sure how to start, we asked top cybersecurity experts for their best advice. Take a look at what they said and start implementing their tips today.
- Jef Towle, Intel Corporation
- James Olivier, Shades of Security
- Lisa Parcella, Security Innovation
- Lauren Hilinski, Shred Nations
- Robert Douglas, PlanetMagpie IT Consulting
- Wade Yeaman, Fluid IT services
- Neil Readshaw, Anonyme Labs
- Greg Scott, Author
- Mihai Corbuleac, ComputerSupport
- Sean Spicer, AgileIT
- Derek Anderson, Biztek Solutions, Inc.
- Joshua Crumbaugh, PeopleSec, LLC
- Eyal Benishti, IRONSCALES
- James Goepel, ClearArmor Corporation
- Tom Evans, Ashton Technology Solutions
- Morey Haber, BeyondTrust
- Dean Coclin, DigiCert
- Peter J. Canavan, Safety Expert
- Robert Huber, Eastwind Networks
- Benjamin Dynkin, Atlas Cybersecurity
- Eric Sheridan, WhiteHat Security
- Mike Meikle, SecureHIM
- Bryan Dykstra, Atlantic Data Forensics
- Joshua Feinberg, Data Center Sales & Marketing Institute
- Larry Kahm, Heliotropic Systems, Inc.
- Tom DeSot, Digital Defence, Inc.
- Kevin Gray, EnvisionIT Solutions
- Justin Lavelle, BeenVerified
- John C. Ahlberg, Waident Technology Solutions
- Robert Siciliano, HotSpot Shield
- Amanda Bigley, Hummingbird Networks
- Isaac Kohen, Teramind
Cyber Security Awareness Training, Advice From Industry Experts
Jeff Towle
Sr. Cloud Solution Security Architect, Intel Corporation
Jeff Towle is an industry veteran in the Information Security, Governance, Risk and Compliance industries. At Intel, Mr. Towle specializes in optimizing Intel-based security designs to contend with modern-day threat vectors for Cloud Service Providers.
Mindfulness with safeguarding your Identity
An employees’ Corporate Identity is THE critical component to safeguarding all valuable top secret or highly classified documents, customer records, Intellectual Property, or design secrets. Hackers will go to great lengths to trick employees/end-users to steal their access credentials. This goes way beyond just making sure you update your password with strong alpha-numeric characters regularly per corporate password reset policy. A good rule of thumb is to treat all the files, folders, documents, social media, corporate websites you have been granted access to as would your own bank account. Sharing your corporate ID is never a good idea, even under temporary circumstances. It’s also a good idea from time to time to check with IT to see what exactly you have access to. Especially if you have been at the company for a long time. Do you want access to systems you used 5 years ago? This only creates risk, and it’s OK to ask for a list of things you still may be able to access and request that access be removed.
Attribution of all Business Communications
What is attribution? Simply put, “Do I REALLY know who sent this message to me? It’s important to train yourself to get into the habit of verifying the author or creator of a digital communication to you (via email, text, social media, automated message, website alert/notification, etc.). This is an awareness technique that’s easy to adopt once you start to just ask the question. With email, you can double-click on a name or hover your mouse on the From: field, and it will resolve to the actual email address. SPAM, Phishing attacks and Malicious Ransomware messages often resolve to a string of characters that are easily seen as suspicious. If the email doesn’t end in “companyname.com” you likely are being subjected to some sort of deceptive communication. The same is true of malicious URL’s. Instead of clicking on the link to find out what it resolves to, hover your mouse or right click to see what the whole string looks like. These changes in behavior can really make a difference beyond just updating antivirus, OS patching, and firewall security controls.
Cyber Attitude
You can be your own best anti-hacking expert with these simple tips:
- Don’t leave your laptop or desktop alone with applications open. Make sure to have a password enabled screen saver activated any time you leave your workstation
- Don’t tailgate. Remember your Identity is critical, and this is true of your employee access badge. It’s only meant to let you into the building, parking lot or server room. Make sure you don’t just let people follow you as a matter of courtesy or convenience.
- Hackers love social engineering. They will call and posture as a co-worker or service agent. They can be very crafty about piecing together information to hack into systems or break or sneak into a building. So beware of those asking questions about scheduling and where people will be at what time. Safeguard information around people’s system access just like you do your own.
- Don’t even read it, delete it. And the worst thing you can do is forward it to others.
- Make sure you have a backup of your laptop or workstation’s data. Ask the IT staff if your data is being backed up regularly. This may be the only way to recover from severe ransomware attacks.
- Believe it or not, you can become a frontline defense security expert to assess whether any application or system you access is vulnerable to some attack. Pay attention to irregular content that’s posted, the amount of time it takes to process information on systems or any strange errors reported in a business process flow. Hackers rely on a lack of incident response planning to have their malware spread and escalate access to damage or steal data so the sooner your report something that is not normal, the better.
James Olivier
Principal Cybersecurity Consultant, Shades of Gray Security
James Chad Olivier, author of Trust Me I’m Lying: Banks Pay Me to Rob Them is the owner and Principal Cybersecurity Consultant of Shades of Gray Security.
Make Your Security Training Program More Personal
Training is much more effective following a social engineering test. If you can show them how you tricked them into letting you into the facility, the success statistics of a spear phishing attack, and/or the success of phone call social engineering, it leaves a big impact. Especially on the ones that know they were tricked. I never reveal who was to blame as I explain the test is not a witch hunt, but an awareness exercise.
I use colorful stories from my past exploits to make the lessons more enjoyable. They have just seen one example of a test, so I tell them some other ways an attacker might exploit them. My style is to lighten the mood and tell them from my perspective which makes it more cinematic in their mind. Like a good suspense thriller. Their responses range from amusement to frightened out how easy it is to con people. When I visit them for the next training (often a year later), my clients remember the old tales and tell me how they have seen similar things during that time, and are excited to learn some new stories. This keeps them much more attentive than just a boring statement of policy and procedures.
I don’t make it just about the company. I tell people about how they are tricked personally. How to avoid scams, credit card protection (how to avoid skimmers), and encourage them to share the material with their friends in family. I explain that if we can make ourselves safe, it is better for our employer, our family, and society in general.
If nothing else, no one wants a boring recitation of policy, procedures, and best practices. Liven it up, don’t speak in a monotone voice, and don’t just read bullet points. That applies to any presentation though.
Lisa Parcella
VP of Product Management & Marketing, Security Innovation
Lisa Parcella designs and delivers comprehensive security-focused products and educational solutions for Security Innovation’s diverse client base.
Training Should Engage Staff
Training needs to be engaging to build internal expertise and competency. Here are four ways to keep cybersecurity training exciting for employees:
- Keep it Interactive: Leverage multiple types of interactions to keep learners engaged. Hands-on simulations/real-world training and tabletop exercises are influential in building offensive and defensive cybersecurity skills and help assess an organization’s situational preparedness. This supplemented with computer-based training, and reinforcement assets are effective in reinforcing lessons learned.
- Groom security champions: It’s much easier to get staff to jump on the security bandwagon if one of their own is driving the adoption versus having it come down as a “must-do” from high-level management.
- Motivate with incentives: From simple recognition to formal awards, incentive programs like belts, certificates, spot bonuses, gift cards, etc. help to facilitate progression and motivate employees to want to learn more. Role-Based: Security is a shared organizational responsibility, and there are many stakeholders including general staff, infrastructure, cloud, and development teams, and managers that need to write policy and ensure adherence to compliance and other mandates. Progressive topic-driven modules customized for specific roles are useful in building the required cybersecurity skills.
Lauren Hilinski
Digital Marketing Specialist, Shred Nations
Lauren’s company partners with document shredders across the nation and aim to make it easy to keep private business and personal information safe.
Use Real-Life Scenarios in Awareness Training
- Create consequences. If you are implementing new cybersecurity rules, create consequences for following or not following them. Whether its a reward or special monthly recognition, or if its some kind of punishment for not following your new security rules, give your employees a reason to get engaged.
- Use examples from real life cases. Yahoo, Blue Cross Blue Shield, Equifax and other large organizations have experienced devastating data breaches. Bring these cases to life with numbers and data proving the seriousness of the topic and showing that it can happen to the most sophisticated systems.
- People don’t like change, so if you are implementing new rules make sure to explain *why*, in simple terms that your employees will understand. You know your team better than anyone, explain the information in a way that makes them understand why behavior needs to change, so that even if they don’t like the changes, they understand that they are important.
- Make the information relevant. Too often these types of presentations aren’t industry specific and seem out of touch with what your employees do every day. Bring the information down to their level so that it is at the very least relevant.
Robert Douglas
President, PlanetMagpie IT Consulting
Robert has worked in the IT industry for 30+ years, consulting on everything from network infrastructure to cybersecurity.
Build each training session around a theme
- Basic email security. Never click on an email link or attachment you are not expecting. Email is the #1 delivery method for malware & ransomware. 60% of all successful hacks occur because of one person’s mistaken click.
- Never use personal email for work. Consumer email does not have business-grade security, backup & compliance features, and all of your emails could become discoverable in a lawsuit.
- Use complex passwords! Store your passwords in password management software and not on sticky notes attached to your monitor! (Begging you here.)
Wade Yeaman
Founder and CEO, Fluid IT Services
Founder and CEO of Fluid IT Services has more than twenty years of experience including leadership and operational responsibility for functions related to both business and information technology.
Use Current Events To Resonate
- Make the training engaging by using real-life scenarios. For example, drop a USB drive in the audience before the training and then during the class ask if anyone found it. Once they respond, ask them what they would do with it. The typical answer is ‘plug it into my computer to see what is on it.’ This is a great tool to show how social engineering works on the human gullibility to infect a machine and an organization.
- Make it relevant and use actual examples from recent current events. Technology is already complicated for non-technical employees to understand, the language is foreign, and most technology professionals are not proficient at translating critical technical terms into easy to understand and relevant business terms. Using actual present-day examples not only makes bridging the gap easier, but it also engages the audience in ways relevant to their experiences. One way is to show real examples of malicious emails and point to specific objects and pieces of information within each email that makes them illegitimate. I always include examples from the past 2-3 weeks to demonstrate what is happening now and also to show the importance of always being diligent.
- Make the presentation fun. This is probably one of the most challenging aspects of the training because nothing about cybersecurity is fun, but mixing in more light-hearted material, such as videos (from The Jimmy Kimmel Show in my example), change up the monotony of delivery and make use of humor to get the points across on serious topics.
- Make it collaborative. Many in the audience may be there because they were forced to, but there are always those wanting to learn and participate. Know the industry and business of your audience and ask them questions related to their specific industry, operational area, and even job type. Throughout ask what they have experienced and what they did about it. Include examples of real security incidents, breaches, ransomware and how those companies dealt with it and recovered. Understanding the amount of time, effort and money expended to recover from an incident is often hidden from employees is very eye-opening. Making cybersecurity ‘real’ will leave everyone more aware of the actual risks they will encounter both professionally and personally.
Neil Readshaw
Chief Security Officer, Anonyome Labs
Neil Readshaw is a seasoned security and compliance executive, who spent over 20 years at IBM overseeing technical direction for security architecture, leading the security workstream for the IBM Cloud Computing Reference Architecture, and programming new global data security products.
Context is the most critical aspect of security awareness training
Context means a few things to me:
– Why it matters to our company, not just generic statements about risk management.
– When the message is relevant to the employees.
– For whom the message matters most, i.e., vary the training content or its delivery by job role, as much as is practical.
Here are some examples of how we train employees:
I try and spend some time with each new employee to reinforce our security culture from the beginning. I hope that also helps the new hires see that my team is approachable and helpful. I also get a benefit from this, as I can learn what the security environment was like at their previous company. It is a great way to get new ideas and challenge the ones with which I am currently comfortable. And it is the right way for new hires from the get-go to understand the robust security and data protection culture we have at Anonyome, and thus what will be expected of them.32. Teaching employees how to detect a phishing email is very important, especially as the mailbox is so often the key to password recovery/password reset for other services.
What has been most impactful is showing people real phishing emails that have been received by our employees, as opposed to boilerplate examples. I try and share these examples through our intranet platforms as they happen, to try and capitalize when other employees may be receiving similar phishes.
For the developers in our company, security about our internal assets, but also how we build and operate systems for our products. The unfortunate data breach at Equifax became relevant for our product teams when they understood that the issues at Equifax were due to old, unpatched software. That was a reminder of why we have procedures around patching systems and keeping our use of open source software components up to date.
We keep formal, recurrent security training to a minimum to avoid cyber safety burnout from employees. However, we regularly check in with key account and data owners to ensure compliance and processes are being adhered to and of course answer any questions employees have.
Greg Scott
Author of Bullseye Breach: Anatomy of an Electronic Break-In
Greg Scott is a veteran of the tumultuous IT industry. Greg started Scott Consulting in 1994 and Infrasupport Corporation in 1999. In late summer, 2015, after Bullseye Breach was published, he accepted a job offer with a large, open source software company.
- Keep it simple. Start with care and share to be prepared and expand from there. You have to make the case it is worth their time to care about cyber-security. Once you have made that case, persuade them to share what they learn.
- Make this happen by relating every concept you teach to real-world scenarios, ideally with stories that have protagonists, antagonists, conflict, and high stakes.
- Entertain. Boredom leads to apathy, which is your worst enemy.
Mihai Corbuleac
Senior IT Consultant, ComputerSupport
I am Mihai Corbuleac, Senior IT Consultant at ComputerSupport.com – IT support company providing professional IT support, cloud and information security services.
Start sessions with relevant and scary cybersecurity statistics.
Facts like 46% of entry-level employees don’t know if their company has a cybersecurity policy or the fact that ransomware threats increased by 36% in 2018 or that 1 in 130 emails contains malware etc. It’s important for people to understand the risks of not being informed and educated regarding cybersecurity.
Secondly, always emphasize how destructive lack of knowledge and negligence could be. Finally, don’t forget to mention that most cyber-attacks could have been prevented if specific protocols would have been followed and that due diligence and staying alert represents the state of normality in today’s cybersecurity.
