Cybersecurity 101:
Intro to Cybersecurity for US & Canadian Businesses

Prevent, Detect, and Respond

As you get ready to call it a night, the last thing you do before you head to bed is lock the doors, turn on the electronic alarm system, and give your German shepherd a pat on the head as he snoozes in his bed.

Now imagine that someone wants to break in. They’ll have to find a way to disable your alarm, get through the locked door, and maneuver past Fido in order to gain access to your valuables. These three layers of security act as barriers (locks and the dog), detect an intrusion (alarm and the dog), and attack the intruder (the dog).

An attacker could certainly find ways to circumvent all three of these security layers, but getting in and out for his mission will be more difficult and take longer than if he only had to deal with locked doors.

The concept is similar in a technology environment