Sean Spicer
Director of Inbound Marketing, AgileIT
Sean Spicer is a 17-year digital marketing veteran who studied Marketing at U.C. Berkeley and earned a computer science certificate from Harvard.
The biggest issue with any security awareness training program is that the people most qualified to teach it are the same ones who are most liable to talk above their audience’s skill level.
While many of the issues in online security are fascinating, it is easy to lose the attention of your team if you get too detailed.
- Keep it fun. Roleplaying phishing scenarios, talking through real work attacks, watching the Pwn videos from Rapid 7 that detail some of the ways they have successfully breached client’s security are all fun ways to engage the audience.
- Keep it actionable. Knowing the dangers of ransomware and identity theft is useless if your team members do not know what to do if they are suspicious of something. Have a point contact or shared email box where they can forward suspicious links.
- Do not victimize, or make examples out of your team. Phishing test exercises are a valuable tool to demonstrate vulnerabilities. However, your most vulnerable employees can feel victimized if they are publicly outed or shamed, which leads to a loss of engagement with the training. Instead of highlighting who failed the assessment, highlight who did the right thing, by forwarding the emails to IT or reporting an unsuccessful penetration testing attempt.
- Be consistent. Complacency is the biggest threat to security, no matter if it is physical security or computer security. Keep your staff up to date on new developments and tools, and make sure to run assessments and micro-training at regular intervals to keep your team vested in the process, and aware of new and emerging threats.
Cyber Security training should be personable and relatable
- Speak to the employees and how they can secure themselves in their personal lives, not just company policies. This gives them more buy-in and reason to pay attention as you are now delivering them value on what they can do to protect themselves and then translate that into how the same principles apply to the organization. I always give my audience a handful of tips they can use personally first, then move on to company policies and then connect the two. It comes back to the old what’s in it for me? If companies just speak about how employees should protect their business, there is less interest, but if you give them personable tools and tips that also relate to the business, you will find greater success.
- Find engaging content. Videos are best in this day in age. I use videos that demonstrate how easy it is for criminals to hack and gain access to personal information. The videos need to be entertaining not lecturing.
- Get out of the classroom/meeting room and get hands-on. We provide a service (and several companies do) that provide real-life employee awareness training that involves sending fake malicious phishing emails to our clients’ staff. The emails do no harm, but replicate what actual bad emails do. When employees fall for our emails, they are kindly told that they failed and need to watch a video on what key points they missed. We provide owners and management reports on their companies phish prone score which gets improved quickly (30 days) with testing and sending these emails and watching the videos. This becomes more random and on-demand training that can be as little as 1 minute to 15 minutes but is consistently ongoing and raising awareness amongst the team.
Joshua Crumbaugh
Chief Hacker at PeopleSec, LLC
Joshua Crumbaugh is one of the world’s leading security awareness experts and internationally-renowned cybersecurity speaker. He is the developer of the Human Security Assurance Maturity Model (HumanSAMM) and Chief Hacker at PeopleSec.
- Shorten the length of training sessions to under 1 minute to accommodate short attention spans.
- Simplify messaging to its bare essentials and do not cover more than one topic in a single security awareness program.
- Phish users on a weekly basis.
- Capitalize on just-in-time training by educating at the moment a mistake is realized.
- Anchor lessons in emotion.
Eyal Benishti
Founder & CEO, IRONSCALES
Eyal Benishti is a veteran malware researcher and founder and CEO of IRONSCALES, the world’s first automatic phishing prevention, detection and response platform.
Most cybersecurity security awareness training conducted for employees is related to email phishing, specifically providing tips and tricks for how business workers can better identify a malicious email. In theory, this is a sound investment. With nine out of ten attacks beginning with phishing, there is a human vulnerability that needs to be addressed.
The challenge is that today’s attacks are so sophisticated and complex that even hyper-phishing aware employees cannot identify them. As an example, 1 in 3 workers in the utility industry in Michigan recently opened a fake phishing email even though those people are mandated to go through security training. In fact, Verizon estimates that only 17 percent of phishing attacks get reported.
So what should companies do?
For starters, if they are going to invest in phishing training, then they should adopt tools that are gamified and tailored to each user’s specific level of awareness. This method is proven to keep people’s attention spans longer and help trigger information retention. Secondly, and most importantly, organizations must realize that humans alone – no matter how much training – can never be relied upon as an actual security safeguard. Instead, companies should look for ways to have humans and machines work together in layers so that when one misses an attack, the other has its back. In this scenario, each time there is an attack, both the human firewall and the machine get a little smarter, further reducing the risk of future phishing emails being successful.
James Goepel
James Goepel, Vice President, General Counsel, and Chief Technology Officer at ClearArmor Corporation
Improving cybersecurity awareness requires cultural changes
Employees need to better appreciate the potential business impacts of their actions, and they need to be held accountable. Until that happens, training is just something employees have to suffer through, rather than being something they understand they need to do. Accountability does not mean the company focuses on punishing those who do not comply. It can also reward those who do.
This can be achieved, for example, through gamification, with employees who do comply receiving positive rewards, such as Starbucks or Panera gift cards if they achieve and maintain certain scores. These kinds of positive reinforcements help move security from being an afterthought to the forefront of employees’ minds, which in turn helps security become part of the culture.
Tom Evans
Over 35 years in IT. Cyber security awareness training for employees is a part-time occupation now that I am retired. End-user support and dealing with security issues occupied most of my working career.
- Actually do training. Even boring training is better than no training. If you do not have the resources in-house, seek outside sources. There are many.
- People enjoy videos these days. There are lots of them out there that help emphasize the severity of the issues. Believe or not NOVA (PBS) has some excellent ones on YouTube. Cisco and others have videos that can be used in training.
- I give out candy when someone answers a question posed to the group. it is not a lot but it gets people involved.
- Once a year is not enough. You cannot train one time and expect people to remember everything. The threat landscape continues to change and training needs to evolve to keep up.
Morey Haber
CTO, BeyondTrust
With more than 20 years of IT industry experience and author of Privileged Attack Vectors, Mr. Haber joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition. He currently oversees BeyondTrust technology for both vulnerability and privileged access management solutions.
Test The Effectiveness Of Your Staff Training
- Make it interactive. Whether the training is online or in a classroom, it must be interactive and engaging. Watching videos, hours of powerpoint, or even mindless cartoons does not work. Any training, regardless of media, must require the end user to engage the instructor, scenarios on the screen, and provide feedback. Making it fun is important but making it positively interactive is critical.
- Make it real-world. Too often training is based on what-if use cases. If you click on this link, if you open this email, if you share your password, etc. this will happen. While these are informative, good cybersecurity training includes real-world examples from other companies (or from within your own) of people doing bad things and the real-world ramifications. If it included the public details from Uber, Equifax, Ashley Madison, Delta, etc. – then employees can relate better to their own experiences.
- Include role-playing and testing. Employees will learn best if they are placed in actual situations that reinforce what they just learned. While standard role-playing is good, testing and cybersecurity certification are required. There is no reason that security teams should stop there. They should perform a light-hearted pen test after training. This could sample phishing emails; a few loosely dropped USB thumb drives or even fake phone calls. People always remember training best when tested with real-world role-playing and testing.
- Do not do it in isolation. Any staff security awareness and training should not be from a person’s desk. It should have dedicated time and location even if it requires them to use their own laptop. There are too many distractions.
Dean Coclin
Senior Director of Business Development, DigiCert
Dean Coclin has more than 30 years of business development and product management experience in cybersecurity, software, and telecommunications.
More useful than training videos are actual tests or exercises.
For example, a phishing exercise where employees are sent random phishing emails to see if they click on links or attachments provides valuable feedback to both the IT department and the employees. A contest amongst employees to see who can spot the most phishing emails (by forwarding them to an alias) puts some friendly competition into the mix while providing a valuable exercise. Rewards can be simple gift cards or a more complex points program which can be redeemed for prizes. Similar activities can target mobile devices or laptops by asking employees to download unauthorized software.
Peter J. Canavan
- Social engineering attacks are the most insidious. You must educate and train your employees on what phishing attack emails may look like including official-looking logos, a sense of urgency, the need to wire funds or check account or package tracking information immediately. By hovering over the links in a message and noting the URL that appears, many of these phishing attacks can be thwarted. When in doubt, look up the company’s phone number or customer support email on your own and do not rely on the contact information in the email to ascertain validity. However, more and more various websites are hacked, and code installed on them that the site owner is unaware of. Just visiting a compromised site can allow malware to get into your systems.
- A great exercise is to have your employees try to spot fake vs. valid emails and to make a game out of it. Divide employees into teams, and then have them mark which emails are legitimate and which are not. The winning team gets a prize (lunch, leave work early, PTO time, etc.)
- Passwords are one of the easiest places to gain entry into a system. Stress the need for strong password security. Use passwords that are LONGER and not necessarily complex. Any password that is 12 characters or longer is almost uncrackable. It would take too much time for a computer/hacker to crack it. Teach them to use easy to use phrases as passwords such as turning vacation time in Aruba into Vaca710n71m31nAruba! which makes an easy-to-remember phrase into a super strong 20 character password.
- Drill into your employees the need to be vigilant and not complacent. Just because they (or your company) have not been hacked before, does not mean it cannot happen. A recent survey by the National Small Business Association found that 50% of businesses they surveyed had reported being victims of cyber attacks, and 3 out of 4 were small businesses with less than 250 employees. The average cost of a cyber attack is around $21,000, and within six months, 60% of those attacked go out of business. Let your employees know that if they want job security, they need to help contribute to your company’s security!
- The apparent need for a robust and centrally managed antivirus solution on all your servers and workstations is a must. Besides, your router’s firewall must be hardened by an expert who knows exactly what the best practices are. Having a solution that combines the two is an excellent option for small businesses.
Robert Huber
Robert Huber, CSO, Eastwind Networks
Eastwind Networks is a cloud-based breach analytics solution that aims to protect government agencies and enterprise organizations from cyber threats that bypass traditional security measures.
- Ensure cybersecurity is a part of every employee’s performance goals.
- Gamify the security awareness training program, so there are points amassed, a leaderboard or prizes.
- Ensure the situations reflect real-life concerns of the enterprise. Rather than using generic scenarios, show how a loss of control, loss of personal information, loss of client sensitive information, intellectual property or similar related to the business affects the bottom line, company profits, reputation, stock price, etc.
Benjamin Dynkin
Benjamin is a cybersecurity attorney specializing in helping businesses understand, manage, and mitigate their cyber risk. He has published extensively and has been featured in a TEDx on cybersecurity and cyberwarfare.
Information security awareness requires hardening the human element
While there are countless strategies for making a data security program useful, to transform a compliance checkbox into a strong security posture.
- Security Awareness training should be a constant presence in the lives of employees. To be effective, a program cannot merely be a quarterly, semiannual, or annual gathering of employees to be lectured on not clicking a link. Instead, it is essential to create an iterative and dynamic process that tests employee through various types of cybersecurity attack vectors, pair that with general education, and finally, to develop specific interventions for ‘habitual clickers’ and other weak links in the organization.
- In the same spirit as the previous tip, small nuggets of knowledge dolled out regularly are far more effective than drawn out lengthy presentations that are spaced over time. 2-3 minute refreshers or targeted lessons with a specific purpose (risk of phishing, operational security, specific compliance issues, etc.) are far more effective than lumping everything together into a single hour-long (or often longer) session.
- Gamification. The average person is more interested in clicking a link than protecting their company from abstract threats. Thus it is vital for a cybersecurity awareness program to change that dynamic. One of the most useful tools for doing that is gamifying security awareness programs. Gamification refers to the process of turning a mundane task into a game. How to gamify security awareness training is a question that involves creativity and an understanding of the employees of the organization. Depending on the scale of the organization and the resources available, gamification can be something as simple as publicly calling out good acts of security awareness such as reporting a phishing link or completing a training course. For a more intricate and involved solution, an organization can create a public point system that rewards proper conduct and punishes poor practice. The company can give rewards and other benefits to top scorers while hoping that poor performers are encouraged to step up their training.
Eric Sheridan
Chief Scientist, WhiteHat Security
As the Chief Scientist of the Static Code Analysis division at WhiteHat Security, Eric oversees all research and development for Sentinel Source and related products, defining and driving the underlying technology.
The pace of change within and outside of an organization is staggering. Many businesses are in the process of digital transformation where applications and the APIs that connect them are becoming the digital fabric connecting the world. No longer is it taking months or years to build out IT infrastructure and applications. In many businesses today, it might be just a matter of days or hours. We have customers who are pushing application updates multiple times a day.
Cybercriminals are staying on top of this change too, evolving their capabilities at a similar pace. Organizations and individuals must be vigilant when it comes to security education and training, and security vendors need to make it as easy as possible for businesses and consumers to get the training and education they need to stay current on potential cyber threats.
To stay ahead of security risks, here are the top three practices to put in place:
- Enroll in Training Programs: People’s understanding of Security generally falls in two buckets: either the person is uninformed, or the person is informed but their knowledge quickly goes stale. A big part of thwarting attacks is to keep the team trained. There are training programs, some even free such as the WhiteHat Certified Developer Program, that can add to a company’s training and education arsenal and help both security teams and IT/development teams learn valuable secure coding skills and how to secure applications through the entire software development lifecycle.
- Phishing Training: People rely on emails and websites to function on a day-to-day basis, and phishing continues to be an effective means of victimizing users. According to the Verizon Data Breach Investigations Report, 30 percent of phishing messages were opened, and around 12 percent then actually clicked the malicious link or attachment. The best phishing attacks target something that you rely on, whether it be online banking, email or credit cards. Continued education and possibly warnings before executing the links are the best way to combat phishing attacks. Two-factor authentication is a great barrier for anyone attempting to hijack your account. Not only will an attacker need to compromise your username and password, but they will also need to compromise a device as well.
- Security in Context: Covering general security topics will only go so far. Optimal training programs provide curriculums that are tailored to the roles and responsibilities of the individual partaking in the curriculum. By way of example, Software Engineers need to have an understanding of the security implications of clicking an untrusted link, and they must also have an understanding of the security implications of building SQL queries at runtime using user-data.
Mike Meikle
Partner, SecureHIM
Mike Meikle is a Partner at secureHIM, a security consulting and education company that provides cybersecurity training for clients on topics such as data privacy and how to minimize the risk of data breaches.
Companies should include information on general security threats, how hackers compromise systems (social engineering, malware, etc.), top hacker targets (Facebook, Twitter, LinkedIn), defense techniques, an overview of the hacking ecosystem, and the cost of lost data to the organization.
Initially, training should be done in-person with a presenter. A slide presentation with topics that highlight how hackers affect the specific organization’s industry should be included. Live websites and video should be used to keep the audience engaged.
Follow-up security awareness presentation can be via a recorded webinar that is updated to reflect the changing threat landscape. After the recorded session there should be a quiz to measure how effective the presentation was with the target employees.
Also, the Information Security group can send out regular email blasts on threats and create a monthly newsletter or blog to keep security in the forefront of employee’s minds.
The best way for organizations to protect their data and keep their employees from compromising security is to train them on information security best practices. This must be done on a continual basis, in layman’s terms and at a minimum of six-month intervals. Sixty to seventy percent of data breaches are due to social engineering and hardware theft; an issue best addressed by training.
If an organization keeps the issue of information security in front of employees, makes it engaging and keeps the organization informed on how threats are impacting the company, then the employees with have a reference point on how their behavior is or could impact the company.
People love hacker stories. As part of our business we handle data breaches for companies, so we have plenty of stories on how hackers broke into organizations and what they did once inside the network. Many of these stories are relatable and get people interested in the topic. Often we will have 2-3 hacker stories in a briefing to introduce better security practices or ideas.
People like to talk about themselves. I make sure that I provide plenty of time for people to ask questions about their personal cybersecurity concerns related to their email, social media and smartphone use. The concerns that are typically expressed by one person in the group are usually shared by others and always leads to lively discussion and better training.
Joshua Feinberg
President, Data Center Sales & Marketing Institute
Joshua Feinberg is a digital strategist and revenue growth consultant, specializing in the data center, mission-critical, and cloud services industries. He is also a president of the Data Center Sales & Marketing Institute.
- Avoid cyber security courses where IT teams are scolding employees for being careless about their use of IT assets. While the 1990’s SNL skit with Jimmy Fallon (Nick Burns, Your company’s computer guy) is sure to be an excellent icebreaker for what your IT team shouldn’t be acting like, it’s far better to infuse a tip or two into other company meetings that employees want to attend.
- Use stories/videos to drive home the point. A few minutes on YouTube, looking for current events about breaches should yield plenty of 2-5 minute videos worth watching. For example, it’s widely known that a very high-ranking 2016 U.S. presidential campaign manager was compromised over essentially not having two-factor authentication turned on. (which brings me to my next point)
- Accept that shadow IT exists and provide department/application-specific advice. For example, show what should be done in settings to protect against the basics: turning on two-factor authentication, enforcing strong passwords, and forcing SSL usage in webapps. A tech-savvy power user in finance or marketing can often be a great person for your IT team to partner with on these efforts.
- Point out the dangers of public WiFi and why VPN software is so critical. Anyone with young kids, or who remembers being a kid, can relate to the telephone game, where you whispered in your friend’s ear to reveal a secret. This is an excellent analogy for this topic.
Larry Kahm
President, Heliotropic Systems, Inc.
Larry Kahm is president and owner of Heliotropic Systems, an IT provider for small businesses and entrepreneurs, located in Fort Lee, NJ. He has clients throughout eastern Bergen County, New York City, and Long Island.
Some general “rules of thumb” about emails that ask you to pay for invoices or to send out financial or client data:
- The same rule as you would use for a phishing email: Be very skeptical.
- If you have an admin handling your mail, make sure they ASK directly, or by phone or text, before they take any action.
- If the email is from someone you know, call them to double-check.
- If the email is from someone you do not know – do NOT call them. It is likely that they will try to use social engineering to convince you to send it.
- Do NOT send attachments if you do not know who requested them
- If you are at all uncertain about the email’s legitimacy, delete it. If someone really and truly needs something – they will get back to you!
I realize that this last one flies in the face of all social contracts. But each of you has to weigh how much you value your businesses’ security program over some possibly ruffled feathers.
Tom DeSot
EVP and CIO, Digital Defense, Inc.
As chief information officer, Tom is charged with key industry and market regulator relationships, public speaking initiatives, key integration and service partnerships, and regulatory compliance matters. Additionally, Tom serves as the company’s internal auditor on security-related matters.
Build A Powerful In House Defense Against Cybercrime
- Arm employees with the required knowledge to thwart information security intrusions designed to help train, educate and reinforce a security-aware employee base.
- Use All Tools Available to Fight Hackers – Kick off a new way of training and create maximum excitement and support by leveraging a fun and enjoyable staff security awareness program.
- Improve Your Team’s Security IQ – Easily deploy fun and engaging animated videos to all employees regardless of keeping security awareness top of mind. Easy and convenient, these videos will be accessible from multiple platforms (PC, laptop, iPad/tablet or mobile device).
- Employees need to be educated on what a phishing email looks like and why they are BAD. We do this by sending out test phishing emails and track which employees click on the link in the test email, and then we can educate that employee on a personal level.
- Another great tip is to not use or connect your devices to public WIFI. (i.e., hotels, airports, Starbucks, etc.) use your phone’s hotspot, so you are not allowing other devices to view your network access.
- Sessions are often boring wastes of time, both for employees and the IT teams responsible for them. How do you avoid this? – Whether we are educating our clients or presenting at a cyber security conference, we always do 2 things to make the event not a boring waste of time 1.) FOOD – we always have food and provide catering at our events and 2.) Giveaway gift cards throughout the presentation and at the end. Ask questions to get audience participation and give away $$. The bottom line on cybersecurity and reducing your risk is TRAINING/EDUCATION. You have to make it a priority to educate your employees.
Justin Lavelle
Chief Communications Officer, BeenVerified
BeenVerified is a leading source of online background checks and contact information. It allows individuals to find more information about people, phone numbers, email addresses, property records, and criminal records in a way that’s fast, easy, and affordable.
Start an Employee Security Awareness Program ASAP
The secret sauce for cybersecurity is focusing on two simple things – Talk about it and think about it. The reality is that dealing with security is a business issue (not an IT issue) and it involves hundreds of little things (usually not expensive or time-consuming) and not just the several big things you think you need to be doing (which can be costly and time-consuming).
Talk about it. We have found great success just getting people in the same room and telling stories. Call it a lunch and learn or do it in the afternoon and call it a snack and learn. The company buys some food, and everyone has to show up. Takes an hour or less and have someone come prepared with some best practices and stories of how people have made poor security decisions (we play this part for our clients). It is amazingly powerful seeing one employee explain how they got a phishing email and how they fell for it and say how they avoid it in the future and then hearing weeks later that someone else in the room saw the same thing but were not a victim because they listened to that story. It is super simple and really works. Just talk about it.
Think about it. Most people do not want to bother thinking about security. It is easier to turn a blind eye and think nothing bad will ever happen to you. All the business person needs to do is to make a conscious effort to think about security. Ask their IT for information about their business applications and such – manage who has access with privileged access management, what rights do users have, what is the password policy (complex and expire after X months), should you be using MFA (Multifactor Authentication), reports for antivirus and software updates, etc. Also think about if there are any concerns with other business areas – physical access control, third parties like banks, etc. Think about it and you will be more secure.
Robert Siciliano
Identity Theft Expert with HotSpot Shield
Train your staff and test your employees
- After presenting information about security awareness, come up with a scheme to set up a situation where employees are given the opportunity to open a very alluring link in their email. This is called a “phishing simulation.” This link will actually take the worker to a safe page, but you must make the page have a message, such as “You Fell For It.” You should also make sure that these emails look like a phishing email, such as adding a misspelling. The people who fall for this trick should be tested again in a few days or weeks. This way, you will know if they got the message or not.
- Do not make it predictable as to when you are giving out these tests. Offer them at different times of day and make sure that the email type changes.
- Consider hiring a professional who will attempt to get your staff to hand over sensitive business information over the phone, in person, and via email. This test could be invaluable, as it will clue you into who is falling for this.
- Quiz your staff throughout the year, to allow you to see who is paying attention. You want to focus on educating your staff, not disciplining them. They should not feel bad about themselves, but they should be made aware of these mistakes.
- Make sure your staff knows any data breach could result in legal, financial or criminal repercussions.
- Schedule workstation checks to see if employees are doing things that might compromise your business’ data, such as leaving sensitive information on the screen and walking away. Explain how important security is to your business and encourage staff to report any suspicious activity.
Amanda Bigley
Marketing Associate, Hummingbird Networks
Amanda Bigley is a marketing associate for Hummingbird Networks. She enjoys researching and writing about all things cybersecurity.
- Make a game out of it. Provide your employees with security basics of identifying social engineering through a quick read or cheat sheet and then incentivize them to put their knowledge to the test. Consider something like a department-wide game of Jeopardy. This method eliminates the boring lecture and boosts employee morale.
- Train employees as they come. Create material for training employees as they join the company. This will eventually cancel out the need for a large group training and ensure employees are properly vetted from day one. A quarterly quiz could help ensure their cybersecurity knowledge stays fresh and relevant.
- Create entertaining literature. Using the good old ambient marketing method, consider printing bathroom literature that provides employees with some easily consumable content. Taking a humorous tone, inform employees of current cybersecurity risks and tips, or company security news with a weekly, bi-monthly or monthly print which is then displayed on the back of stall doors. Create a simple template that requires little time to update with new info.
Isaac Kohen
Founder and CEO, Teramind
Isaac Kohen is the founder and CEO of Teramind, an employee monitoring, insider threat prevention platform that detects, records, and prevents malicious user behavior.
Cybersecurity awareness sessions for employees can often be boring wastes of time.
Combat the snooze fest of employee education sessions by making them engaging. This can be done by making the courses relatable. Create cybersecurity scenarios that employees can easily understand.
Utilize games, trends, gifs, memes, etc. whatever you need to convey your cybersecurity message. Understand your environment and hone in on whatever applies to your employees. You can easily incorporate funny and relatable scenarios to keep your employees attention all while helping them understand why cybersecurity is vital.
PCI DSS 3.2 Compliance Requirements Guide: Updated For 2020
Every day we are becoming more and more a cashless society.
Plastic is the preferred method of payment for most North American businesses, and we even see a significant shift into virtual payment systems and direct-to-consumer banking.
In the modern world of digital currency, e-commerce, and fast-moving transactions, how can your business make sure that it is safely handling customer data?
Do you want to end up as the next headline splashed across the news as another company that has mishandled thousands of sensitive customer records?
If your business is accepting credit card payments and either stores, processes, or transmits cardholder data, then you are required to adhere to Payment Card Industry Data Security Standard compliance standards, otherwise known as PCI DSS.
The latest iteration of the standards is PCI DSS 3.2, as published by the Payment Card Industry Security Standards Council, with version 3.1 was entirely replaced as of October 2016.
This guide is a strong starting point for companies looking to maintain a strong security infrastructure. It also sets a clear and specific standardization of what is expected of companies that handle cardholder data.
What is PCI DSS Compliance?
PCI stands for “payment card industry” and refers to the Payment Card Industry Security Standards Council (PCI SSC).
The Counsel is a compromise between five proprietary data security and operations programs from major credit card companies: Visa, MasterCard, American Express, Discover, and JCB.
These companies aligned their policies to form the PCI DSS standard. This standard means that your company can pass validation of compliance from a Quality Security Assessor (QSA) from a firm-specific Draft Internal Security Assessor.
PCI validation methods culminate in an audit of PCI security standards controls. If the controls are found to be valid, a Report of Compliance (ROC) is issued. When a QSA conducts the audit, an Attestation of Compliance (AOC) is also issued. These are the accepted processes set by the PCI Security Standards Council.
TL:DR – Identify the 6 Most Prevalent Risk Factors in Data Security
Who do PCI DSS 3.2 Requirements Apply To?
Any company or private entity that can process, transmit or store consumer information from any of the five major credit card companies are subject to DSS compliance.
Credit card companies maintain merchant compliance levels depending on the number of annual transactions that a company completes:
-
- Level 1 – Merchants with more than 6 million yearly sales added across all channels. However, global merchants that identify as Level 1 in any region maintain that distinction in all areas.
- Level 2 – Merchants that conduct between 1 and 6 million transactions on an annual basis across all channels.
- Level 3 – Online Merchants that conduct e-commerce between 20K and 1 million transactions on an annual basis across all channels.
- Level 4 – Online Merchants that conduct e-commerce of fewer than 20K transactions on an annual basis across all channels, and merchants processing no more than 1 million yearly transactions across all channels.
Transactions may not be included in the merchant total if they are processed through local merchant locations instead of through the corporate entity.
The credit card companies also state that they maintain the sole right to define a Level 1 Merchant.
What Is the Timeline for the PCI DSS 3.2 Update?
As stated directly from the PCI Council:
“PCI DSS 3.1 will retire on October 31st, 2016, and after this time all assessments will need to use version 3.2. Between now and 31 October 2016, either PCI DSS 3.1 or 3.2 may be used for PCI DSS assessments. The new requirements introduced in PCI DSS v3.2 are considered best practices until January 31st, 2018. Starting February 1st, 2018 they are effective as requirements and must be used.”
What To Expect from the PCI 3.2 requirements Update?
The most critical changes that companies can expect from the update to the 3.2 standards are as follows.
Multi-factor authentication – This is different from two-factor authentication, or 2FA. Multi-factor authentication includes all processes that have at least two authentication factors. Every employee who has administrative access control to the cardholder data environment (CDE) must process through multifactor authentication. Previous PCI DSS standards only required 2FA and just remote administrators that were considered “untrusted” were required to verify themselves this way. This is one of the most significant expansions of the authentication requirement standards in the history of published PCI DSS.
SAQ Changes – All Self Assessment Questionnaires (SAQs) added many requirements outside of SAQ B and SAQ P2PE. SAQ B stayed the same as its previous iteration. SAQ P2PE took away two of its obligations. These requirements had to do with emailing and masking PAN data that was not encrypted.
Network segmentation and scoping – Systems outside of the CDE may now be included within the scope of PCI compliance. Many systems that connect to the CDE may also need to be added due to lack of segmentation.
Service providers – There are multiple changes for merchants and service providers including changes in penetration testing and the establishment of responsibilities for data and annual PCI compliance. There are also changes to the personal reviews performed on a quarterly basis, timeliness of reporting and detection of problems and cryptographic architecture.
Deprecation of SSL and Early TLS – All uses of SSL and TLS 1.0 within your CHE must be removed by June 30, 2018. However, TLS 1.1 is allowed though it is highly recommended to upgrade to TLS 1.2.
How Do The Updated Requirements Affect Your Organization?
The change from 3.1 to 3.2 is considered a non-major release and should not impact organizations significantly.
The depreciation of SSL and early TLS will be a challenge for many organizations but is a much-needed rule. SSL and TLS 1.0 have been exploitable for a significant amount of time and businesses are doing themselves a favor by upgrading. Many TLS and SSL exploits have caused many companies problems, including the exploits known as BEAST and POODLE. The National Institute of Standards and Technology (NIST) report that there are currently no patches that can provide a full repair for these TLS and SSL exploits.
How Can You Prepare for Your Next PCI DSS 3.2 Assessment?
Ordering Compliance Efforts Through the 6 Step Prioritized Approach
PCI DSS has identified six security measures that are most important in assessing and protecting against the most prevalent risk factors in business data security. These steps are meant to provide a company with a roadmap that can help to prioritize time and resources towards a fully compliant organization. The process is also intended to improve morale towards an environment of full compliance by creating a pragmatic approach that creates ultimate successes.
This prioritized approach also helps to promote consistency in compliance assessments along with operational and financial planning. Following the steps in order will also help a company to protect its cardholder data environment more quickly than haphazardly applying compliance standards. The approach was cultivated through an assessment of past breaches and feedback from forensic investigators and QSAs.
The six steps are as follows:
-
- The removal of authentication data that may be sensitive and the limitation of data retention – in short, companies should delete all data that they do not need. This is especially true of authentication data and other personal and financial information that may be sensitive. If this data is deleted from the system, its ability to be used to compromise the system is greatly reduced.
- The protection of networks and systems through constant vigilance in preparation for a breach – Companies should identify the most common point(s) of access for a breach or security compromise(s). The company should then identify and begin to prep the processes by which it will respond to these challenges.
- Securing all applications of payment card information – Weaknesses in application processes, servers, and controls for applications are straightforward ways for hackers to compromise company systems. This event should be considered on its own because of the importance of securing payment card applications.
- Monitoring who has physical access to company systems and controlling data access – Companies should implement a tiered system that limits the access of administrators to information that is outside of their jurisdiction. This system should be monitored, and all processes for the security of the system fully documented.
- The protection of cardholder data that is stored within the system – First, companies must determine whether they need to store highly sensitive information such as Primary Account Numbers. If a company has made this determination through a complete assessment of its internal processes, then it must create protection measures for that data.
- Ensuring that all protection controls are fully operational and finalizing any extra compliance efforts – By the time that milestone six is completed, all PCI DSS 3.2 requirements should be fulfilled. Additionally, any related processes, policies, and procedures that relate in any way to PCI DSS compliance should be fully operational as well.
Here are 10 best practices to prepare for your next PCI assessment.
Consistent Monitoring of Security Controls
Because of the speed with which malicious hackers improve their techniques, companies must continuously monitor their security controls. Part of being compliant with PCI DSS v3.2 is determining if a company can protect itself between assessments. If it cannot, then the assessment itself may not serve as an adequate deterrent for hackers looking for a weak target. It is also a requirement to review your PCI controls on a quarterly basis (if not monthly).
Timely Identification and Response to Failures of Security Controls
If a security control fails, then specific processes must be invoked within a timely manner to remain compliant. These processes include identification of why the control failed, identifying security issues that occurred during failure, full restoration of the control, the creation of procedures to ensure the failure doesn’t happen again, and the implementation of a monitoring strategy to verify operation of the control.
Determination of Changes Made before Upgrades Can be Completed
If any system is to be added into a PCI DSS environment, the impact of that system must be assessed. This system can be entirely new or modified from an existing system. Any part of a company’s infrastructure that connects to the addition must be evaluated for its compliance with PCI DSS 3.2. The company is responsible for identifying that new compliance requirements are met for all systems and networks modified by the change. The scope of the PCI DSS must be updated, and all new security controls required must be implemented and penetration tested.
Changes to the Organizational Structure Must be Reviewed
All employees must have privileged security access management controls that are relevant to his or her responsibilities and job description within the company. This structure should be reviewed from multiple scopes, including the individual and group levels.
Companies Should Initiate Consistent Reviews
A company should perform a regular review of its compliance measures to ensure that all requirements are implemented and up-to-date. These reviews must be conducted, at a minimum, quarterly to remain compliant. A company should also check to make sure that its processes have been properly updated as suggested by PCI 3.2. These internal reviews should include all company locations and all system components. A company has some leeway to determine how often these reviews should be completed, based upon the size and complexity of its infrastructure.
A main focus of these reviews should be to verify that appropriate records are being kept to maintain and prove PCI DSS v3.2 compliance efforts.
Regular Documentation of Both Software and Hardware Technologies
The vendor must fully support all equipment that is used within the company. All equipment must also meet the PCI DSS version 3.2 security requirements of the client. The company should immediately take action if any hardware is not vendor supported or the requirements are not met.
The same level of scrutiny should be applied to all software that the company is using. Software that is out of compliance accounted for 44% of data breaches in 2018.
Ensuring Accountability for Security Notifications
Five new requirements are introduced with 3.2 dealing specifically with the need for companies to notify customers of problems promptly.
The changes deal with detection of critical security systems and control mechanisms as well as cryptographic architecture. The amendments also require that a company perform quarterly reviews to vet all internal security personnel. The timely notification of severe issues to customers was found to be one of the aspects of security most lacking in companies, even those compliant with past iterations of the PCI DSS.
Ensuring the Proper Masking of Primary Account Numbers
To remain compliant with PCI DSS 3.2, a company must mask all instances of primary account numbers. At a maximum, only the last four digits or the first six digits may be shown. Any employee who is allowed to see more than this maximum must be accounted for. A company must create a list of these employees, including their roles within the company and the reasoning behind allowing them to see more than the masked primary account number.
Going Over the Designated Entities Supplemental Validation (DESV)
Because payment brands have the power to require service providers to fulfill additional DESV validations, companies should go over these requirements from the beginning of the compliance process. These requirements are covered in Appendix 3 and only will be penetration tested when instructed by an acquirer or a payment brand. PCI DSS 3.2 has the Designated Entities Supplemental Validation process as an appendix, including all new requirements that service providers will be expected to follow. These updated requirements include interviewing personnel to ensure documentation of cryptographic architecture. Additionally, companies are expected to implement a full change management process that keeps up with all system changes that may impact any system that is within the auspices of the PCI DSS.
Properly Scoping the Affected Environment
Evaluating the company environment is one of the most critical steps that you can take towards compliance and implementation of PCI DSS version 3.2.
To begin the process of scoping, a company should identify every component of the system that is either connected to or located within the CDE. The PCI SSC has given suggestions for compliance. Currently, there is a process to assess, report and remediate all data within the scope of the PCI DSS.
The Future Importance Of PCI Compliance
No one is quite sure exactly how malicious hackers will attack ecommerce in the coming years. There is a consensus, however, when you discuss data breaches in general. The problem is not going away.
Unprotected companies can almost expect to be targeted. Having a data security standard is essential to protecting your company and the information of the people who trust you. Take the above PCI compliance guide into account, consider PCI Compliant Web Hosting to bolster your security controls.
What is High Availability Architecture? Why is it Important?
Achieving business continuity is a primary concern for modern organizations. Downtime can cause significant financial impact and, in some cases, irrecoverable data loss.
The solution to avoiding service disruption and unplanned downtime is employing a high availability architecture.
Because every business is highly dependent on the Internet, every minute counts. That is why company computers and servers must stay operational at all times.
Whether you choose to house your own IT infrastructure or opt for a hosted solution in a data center, high availability must be the first thing to consider when setting up your IT environment.
High Availability Definition
A highly available architecture involves multiple components working together to ensure uninterrupted service during a specific period. This also includes the response time to users’ requests. Namely, available systems have to be not only online, but also responsive.
Implementing a cloud computing architecture that enables this is key to ensuring the continuous operation of critical applications and services. They stay online and responsive even when various component failures occur or when a system is under high stress.
Highly available systems include the capability to recover from unexpected events in the shortest time possible. By moving the processes to backup components, these systems minimize downtime or eliminate it. This usually requires constant maintenance, monitoring, and initial in-depth tests to confirm that there are no weak points.
High availability environments include complex server clusters with system software for continuous monitoring of the system’s performance. The top priority is to avoid unplanned equipment downtime. If a piece of hardware fails, it must not cause a complete halt of service during the production time.
Staying operational without interruptions is especially crucial for large organizations. In such settings, a few minutes lost can lead to a loss of reputation, customers, and thousands of dollars. Highly available computer systems allow glitches as long as the level of usability does not impact business operations.
A highly available infrastructure has the following traits:
- Hardware redundancy
- Software and application redundancy
- Data redundancy
- The single points of failure eliminated
How To Calculate High Availability Uptime Percentage?
Availability is measured by how much time a specific system stays fully operational during a particular period, usually a year.
It is expressed as a percentage. Note that uptime does not necessarily have to mean the same as availability. A system may be up and running, but not available to the users. The reasons for this may be network or load balancing issues.
The uptime is usually expressed by using the grading with five 9’s of availability.
If you decide to go for a hosted solution, this will be defined in the Service Level Agreement (SLA). A grade of “one nine” means that the guaranteed availability is 90%. Today, most organizations and businesses require having at least “three nines,” i.e., 99.9% of availability.
Businesses have different availability needs. Those that need to remain operational around the clock throughout the year will aim for “five nines,” 99.999% of uptime. It may seem like 0.1% does not make that much of a difference. However, when you convert this to hours and minutes, the numbers are significant.
Refer to the table of nines to see the maximum downtime per year every grade involves:
| Availability Level | Maximum Downtime per Year | Downtime per Day |
| One Nine: 90% | 36.5 days | 2.4 hours |
| Two Nines: 99% | 3.65 days | 14 minutes |
| Three Nines: 99.9% | 8.76 hours | 86 seconds |
| Four Nines: 99.99% | 52.6 minutes | 8.6 seconds |
| Five Nines: 99.999% | 5.25 minutes | 0.86 seconds |
| Six Nines: 99.9999% | 31.5 seconds | 8.6 milliseconds |
As the table shows, the difference between 99% and 99.9% is substantial.
Note that it is measured in days per year, not hours or minutes. The higher you go on the scale of availability, the cost of the service will increase as well.
How to calculate downtime? It is essential to measure downtime for every component that may affect the proper functioning of a part of the system, or the entire system. Scheduled system maintenance must be a part of the availability measurements. Such planned downtimes also cause a halt to your business, so you should pay attention to that as well when setting up your IT environment.
As you can tell, 100% availability level does not appear in the table.
Simply put, no system is entirely failsafe. Additionally, the switch to backup components will take some period, be that milliseconds, minutes, or hours.
How to Achieve High Availability
Businesses looking to implement high availability solutions need to understand multiple components and requirements necessary for a system to qualify as highly available. To ensure business continuity and operability, critical applications and services need to be running around the clock. Best practices for achieving high availability involve certain conditions that need to be met. Here are 4 Steps to Achieving 99.999% Reliability and Uptime.
1. Eliminate Single Points of Failure High Availability vs. Redundancy
The critical element of high availability systems is eliminating single points of failure by achieving redundancy on all levels. No matter if there is a natural disaster, a hardware or power failure, IT infrastructures must have backup components to replace the failed system.
There are different levels of component redundancy. The most common of them are:
- The N+1 model includes the amount of the equipment (referred to as ‘N’) needed to keep the system up. It is operational with one independent backup component for each of the components in case a failure occurs. An example would be using an additional power supply for an application server, but this can be any other IT component. This model is usually active/passive. Backup components are on standby, waiting to take over when a failure happens. N+1 redundancy can also be active/active. In that case, backup components are working even when primary components function correctly. Note that the N+1 model is not an entirely redundant system.
- The N+2 model is similar to N+1. The difference is that the system would be able to withstand the failure of two same components. This should be enough to keep most organizations up and running in the high nines.
- The 2N model contains double the amount of every individual component necessary to run the system. The advantage of this model is that you do not have to take into consideration whether there was a failure of a single component or the whole system. You can move the operations entirely to the backup components.
- The 2N+1 model provides the same level of availability and redundancy as 2N with the addition of another component for improved protection.
The ultimate redundancy is achieved through geographic redundancy.
That is the only mechanism against natural disasters and other events of a complete outage. In this case, servers are distributed over multiple locations in different areas.
The sites should be placed in separate cities, countries, or even continents. That way, they are entirely independent. If a catastrophic failure happens in one location, another would be able to pick up and keep the business running.
This type of redundancy tends to be extremely costly. The wisest decision is to go for a hosted solution from one of the providers with data centers located around the globe.
Next to power outages, network failures represent one of the most common causes of business downtime.
For that reason, the network must be designed in such a way that it stays up 24/7/365. To achieve 100% network service uptime, there have to be alternate network paths. Each of them should have redundant enterprise-grade switches and routers.
2. Data Backup and recovery
Data safety is one of the biggest concerns for every business. A high availability system must have sound data protection and disaster recovery plans.
An absolute must is to have proper backups. Another critical thing is the ability to recover in case of a data loss quickly, corruption, or complete storage failure. If your business requires low RTOs and RPOs and you cannot afford to lose data, the best option to consider is using data replication. There are many backup plans to choose from, depending on your business size, requirements, and budget.
Data backup and replication go hand in hand with IT high availability. Both should be carefully planned. Creating full backups on a redundant infrastructure is vital for ensuring data resilience and must not be overlooked.
3. Automatic failover with Failure Detection
In a highly available, redundant IT infrastructure, the system needs to instantly redirect requests to a backup system in case of a failure. This is called failover. Early failure detections are essential for improving failover times and ensuring maximum systems availability.
One of the software solutions we recommend for high availability is Carbonite Availability. It is suitable for any infrastructure, whether it is virtual or physical.
For fast and flexible cloud-based infrastructure failover and failback, you can turn to Cloud Replication for Veeam. The failover process applies to either a whole system or any of its parts that may fail. Whenever a component fails or a web server stops responding, failover must be seamless and occur in real-time.
The process looks like this:
- There is Machine 1 with its clone Machine 2, usually referred to as Hot Spare.
- Machine 2 continually monitors the status of Machine 1 for any issues.
- Machine 1 encounters an issue. It fails or shuts down due to any number of reasons.
- Machine 2 automatically comes online. Every request is now routed to Machine 2 instead of Machine 1. This happens without any impact to end users. They are not even aware there are any issues with Machine 1.
- When the issue with the failed component is fixed, Machine 1 and Machine 2 resume their initial roles
The duration of the failover process depends on how complicated the system is. In many cases, it will take a couple of minutes. However, it can also take several hours.
Planning for high availability must be based on all these considerations to deliver the best results. Each system component needs to be in line with the ultimate goal of achieving 99.999 percent availability and improve failover times.
4. Load Balancing
A load balancer can be a hardware device or a software solution. Its purpose is to distribute applications or network traffic across multiple servers and components. The goal is to improve overall operational performance and reliability.
It optimizes the use of computing and network resources by efficiently managing loads and continuously monitoring the health of the backend servers.
How does a load balancer decide which server to select?
Many different methods can be used to distribute load across a server pool. Choosing the one for your workloads will depend on multiple factors. Some of them include the type of application that is served, the status of the network, and the status of the backend servers. A load balancer decides which algorithm to use according to the current amount of incoming requests.
Some of the most common load balancing algorithms are:
- Round Robin. With Round Robin, the load balancer directs requests to the first server in line. It will move down the list to the last one and then start from the beginning. This method is easy to implement, and it is widely used. However, it does not take into consideration if servers have different hardware configurations and if they can overload faster.
- Least Connection. In this case, the load balancer will select the server with the least number of active connections. When a request comes in, the load balancer will not assign a connection to the next server on the list, as is the case with Round Robin. Instead, it will look for one with the least current connections. Least connection method is especially useful to avoid overloading your web servers in cases where sessions last for a long time.
- Source IP hash. This algorithm will determine which server to select according to the source IP address of the request. The load balancer creates a unique hash key using the source and destination IP address. Such a key enables it always to direct a user’s request to the same server.
Load balancers indeed play a prominent role in achieving a highly available infrastructure. However, merely having a load balancer does not mean that you have a high system availability.
If a configuration with a load balancer only routes the traffic to decrease the load on a single machine, that does not make a system highly available.
By implementing redundancy for the load balancer itself, you can eliminate it as a single point of failure.
In Closing: Implement High Availability Architecture
No matter what size and type of business you run, any kind of service downtime can be costly without a cloud disaster recovery solution.
Even worse, it can bring permanent damage to your reputation. By applying a series of best practices listed above, you can reduce the risk of losing your data. You also minimize the possibilities of having production environment issues.
Your chances of being offline are higher without a high availability system.
From that perspective, the cost of downtime dramatically surpasses the costs of a well-designed IT infrastructure. In recent years, hosted and cloud computing solutions have become more popular than in-house solutions support. The main reason for this is the fact it reduces IT costs and adds more flexibility.
No matter which solution you go for, the benefits of a high availability system are numerous:
- You save money and time as there is no need to rebuild lost data due to storage or other system failures. In some cases, it is impossible to recover your data after an outage. That can have a disastrous impact on your business.
- Less downtime means less impact on users and clients. If your availability is measured in five nines, that means almost no service disruption. This leads to better productivity of your employees and guarantees customer satisfaction.
- The performance of your applications and services will be improved.
- You will avoid fines and penalties if you do not meet the contract SLAs due to a server issue.
SECaaS: Why Security as a Service is a Trend To Watch
Your company is facing new cybersecurity threats daily. Learn how Security as a Service (SECaaS) efficiently protects your business.
The cybersecurity threat landscape is rapidly expanding. Technology professionals are fending off attacks from all directions.
The lack of security expertise in many organizations is a challenge that is not going away anytime soon.
CIOs and CSOs have quickly realized that creating custom solutions are often too slow and expensive.
They now realize that managed security service providers or MSSP companies are the best way to maintain protection. Software-as-a-service (SaaS) is becoming a more comfortable concept for many technology professionals.
What is Security as a Service?
SECaaS is a way to outsource complex security solutions needs to experts in the field while allowing internal IT and security teams to focus on core business competencies.
Not long ago, security was considered a specialization that needed to be in-house. Most technology professionals spent only a small portion of their time ensuring that backups always, the perimeter was secure, and firewalls were in place. There was a relatively black and white view of security with a more inward focus. Antivirus software offers only basic protection. It is not enough to secure against today’s threats.
Fast forward to today, where risks are mounting from all directions. Data assets spend a significant portion of their life in transit both within and outside the organization. New software platforms are being introduced on a weekly if not a daily timeline with many organizations. It is more difficult than ever to maintain a secure perimeter, and accessible data, while staying competitive and agile.
Threat Protection from All Sides
Today’s business users savvier about accessing secure information. Yet, many are less aware of the ways that they could be opening their networks to external attacks.
This causes a nightmare for system administrators and security professionals alike as they attempt to batten down the hatches of their information and keep it truly secure. Advanced threats from external actors who are launching malware and direct attacks at a rate of thousands per day are a challenge.
The drive towards accessibility of data and platforms at all times causes a constant tension between business users and technology teams. Security technologists seek to lock down internal networks at the same time users are clamoring for the ability to bring their own device to work.
There is a significant shift in today’s workforce towards the ability to work whenever and wherever the individual happens to be.
This makes it crucial that technology teams can provide a great user experience without placing too many hurdles in the way of productivity.
When business users find an obstacle, they are likely to come up with an unacceptable workaround that is less secure than the CSO would like. Account requirements too prohibitive?
No problem. Users will just share their usernames and passwords with internal and external parties. Providing easy access to confidential information. These are only the internal threats. External forces are constantly banging on your digital doors, looking for a point of weakness that they can exploit.
Cybercriminals are active throughout the world. No businesses are immune to this threat. Damage from cybercrime is set to exceed an annual amount of $6 trillion by 2021. Doubling the impact from just 2015.
The amount of wealth changing hands due to cybercrime is astronomical. This can be a heavy incentive both for businesses to become more secure and for criminals to continue their activity. Spending on cybersecurity is also rising at a rapid rate and expected to continue that trend for quite some time. However, businesses are struggling to find or train individuals in the wide spectrum of skills required to combat cyberterrorism.
Benefits of Security as a Service
SECaaS has a variety of benefits for today’s businesses including providing a full suite of managed cloud computing services.
Staffing shortages in information security fields are beginning to hit critical levels.
Mid-size and smaller businesses are unlikely to have the budget to hire these professionals. IT leaders anticipate that this issue will get worse before it improves. Technology budgets are feeling the strain. Businesses need to innovate to stay abreast of the competition.
The costs involved with maintaining, updating, patching and installing software are very high. There are additional requirement to scale platforms and secure data storage on demand. These are all areas cloud-based security provides a measure of relief for strained IT departments.
Managed cloud SECaaS businesses have the luxury of investing in the best in the business from a security perspective — from platforms to professionals. Subscribers gain access to a squad of highly trained security experts using the best tools that are available on the market today and tomorrow. These security as a service providers are often able to deploy new tech more rapidly and securely than a single organization.
Automating Manual Tasks
Having someone continually review your business logs to ensure software and data are still secure is probably not a good use of time. However, SECaaS platforms can monitor your entire employee base while also balancing endpoint management.
Results are delivered back in real time with automated alerts triggered when unusual activity is logged. Completing these tasks automatically allows trained technology professionals to focus more on efforts that move the business forward while much of the protection is done behind the scenes. Benchmarking, contextual analytics, and cognitive insights provide workers with quick access to items that may be questionable. This allows movement to happen without requiring drudge work behind the scenes.
Reducing Complexity Levels
Does your information technology team have at least a day each week to study updates and apply patches to your systems? If not, your business may be a prime candidate for security as a service.
It is becoming nearly impossible for any IT team to stay updated on all platforms. Or, see how their security needs interact with other platforms that you’re utilizing and then apply the appropriate patches. Many organizations require layers of protection due to the storage of personally identifiable information (PII). This can add to the level of complexity.
Protecting Against New Threats
Cybercriminals are always looking for new ways to attack a large number of systems at once. Global ransomware damage costs are in the billions of dollars, and an attack will occur approximately every 14 seconds by 2020.
Industry insiders such as Warren Buffet state that cyber attacks are the worst problem faced by humankind — even worse than nuclear weapons. The upfront cost of paying a ransom is only the tip of the iceberg when it comes to damages that are caused. Businesses are finding hundreds of thousands of dollars in direct and indirect costs associated with regaining access to their information and software.
Examples of Security as a Service Providers Offerings
Traditional managed providers are enhancing security offerings to include incident management, mobile, endpoint management, web, and network security threats and more.
SECaaS is a sub-category of SaaS and continues to be of interest to businesses of all sizes as complexity levels rise.
Today’s security as a service vendors go beyond the traditional central management console and include:
- Security analysis: Review current industry standards and audit whether your organization is in compliance.
- Performance balancing with cloud monitoring tools: Guard against a situation where a particular application or data pathway is unbalancing the infrastructure.
- Email monitoring: Security tools to detect and block malicious emails, including spam and malware.
- Data encryption: Your data in transit is much more secure with the addition of cryptographic ciphers.
- Web security: Web application firewall management that monitors and blocks real-time. Threat management solutions from the web.
- Business continuity: Effective management of short-term outages with minimal impact to customers and users.
- Disaster recovery: Multiple redundancies and regional backups offer a quick path to resuming operations in the event of a disaster.
- Data loss prevention: DLP best practices include tracking and review of data that is in transit or in storage, with additional tools to verify data security.
- Access and identity management: Everything from password to user management and verification tools.
- Intrusion Management: Fast notifications of unauthorized access, using machine learning and pattern recognition for detection.
- Compliance: Knowledge of your specific industry and how to manage compliance issues.
- Security Information Event Management: Log and event information is aggregated and shown in an actionable format.
While offerings from security as a service companies may differ, these are some of the critical needs for external security management platforms.
Once you have a firm grasp of what can be offered, here’s how you can evaluate vendor partners based on the unique needs of your business.
Evaluating SECaaS Providers
Security has come to the forefront as businesses continue to rely on partners to perform activities from infrastructure support to data networks. This shift in how organizations view information risk makes it challenging to evaluate a potential cloud computing solution as a fit.
The total cost of ownership (TCO) for working with a SECaaS partner should represent significant savings for your organization. This is especially important when you balance against performing these activities internally. Evaluate total costs by looking at the expense of hiring information security professionals, building adequate infrastructure and reporting dashboards for monitoring. Be sure you fully disclose items such as total web traffic, the number of domains and data sources and other key metrics when requesting estimates.
The level of support that is provided, guaranteed uptime and SLAs are also essential statistics. Your vendor should be able to provide you with detailed information on the speed of disaster recovery. You will need the same information on how quickly infiltrations are identified and any issue resolved. A disaster situation is the least likely possibility. You should also review the time to address simple problems. For example, a user who is locked out of their account or adding a new individual to your network. A full security program will allow your network managed service provider to pinpoint problems quickly.
It is critical that the solution you select works with other business systems that are already in use. Secure cloud solutions are often easier to transition between than on-premise options. It is better to work with a single vendor to provide as many cloud services as possible. This allows for bundled pricing. It can enhance how well software packages work together.
Your team can monitor system health and data protection with real-time dashboards and reporting. This is valuable whether or not a vendor is also overseeing the threat detection process. You will improve the internal comfort level of your team while providing ready access to individuals who are most familiar with the systems. This availability of data will keep everything working smoothly. Be sure that your vendor understands how to provide actionable insight. They should also make recommendations for improving your web security. Access is always a concern.
Evaluating core IT security strategy factors help keep your organization’s goals aligned. A proactive SECaaS vendor-partner adds value to the business by providing DDOS protection. Plus, offering risk management and more.
Security challenges for today’s CIOs & CSOs are Real
Hackers target businesses of all sizes for ransomware and phishing attacks. Staying vigilant is no longer enough.
Today’s sophisticated environment requires proactive action taken regularly with the addition of advanced activity monitoring. Keeping all of this expertise in-house can be overly expensive. The costs involved with creating quality audits and control processes can also be quite high.
Security in the cloud offers the best of both worlds.
Learn more about our security as a service. Request a free initial consultation with the experts at PhoenixNAP.
SOC 2 Compliance Checklist For 2020: Be Ready For an Audit
This article was updated in December 2019.
Data is the lifeblood of your business. Your clients must be confident that their information is safe. They trust you to maintain it. If you fail, you will lose your clients’ trust.
Reassuring clients is the goal of SOC 2 compliance and certification. The integrity, confidentiality, and privacy of your clients’ data are at stake. Potential clients will want proof that you have measures in place to protect them. The SOC 2 compliance audit provides it.
What is SOC 2?
SOC stands for “System and Organization Controls” and is the agreed upon procedures of controls set by the American Institute of Certified Public Accountants (AICPA).
These defined controls are a series of standards designed to help measure how well a given service organization conducts and regulates its information. They are designed to provide clients confidence that an organization can be trusted to keep their data secure.
The purpose of an audit is to achieve SOC attestation or SOC certification.
Who can perform a SOC 2 audit?
This attestation can only be given after the organization is audited by an independent certified public accountant or CPA Firm who determines if the appropriate safeguards and procedures are in place.
Three Report Types An Organization Can Choose
The first is type 1.
These reports show the service organization’s controls over its client’s financial reporting standards. The organization being audited defines the objectives that are important to its business, and the controls it follows to achieve those objectives. Since the scope of the audit objective is self-defined, this is a very flexible standard and can be customized to each service provider.
The second is the type 2 report.
It focuses on five trust principals: security, availability, integrity, confidentiality, and privacy. Each trust principal has a standard set of controls and testing criteria for all service providers. When undergoing a Service Organization Control Type 2, the service organization selects which principals are relevant to their business.
The third is the type 3 report.
It is a simplified version of the SOC 2 report and was designed to attest that the service provider has completed a SOC 2 assessment, while also limiting the information to what is relevant to public parties.
SOC 1 and 2 also come in two report types.
Type 1 reports review the policies and procedures that are in operation at a specific moment in time.
The SOC Type II examines the policies and procedures over a period of time no less than six months. Since the Type II report takes into account the historical processes, it is a more accurate and comprehensive audit.
What Is Included in a SOC 2 Certification Report?
What the SOC 2 reports contain depends on the type of service the organization provides.
A service organization can be evaluated on one or more of the following trust services criteria (TSC) categories:
-
- Security – Information and systems are protected against unauthorized access, unauthorized disclosure of information and damage to systems that could compromise security availability confidentiality, integrity, and privacy of data or systems and affect the entity’s ability to meet its objectives.
- Availability – Information and organizational systems are available for operation and use to meet the entity’s objective requirements.
- Processing Integrity – System processing is complete, valid, accurate, timely and authorized to meet the entity’s objectives.
- Confidentiality – Information designated as confidential is protected to meet the entity’s objectives.
- Privacy – Personal information is collected, used, retained, disclosed and disposed of to meet the entity’s objectives.
The categories above all share a set of trust services criteria known as the standard criteria.
The common principles are:
-
- Control environment
- Communication and information
- Risk assessment
- Monitoring activities
- Control activities – which are further broken out by:
-
-
- Logical and physical access
- System Operational Effectiveness
- Change Management
- Risk Mitigation
-
These criteria must be addressed in every SOC audit. Depending on which TSC categories are being assessed, there may be more TSC’s which needed to be evaluated in addition to the standard criteria.
With the changes made in 2017, organizations can also get a SOC 2+ report which allows the services organization to address additional criteria from other compliance standards such as HITECH, HIPAA compliance, ISO 27001, Cloud Security Alliance (CSA), NIST 800-53 or COBIT 5.
When you order your compliance audit, you can decide which TSC categories are the most important. Base your decisions on what clients are most likely to want. Doing so will ensure that clients get the information they need. They will be less likely to come back to you with questions if they are addressed in the SOC 2 report.
The key is to reassure clients that you will keep their data secure. Your organizational controls should be explained. That way, clients can be confident that their data is safe with you.
Prepare with a SOC Audit Checklist
There are standard sense steps you can take. Being prepared will make the auditor’s job as comfortable as possible.
Your goal is to anticipate issues and try to resolve them beforehand.
Here are six steps you can take to prepare.
-
- Define the operating goals of your audit. You should ask yourself what your clients are most likely to want to know. You know the parameters of the SOC 2 audit. If you handle financial information, you may need a SOC 1 audit, as well.
- Define the scope of your SOC 2 audits. They typically address infrastructure, software, data, risk management, procedures, and people. You will also need to decide which trust principles to include. Any TSC you add will increase the scope of your audit. Again, choose the TSCs that are most likely to concern your clients.
- Address regulatory and compliance requirements. Every industry has regulations. For example, healthcare providers must comply with HIPAA compliance while those handling credit cards require PCI compliance. Doing a review of your enterprise’s compliance will help streamline the audit.
- Review and write security procedures. The auditor you hire will use your written policies as a guideline. Many companies fall behind. If your systems are out of date, you should update them. If you lack written procedures for anything covered by the audit, you should create them now. Written policies will help your employees adhere to internal rules.
- Perform a readiness assessment. A readiness assessment is your final chance to prepare. You can do the evaluation yourself. Alternatively, you can hire an auditing firm to do it for you as they abide by strict auditing standards. Think of it as a dress rehearsal. You can use the results to fill in holes in your audit prep.
- Evaluate and hire a certified auditor. As I mentioned before, hire someone with experience in your industry. The auditor will:
-
- Work with you to choose agreed-upon testing dates
- Give you a list of required documentation in advance of the audit
- Visit your site for document reviews, employee interviews, and walk-throughs
- Document the test results and review any issues with you
- Provide you with a completed type II report to share with your clients
-
Following these six steps of our SOC 2 compliance checklist will ensure that you have a smooth audit process. It is your job to do as much as you can to prepare. Even if you think your company is in good shape, periodic reviews are a must.
You may want to put a system in place to review written procedures. Doing so on a regular basis will make sure your next audit is without problems.
Who Can Request SOC 2 Compliance Reports?
Any organization contracting with a service provider should be concerned about security. That is true regardless of industry. However, it is not necessary to get a new audit every time.
SOC 1 and SOC 2 reports are meant to be confidential, limited-use documents for the service provider and its customers; however, they were often distributed publicly. The SOC 3 report was created as a result of the growing demand for a public facing report.
Now, any party who is knowledgeable about the services provided may request one. Parties who need to know how the entity’s system interacts with others may also get the report. These include user entities, sub-service user organizations, and other parties.
Of course, those interested in the internal controls may also request SOC reports. Before you entrust your data to anyone, requiring a SOC compliance audit is a good idea.
Many companies order SOC 2 audits. Then, they provide a report to prospective clients and other qualified parties.
Of course, it is possible that a client might have questions not covered by the SOC 2 report. In that case, you will need to decide how to respond. The report includes many of the most common questions and concerns clients will have.
How Have SOC Audits Changed?
The standards used for auditing have evolved over the years. Up until 2011, AICPA applied the SAS 70 standard. The SAS 70 standard became extremely popular, and subsequently, it was being used too broadly, and it started to lose the desired focus. In response, AICPA replaced SAS 70 with the Statement on Standards for Attestation Engagements (SSAE) No. 16 in 2011 and recently updated to version SSAE 18, in May of 2017.
The new requirements for the SSAE 18 are as follows.
-
- IPE, or Information Produced by the Entity. Companies must get evidence of the accuracy of any information provided. Examples might include standard queries or report parameters.
- Vendor management and monitoring of sub-service organizations. Service providers or data centers must include controls for sub-service organizations. The goal is to ensure that anybody with access to the data is adhering to control standards.
- CUECs or Complementary User Entity Controls must be in place. They should be limited to controls that are needed to achieve the stated control objectives
- Internal audit and regulatory examinations. SSAE 18 requires service organizations to read specific reports. Specifically, they relate to internal and regulatory examinations.
The SSAE will continue to evolve as new security risks come to light. Keeping up with risks can feel a bit like a game of Whack-A-Mole.
One example is the new SOC Cybersecurity examination and updated trust services principles that went into effect on December 15th, 2018. AICPA’s goal is to stay abreast of information security needs and respond accordingly.
How Much Does SOC 2 Auditing Cost?
The expense can vary depending on what is included.
Some of the things that can affect the cost include:
-
- The scope of services included in the report
- The TSCs you choose to add
- The size of your organization
- The number of in-scope systems and processes
In other words, if you have multiple systems and methods to include, the price will increase. Any system that affects the security of clients’ sensitive data must be audited. That is the only way to reassure clients to trust you with their data.
For the best result, choose a firm with IT auditing experience. They should identify the employees who will complete your audit. It is essential to ensure that the firm does background checks on anyone who will have access to your customer data.
Finally, make sure that you ask for (and check) references before hiring an audit firm. Ideally, the firm you choose should have experience in your industry.
Understand The Importance of SOC Compliance Audits
Compliance with SOC 2 reassures clients. Upon auditing, you can provide them with the reports for their records. Having a current report on hand will ensure that prospective clients know they can trust you. Use our SOC 2 compliance checklist to prepare for an audit.
11 Enterprise Password Management Solutions For Corporate Cybersecurity
Let’s set a scene: It is a Monday morning, and you have just sat down at your office workstation after a long and relaxing weekend.
Coffee in-hand and you are ready to take on the week, only to realize you have been mysteriously locked out of all your accounts.
Did the system administrator push a password refresh? Did you accidentally knock out a LAN cable?
That pit in your stomach and sweat on your brow is how it feels when you suddenly realize your passwords have been stolen or compromised.
Who has access to your information, your accounts, your data? Even worse; how did they get through your security?
In the age of widespread identity theft, security breaches, and corporate espionage, password protection is essential to your digital security. The use of enterprise password management software is becoming a required element in any IT organization.
60% of small-to-medium size companies suffer a from cyber-attack at some point. According to the National Cyber Security Alliance, most close down only six months after an attack.
What is a Password Manager?
Password managers are designed to manage a user’s personal details securely. We all enter our information online, whether it is a bank account login, our social security number, or an e-mail password. Most users have dozens of accounts. Team members in business may have hundreds. All of them protected by usernames and their accompanying passwords.
Remembering all those details can be near-impossible – because we are all using different passwords for each account, right?
Password managers take the burden of remembering each login off the user. The majority of these services are low-cost or free, targeting, and meeting the needs of a single consumer.
They run discreetly in the background. Upon creating or using a new account for the first time, the user receives a prompt. The prompt will most often ask the user to save the password. Once collected, details are logged and held in a “vault.” The password vault manager encrypts all data.
Most managers also can recognize duplicate and weak passwords. If it registers as such, they prompt the user to either create a stronger one or to generate a stronger key randomly.
Why You Need Enterprise Password Management?
The average consumer-level password is enough for the needs of a single user. However, the enterprise world has much higher standards for security.
IT staff need a central point of collection, or a team password manager should a user lose access. Admins must also be able to manage details for shared accounts and to set and revoke permissions. Moreover, enterprise-level managers can store all kinds of data, not just login details. Some options store files of all format types.
The right software can lift much of the burden that server admins endure. Those running an IT system often deal with regular interruptions. Members of the team forget passwords and a simple password reset. Corporate password managers perform many of these functions automatically.
Dangers of Leaving Password Management to Employees
Allowing users to choose their private passwords and management software can be a minefield.
One device can have access to hundreds of account passwords. Users need strong passwords for everything from Twitter to Hootsuite to LinkedIn to MailChimp, and so on. Without a firm, centralized approach to password storage and security, users must find their own means.
Allowing users to decide how to implement password protocol can also be dangerous.
In many cases, team members will use insecure methods such as using .doc files, Excel spreadsheets, or even a post-it note on the front of their screen to store details. The risk of having passwords stolen from such unprotected mediums is much higher than using the right software.
Other employees may instead choose to use their own personal software. Management may see this as a way to ensure protection without added cost.
Single users do not have access management to group passwords, however. Nor do they always set standards for passwords that match company protocol. In the future, they could leave the company with corporate login details still in their accounts. Naturally, these are valid security concerns. Best practices are critical.
Enterprise Software Features to Look For In a Password Management Solution
Enterprise software enables the separation of personal, single-use accounts and shared details.
One of the best features of enterprise password managers is access to central dashboards. These dashboards allow security officers to check user activity and aggregate data. Many include visualization tools that make it easier to monitor behavior and security practices.
Studying user habits can help reinforce and improve your companies password practices.
Let’s look at the best password management software for an enterprise on the market.
We will highlight criteria to help you better judge different platforms. These include what operating systems and hardware the software is compatible with, price, security, features, and ease-of-use.
LastPass Enterprise
A premium edition for businesses based on the well known free software. LastPass lets the user generate and store any number of logins in a master vault. Multi-factor or two-factor authentication limits access to the vault.
Besides passwords, the vault offers protection of additional text notes. Secure data syncing allows users to retain the same credentials and security between different platforms. Users can access the vault on any device through the developer’s website.
LastPass also uses a growing database of phishing websites. By highlighting such, users are less likely to leak access to privileged accounts. Admins can also export encrypted data. Exporting makes it easy to switch to another software option down the line if you choose to.
The premium edition offers further cloud protection for all kinds of files. The contingency access feature lets a team member use your account when you are unable to. Without additional support for shared accounts, however, LastPass might not be best suited to large teams.
Dashlane
Dashlane offers many of the same features as LastPass with its enterprise edition. Team account management software is now available on an accessible browser window interface. Some may prefer the downloadable software package, which is equally easy to use.
Active Directory integration makes it easy to share Dashlane through your business network. One of the better resources offered is the bulk password changer. This feature allows you to quickly change large amounts of data in the event of a breach.
Conversely, Dashlane is high in price compared to some of the other solutions here. It may not be an option every business can afford. This edition includes unlimited sharing and syncing between teams and devices. It was rated as the most secure password manager.
Keeper Security
A mobile-centric alternative to other platforms, Keeper Security for Business, operates on a wide range of platforms with a particular focus on responsive design. Like LastPass and Dashlane, it offers a secure vault that stores all kinds of files, not just passwords.
One of the benefits of Keeper Security is the vast range of platforms it works across. The software has versions for Android, iOS, Blackberry, Kindle, iPad, Windows, Mac, and Linux. The centralized vault allows access management to the same credentials across all platforms.
Keeper Security comes with Active Directory integration and an admin control panel. Amongst other features, the panel allows for the fast provisioning of users. Access to specific passwords is easily distributed and revoked.
Centrify Enterprise
This option contains many of the same features you can come to expect from most password managers. These features include autofill, password capture, and password generation. Centrify is one of the most useful tools for capturing and monitoring data cross accounts, too.
Centrify tracks a lot of user data. Data tracking includes logs of the number of attempted logins, valid log-ins, and unusual activity.
Admins can generate reports on each user session. The summary collates all data of activity across a whole enterprise. Centrify has the further ability to separate reports based on different roles. This makes it a worthwhile tool for inspecting security practices company-wide.
CommonKey | Team Password Manager
CommonKey is an affordable solution for smaller businesses. It focuses on password protection alone, lacking the secure data storage features available elsewhere. Shared accounts and user provisioning tools are also included.
It is limited by the platforms you can use it on. CommonKey runs as a Chrome security extension. As a result, it’s only useful when used with websites and services. Passwords for local software cannot be saved.
The local encryption used by the application could be a risk, too. Certain breaches could allow hackers to see encryption methods and break them. Effectively, such a leak would expose all your details.
Larger businesses with more robust password needs may want to search for alternatives. For smaller teams that rely on websites and web applications, however, it can be a reliable tool.
RoboForm For Business
RoboForm for Business allows for centralized protection of an entire team. It includes a site license that stores and manages all passwords used in the company.
RoboForm includes secure provisioning of shared passwords. An admin console allows for easy management of different users.
You can manage users as individuals or as members of role-based groups. Role-grouping saves a lot of time when dealing with larger departments. Advanced reporting allows admins to ensure that users comply with company policy, too.
Pleasant Password Server
One of the few open-source password managers on the market. Pleasant password server lets tech-savvy users fully customize their approach to improve password security. Like many enterprise editions, it includes active directory integration.
Unlike other managers, the encryption and storage of sensitive data do not happen locally. Passwords stored on the client are kept safe in the event of a local data breach.
A refined folder system allows for simple grouping of large amounts of data. Admins can use this data to create reports that work with shared accounts and role-based management. It can generate reports including evaluating password age, strength, expiration, and more.
BeyondTrust
BeyondTrust Privileged Password Management includes powerful data tools on top of the standard features. Session-logging and auditing offer greater monitoring of security practices across the team.
Active Directory and LDAP integration enable the automatic provisioning of users. The management features work with local appliances using government-level security. It’s not just a tool for websites and web applications.
BeyondTrust has one of the most complex and detailed reporting modules on the market. Included, is the ability to track login attempts and session activity across the whole team. In the event of a breach attempt, you can use these reports to ensure regulatory compliance.
ManageEngine
One of the most popular enterprise-level password security programs. The pro password management of ManageEngine includes options to enable multiple admins. Using this option does increase the price of the package, however.
Data sync and Active Directory integration streamline management of multiple accounts. While it doesn’t work with mobile devices, it does include further forensic tools. Chief amongst them is the compliance report generation feature and video logs of sessions. This makes it one of the best tools for inspecting the security practices of your team members.
ZohoVault Online Password Manager For Teams
This software works solely with mobile devices. It sounds limiting, but ZohoVault does bring a surprising depth of features to its platform.
Included, are administrator access and management of user groups as well as smooth password transferal. It allows for the creation of reports on user activity and even allows more in-depth provisioning tools. As well as limiting access by specific users, admins can restrict access by IP address. If your concerned team members use unauthorized devices to access passwords, you can block them.
Zoho works as more than a standalone centralized manager for mobile devices. It also integrates with other password managers like LastPass. A company can use Zoho to extend existing enterprise password management to mobile devices effectively. On top of that, this is one of the cheapest solutions on the list.
1Password Business
Popular consumer software, 1Password from AgileBits may not be full enterprise at the moment, but they are one to keep on your radar. Recently, they expanded their popular subscription-based service for larger teams (replacing the existing, Teams Pro service).
1Password Business provides the features you need as a larger team. It gives you the tools to protect your employees, secure your most important data, and stay compliant. Your administrators will love it for the control it provides them, and your employees will love how easy it is to use,” writes AgileBits in an introductory blog for the product.
AgileBits introduced subscription pricing in 2016, moving away from licensed-based pricing. This may be a deterrent for some businesses, though depending on the size of your company, it could end up being more cost-effective in the long-run.
While 1Password is still geared toward smaller businesses or group users, the new Business plan offers enhanced customer support; more per person document storage; and a more significant number of guest accounts. Worth keeping an eye on in your consideration process.
Choosing the Best Enterprise Password Solution
Unauthorized use of passwords is the most common method of entry in recent data breaches.
All of the options listed above have a reputation for high-security standards. Do not forget, the centralization of your password management is crucial. The solution you choose depends on the needs of your organization.
Compliance Guide to GDPR, The General Data Protection Regulation
We are at a strange intersection in the ‘GDPR Preparedness’ timeline. Some organizations are so prepared as to put the rest of us to shame. Others are so unprepared that the very mention of the letters “GDPR” is met with blank stares.
Then there is the rest of us… The ones who know what GDPR is, have some idea of what is needed by the 25th May 2018 (when the directive becomes law across the European Union), yet find themselves so overwhelmed by the scope of what they face as to feel almost paralyzed. Thus begins a series of questions:
Where does one start? For that matter, where does one finish? What exactly does ‘being GDPR compliant’ look like? Am I going to face a massive fine?
These are all common questions that are floating around the business world, and there is very little help available. The lack of advice is based on two overriding factors:
- Nobody wants to provide guidance because, if they are wrong, then they’ve potentially left themselves legally vulnerable.
- Even the so-called “experts” have not got a clue what being fully compliant means in a real-world sense.
It is a sad idiosyncrasy of GDPR that those best placed to provide the guidance we need, are also the ones most reluctant to assist. So, let us see if I can help remedy the situation and give some of the real-world advice that is sorely lacking at the moment.
Step 1 – GDPR Overview, What is it All About?
On the 24th May 2016, the European Parliament voted The General Data Protection Regulation (GDPR) into law. After publication of the regulations, a two-year countdown leading up to 25th May 2018 immediately began. On that day, GDPR becomes law throughout the entire European Union, replacing all other digital data privacy laws and provisions that came before it.
The law intends to provide a consistent set of new rules concerning the protections afforded to citizens’ data – wherever that records may reside.
It also equips its citizens with the ability to query, alter and if needed, delete the personal information that references them from any system anywhere in the world. That is right folks, if you are in Bangladesh and you process the private information of an EU citizen, that data is protected under GDPR. “Why is that?” I hear you ask.
Well, EU GDPR 2018 is one of a couple of extraterritorial laws that have been passed in the past decade that affect international trade. These laws affect all jurisdictions everywhere and are expected to be enforced by local authorities regardless of the fact that they were enacted overseas.
For example, the Foreign Account Tax Compliance Act (FATCA) was passed in 2010 and requires all non-US financial institutions to identify assets belonging to US citizens and then report those assets to the U.S. Department of the Treasury (along with the identifies of the asset holders).
GDPR regulation is similar, in that it places a burden on all organizations everywhere to identify the data of EU citizens they hold and ensure that those details can be identified, updated and, if needed, deleted upon request by those citizens.
Easy right? After all, how much personal information can there be out there? Well, as it turns out, quite a bit.
Step 2 – Identifying What Data Falls (And Does Not Fall) Under The GDPR 2018
The GDPR protects two types of data – personal data and sensitive personal data.
Sensitive Personal Data is defined as details consisting of racial or ethnic origin, sexual orientation, political opinions, religious or philosophical beliefs, trade union membership(s), genetic or biometric data and health data.
Personal Data is defined as any information relating to an identified or identifiable natural person.
Sensitive Personal Data is straightforward as definitions go. It essentially identifies some of the most private data of an individual and ensures that that information is protected at the highest levels of discretion. The definition of Personal Data is, however, far more nebulous – and this appears to be by design.
Is my name considered personal data? Yes. How about my home address? Yes.
What about my communications with 3rd parties such as emails, social media, chats and text messages? Yes, yes and yes.
What about IP Addresses or GPS data? Yes – them too. Any information that could be used to trace back to a natural person can be classified as personal data regardless of the form it takes, and this is a huge issue.
Are you aware of just how much data will be reclassified as “personal” when the GDPR comes into force?
I cannot say that I am. Moreover, I am pretty sure you cannot either. In fact, the only thing I can say with any confidence is that if anyone tells you that they have an “all-encompassing” definition of what personal data is, then they have not got a clue what they are talking about.
Most consultants we have spoken to have hedged their bets and classified almost everything as “personal data” regardless of how unrealistic their interpretation may be. The operative assumption appears to be – the EU has not made their definition clear enough to enable concrete advice to be provided. Therefore all such information will be as generic as possible in order not to be exposed to potential legal repercussions.
Organizations that fail to implement the suggested data protection measures are facing two levels of GDPR penalties. Article 83 of the GDPR text defines how administrative fines will be applied.
Essentially, the GDPR fines and penalties for a specific organization will depend on a variety of factors including the nature, gravity, and duration of the infringement, the categories of data affected, the actions taken to prevent the infringement.
The list goes on.
Step 3 – Appointing A GDPR Data Protection Officer (DPO)
Before you get started with the more technical aspects of GDPR implementation within your organization, you will need to appoint someone to spearhead your efforts in this area. That person is your DPO (Data Protection Officer). They will be the one who is ultimately responsible for the application and success of your GDPR EU strategy and will be the focal point for all issues.
At this point in most articles on GDPR, you will likely be reading some blurb about whether or not you need a DPO at all. My advice? Appoint one regardless. You will only truly appreciate the depth of the number of private records your organization stores if you turn your GDPR compliance plan into a full-blown project, and that project is going to need a leader.
Whomever you appoint is going to have a rather large task on their hands. Their responsibilities will include:
- Evangelizing GDPR key points and security awareness throughout the organization and educating staff on compliance;
- Ensuring that adequate training programs are implemented so that all staff involved in the processing of private records are prepared for GDPR and its implications;
- Conducting internal and external audits of systems and data management practices and, where necessary, prescribe remediation;
- Act as the primary point of contact and liaison between your organization and the various protection authorities in Europe;
- Ensuring that all activities conducted as part of your GDPR compliance efforts are adequately documented so that you are prepared for any potential external GDPR audit;
- Contacting data subjects as part of any access request processes you implement to ensure that they are informed about how their data is stored, managed and erased; and that they are aware of the existence of the supporting policies and procedures in place.
Step 4 – Getting Every Department On Board (The War Within)
The first thing you will notice after you have defined what personal data is, is that that data is spread out over an extensive area.
Your operations team will control some of it; your finance team will manage a whole separate part of it. Some departments will use redundant copies of it for their own purposes. And many teams will share common databases.
To form a coherent picture of your data assets and rally everyone to your banner, you are going to have to find some way of bringing order to this chaos. Your team can either view GDPR as overhead, a waste of resources, or it can choose to view it as an opportunity to bring order to a branch of data management policies and processes that your organization never had the time or the inclination to reform.
You’ll need to be measured in your approach:
- Start slowly. If you walk in with visions of doom and gloom about the possible negative consequences of not implementing GDPR reforms, you will lose potential allies. Instead, help your team view this as a chance for genuine inter-departmental co-operation on a scale that rarely occurs.
- Do not Expect Perfection. You will face fear. The kind of reluctance to act that can scupper projects. Ensure that everyone on the team knows that perfection is neither achievable nor desirable. Instead, coach your team to see GDPR as an ongoing process that provides you with a clearer view of your data assets over time. Your first steps may feel like they fall short, but they are an essential part of the process.
- Get Buy-In From The Top. If your organization is like most, then folks only move when they know that an initiative is backed at the highest levels. GDPR is no different. If your C-Level Execs are not pushing it, then nobody will follow. Get their buy-in, and all doors will open.
- Maintain A Positive Outlook. At the risk of sounding like an inspirational poster – GDPR is a journey, not a destination. It will be easy to lose drive and focus along the way. A positive approach to the task at hand will help drive people along the path and ensure a smoother ride to the 25th May deadline and beyond.
Step 5 – Finding The Data You Store And Identifying The Various Actors In Your Business
Whose personal data do you store?
If you are like most businesses, then you store records of your staff (Human Resources), your users (Sales and Operations) as well as those of your partners (Supply Chain and Support).
Each of these actors in your company typically requires different systems to store their records, and each of these systems has probably been in operation for some time. Some systems might be paper-based, some may be fully-automated (i.e., software-based) and some may be a combination of the two.
Either way, a comprehensive audit will have to be conducted to establish where the private records of each of the actors in your business is stored.
Once that exercise is complete, the real work begins.
A central tenet of the GDPR framework is consent. Essentially, this part of the GDPR legislation asks the question – On what basis, under the law, did I collect this personal data that I am storing? The GDPR provides a list of the types of justification that are considered appropriate:
- Explicit Consent – Where you are given a clear and unambiguous go-ahead by the data owner to store their records for a specific purpose.
- Contractual Obligation – Where you need the provision of personal data to fulfill your end of an agreement/contract.
- Vital Interests – Where you require the use of a natural person’s data to protect their life, and they are unable to provide explicit consent (very few organizations can claim this).
- Public Interest – Where you must use specific personal information in the exercise of an official task (even fewer organizations can claim this).
- Legitimate Interest – When you use certain personal information because you are certain that doing so would have a minimal data privacy impact, or where there is a compelling justification for the processing. You must balance your interests against the individual’s and if you could obtain their data by other, less intrusive, means then your basis for processing their records will be considered invalid (this is the most ‘legally flexible’ justification for processing data but also the one most fraught with potential pitfalls).
- Special/Criminal Interests – This information falls under the ‘sensitive personal data’ header and can only be legally processed by particular organizations.
It is pretty clear that most organizations will use Explicit Consent and Contractual Obligation as their two most common bases for consent since they are, typically, the main ways of gathering private details. However, reverse-engineering that consent weeks, months and, sometimes years, after that data was collected is going to take a lot more effort than people think.
Step 6 – Are You A Data Controller Or A Data Processor?
Once you have made an assessment and analyzed the records you use within your organization, you need to understand whether you are that data’s GDPR Controller or whether you are merely its Processor. The difference between the two will determine what your obligations are under the GDPR.
The operative difference between a GDPR Data Controller and a Data Processor is control. The GDPR text specifies that Controllers determine the “purposes and means of the processing of personal data” whereas Processors “process personal data on behalf of the Controller.” It is clear, therefore, that Controllers have far more significant responsibilities and legal obligations than Processors.
Data Controllers are the ones who acquire the data and are therefore responsible for ensuring that there was a clear basis for consent – that the data collected was the minimum amount needed for a specific purpose, that it is as accurate as possible, that it is stored as securely as possible and that it is purged or anonymized when it is no longer needed.
The Processors only use details provided by the Controllers, so there is the operative assumption that all the right checks listed above are in place. However, they still have some responsibilities, namely to “provide sufficient guarantees to implement appropriate technical and organizational measures in such a manner that processing data will meet the GDPR requirements and ensure the protection of the rights of the data subject.”
Step 7 – Determining A Data Retention Policy
If you are like most organizations, then the idea of archiving, anonymizing or outright deleting records is not something you’ve ever considered. Data is a valuable asset, why limit it?
Well, because now, if you do not, you are in violation of GDPR policy, that’s why. There are many questions to be asked:
- How long do I hold on to staff records after those employees have left the organization?
- How long do I hold on to client information once they have ceased to be a client?
- How long do I hold on to marketing records once the reason for its collection has passed?
The answer to all these questions is – It depends. And that is enormously unsatisfying.
Staff data retention varies from country to country within the European Union. There is no hard and fast rule that can be applied to all EU countries. But we do know is that once a member of staff has left your organization, a moment will be reached where their records can no longer be legally held by their former employer. The same is true for customers, partners, and suppliers.
Sales and Marketing information is another thing altogether. The GDPR data retention makes it clear that the reason for the collection of private information for marketing purposes must be made absolutely clear to the natural person at the outset and that only their explicit consent to provide you with this data will be considered legal. Once that consent is revoked or the narrow reason for the collection of their information has ceased to exist (such as a short-term marketing campaign) then those records must be deleted or anonymized in some fashion.
These are some uncomfortable truths that will need to be fully understood and internalized before you can move forward.
Step 8 – How to Prepare For Data Subject Access Requests (DSAR’s)
This is the customer/client/people-facing aspect of GDPR.
When the law comes into effect, individuals will be able to ask your organization to provide them with a list of the private content that you hold on them. These requests must be acknowledged immediately upon receipt, and the identity of the individual making the request needs to be established beyond any reasonable doubt. Once that is done, you have a one-month timeline to find their records and provide them to them in electronic form (unless they request other means).
That is the technical part of GDPR directive on data protection out of the way. But what about the operational implications of these requests?
Obviously, you will need to train all your front-line and customer-facing staff about what the GDPR data security is and how to handle these requests. But it goes beyond that. It involves “operationalizing” the entire process from start to finish. For example:
- Will you have a specific email address to handle all incoming DSAR’s?
- Should all your front-line staff redirect all incoming verbal DSAR’s requests to an online form system?
- Will there be a specific training program for all existing and incoming staff that covers this aspect of their jobs?
- Which individual/department will ultimately be responsible for ensuring that DSAR’s are responded to promptly?
- How many DSAR’s are we expecting on day 1, month 1, year 1?
If you are looking for one generic answer to the above questions, think again. The answers will vary based on your technology systems, internal circumstances and technical capabilities.
Step 9 – The Cop Out (aka – Get A Second And Third Opinion)
You are unlikely to get one solid opinion on what GDPR is and how you should apply it.
The views and opinions expressed above and purely my own and are based on my experiences as DPO and the implementation of General Data Protection Regulation 2018 rules within my organization.
It would be foolish to assume that any advice I give is appropriate for all organizations and I would, therefore, advise everyone considering their options regarding the implementation of GDPR requirements and rules to seek external advice. This advice can/should come in the form of legal counsel as well and potentially by engaging the services of a 3rd party audit firm.
The road ahead is unclear. I would advise everyone to acquire as much informed opinion as possible and develop their own GDPR compliance checklist.
Author:
Adrian Camilleri, phoenixNAP’s Head of Operations in Europe
Secure Data Storage Solution: 6 Rules to Making the Right Choice
As your business grows, so does your need for secured professional data storage.
Your digital database expands every day with each email you send and receive, each new customer you acquire, and each new project you complete. As your company adopts new business systems and applications, create more files, and generate new database records, it needs more space for storing this data.
The trend of massive digital data generation is affecting every business. According to analyst reports, the demand for data storage worldwide reached nearly 15,000 exabytes last year. With such an impressive figure, it is clear why choosing a professional storage solution is a frequent challenge in the business world.
What companies are looking for in a data storage solution
The rapidly growing data volume is only one of the challenges businesses are facing. As you compile more files, you also need better data protection methods. Securing mission-critical files and databases is a number one priority for today’s businesses that are increasingly exposed to cyber attacks.
You also want to ensure the data is accessible to your teams at any point. Whether they are working remotely or using multiple devices to access business documents, you need to provide them with easy and secure access to your company’s file system.
These are just some of the reasons why choosing secure data storage can be a tough task. When you add cost considerations to these reasons, the issue becomes even more complicated.
Most business execs do not understand storage access methods, performance, redundancy, risk, backup, and disaster recovery. This makes things much more difficult for IT administrators who need to justify the cost of additional storage requirements.
So why is storage so challenging to tackle and manage?
Most small businesses have limited storage systems, lacking the ability to expand as their needs grow. Their IT departments are left to deal with the challenge of handling high costs of storage along with the cost of security systems and software licenses.
Larger businesses, on the other hand, have an issue of finding a solution that is both flexible and secure. This is especially important for companies operating in regulated industries such as Financial Services, Government, and Healthcare.
Whatever the focus of your business, your quest for a perfect professional data storage solution may get complicated.
1. Assess your current and future data storage needs
The first rule businesses should address is their current and future data storage needs.
Do you know the minimum storage requirements for your applications, device drivers, etc.? Of the space you have left, do you have enough to sustain business needs for the next five years?
If you are unsure, you can assess the amount of storage you have now and compare it to your needs in five years. Sure, you can restrict the size of your employee’s inboxes and the amount of storage they can use on the company shared drive. However, how long will your business be able to sustain these restrictions? You will get to a point where your business outgrows your data storage.
As you continue to add new customers and prospective client information to your customer relationship database (CRM), you can expect to see an exponential need for more storage. Even if you take precautionary measures to remove duplicate entries in your CRM and perform routine data cleanup, your need for additional storage will continue to grow. As your applications require updates and patches and you continue to add new apps to your business, your needs for more storage to house all of it will keep growing.
2. Consider storage functionality that you need
After you assess your current and future needs, considering data storage functionality is the next most important thing to consider. Although it is a fundamental aspect, it is easily overlooked. After all, what function does data storage perform anyway?
You should have already answered the question of why you are purchasing storage by this point. Typically, the goal is to lower IT costs, improve productivity, or support business expansion. Instead of having to buy physical servers or add hard drives that you have to maintain, you can centralize your data storage and management in the cloud.
The cloud would help you increase network performance and make data more accessible to your employees. Moreover, it will make your critical assets available in case of a system failure. These are just some of the factors that should drive you toward the optimal solution for your needs.
You will need to determine whether a shared public cloud would suit your needs well or whether you should consider a private option. Both have their advantages and are tailored for businesses with different needs. If your idea is to share less sensitive information in the public cloud, you may not need to invest significantly in data storage expansion. Dedicated and more secure storage options, which can meet the highest storage security and compliance needs, may be more expensive.
This is why you need to ask yourself what is it that you need right now and what goals you want to achieve in future. The answers to these questions also provide you with a starting point for your decision on which type of storage solution is right for your business.
If you do not know or cannot determine the storage function, you can assume that a shared solution is not necessary. Many small businesses do not need dedicated server providers anyway.
However, it all depends on where you forecast your business will be in a few years. If your organization is reliant on building a large customer base, you may consider mapping out how many customers or potentials you will have and how much storage each data record requires. Multiply that by the number of records you plan to have, and calculate a rough estimate of necessary storage.
3. Redefine your information security processes
Data security is a vital issue to address when choosing and implementing a storage solution. Without a sound storage security strategy in place, you risk losing your sensitive data. With the frequency of data breaches becoming more and more alarming, you should integrate security solutions into each step of your data management process.
Many businesses risk losing data stored on their infrastructure due to platform vulnerabilities or poor security management practices. This is especially true for companies using public or hybrid cloud solutions, where a third-party vendor carries part of the responsibility for data security.
While the cloud is not inherently insecure, the lack of storage security best practices and specialized data security software make your cloud data more vulnerable. To protect data adequately, you need to implement information security best practices on multiple levels in your company.
This involves training your employees on the best practices of cybersecurity, implementing new physical security procedures, hiring data scientists, and developing disaster recovery plans. If your data is stored on multiple platforms or with different providers, this may become a complicated issue, so you need to consider it before you make your choice.
You should keep the operational aspects of security in mind when choosing data storage such as security devices, security administrating, and data monitoring. Is your data encrypted in storage and transit?
Just because cloud storage is vulnerable doesn’t mean your data should be. Understand where your data is stored, how it is transferred, and who has access to the keys. For instance, what would an outage mean to your business? Do you have a valid SSL certificate? Does your CA have a good reputation? Some of the most recent major outages occurred because the SSL certificates were expired.
In addition to this, consider the type of data you backup. Sensitive data should be encrypted and secured separately from non-sensitive data. Many businesses use the hybrid cloud to ensure their critical data is stored on an impenetrable platform and protected by different types of data security measures.
You also need to enforce a strict data usage and storage policy company-wide. Employees should become aware of the sensitive nature of their customer information, as well as the best ways to protect data. With comprehensive security training, your employees can become the best guardians of your critical files.
4. Data backup and deduplication options
Another rule to consider when selecting a professional data storage solution is deduplication.
This is the process of identifying unique data segments by comparing them with previously stored data. With an autonomous backup, the same data can continuously be saved after deduplication is complete. Why save and backup duplicate data in the first place? The deduplication process saves only the unique data in a compressed format.
Deduplication reduces your storage requirement by eliminating any redundant data or information found. This also helps improve processing speed by reducing the server workload. Additionally, deduplication reduces the amount of data you have to manage and increases data recovery times.
Imagine the processing power you expend on sifting through gigabytes upon gigabytes of duplicate data, not to mention confusion of which files are relevant. Another way to think of why deduplication is essential to your data storage, you could end up paying for more storage than you need. You may end up saving money by eliminating duplicate data because you will not have to scale up your data storage.
You may find that deduplication offers more storage space that you are already paying for. You could use this newly found storage for applications or other storage needs.
Deduplication is a method of decluttering folders and databases. Depending on your data, this process could be performed through either manual or automatic processes. Your first step could be to find tools that seek similar data or files because you may not be able to find duplication easily. Once you find it, just delete or determine if you need it or not.
5. Compare speed and capacity of different solutions
Once you have chosen the storage option, you can determine the performance and capacity you need. Capacity is easy to determine and the most obvious function. Performance can be easy to explain but hard to quantify. You may have a hard time determining the needed bandwidth, latency, and burst speeds.
While there is a debate among IT professionals about processor speed versus storage, all you care about as a business owner is the performance of the storage you are paying for. In this case, you may wish to do a little research on which processors can yield the best performance for data storage. If you have selected a shared storage solution, find out what processors the storage provider uses.
You do not need a complete understanding of processor speeds. However, consider this: a dual or quad core processor of 2.8 GHz is better than a single core 3.4 GHz processor. Two cores run two programs simultaneously at 2.8 GHz, while the single core 3.4 GHz processor must share the processing power. This means that the 3.4 GHz processor is limited to operating at 1.7 GHz. In addition to processor speeds, memory speed should be adequately matching as well.
6. Find a provider on which you can rely
If considering moving to or buying additional shared storage in the cloud, consider the reliability behind it. You need to choose a credible vendor or a data center provider and ensure the service level agreement (SLA) is tailored to your needs.
A Service Level Agreement should list the acceptable amount of downtime, reliability, redundancy, and disaster recovery you should expect from a shared storage solution. You also need to consider your provider’s data security methods and data security technologies. This would give you peace of mind considering the availability of your data even in case of a disaster.
You should have your IT administrator chime in on this one because reliability o means the difference between having to wait hours or days for recovery in the event of a catastrophic failure. Even if you do not think you will need to access your data storage solution hourly, daily, weekly, or monthly, you need to ensure it is there when you need it.
The concepts of availability and redundancy are equally important. You should not think of storage as just a typical server. In almost all cases, data storage solutions are built and managed through enterprise servers all with the same physical components. Small businesses should look at a mid to high-end storage provider to support their lower-end servers. Regardless of the size of your company or the size of the servers your data storage resides on, all principles of reliability apply. You will have to weigh reliability and security risks and determine the best choice for your business.
For example, do you plan on using this storage for legacy data you might only access once a quarter or once a year? In this case, the reliability of storage will not be as critical as the data your employees need to access daily and hourly.
Conclusion: Finding a Secured Provider Of Data Storage
In summary, your need for professional data storage will grow along with your business. So will your need for a comprehensive and up-to-date security strategy.
To overcome this challenge, you need to perform an initial assessment of your current and future data storage needs, research storage vendors, and security options. Once you have a clear picture of the functions and needs your storage platform, you should consider how you can secure it adequately.
Building a security architecture that meets all your needs for flexibility and scalability may turn out to be a complicated task. Cloud computing does offer flexible, but you still need strong security and data management strategies to maintain the highest level of safety for your data. This is why choosing a secure storage option is an essential part of a company’s digital transformation strategy.
With the right solution, you can optimize all your critical processes. By following the tips outlined in this article, you increase your chances of making a great decision.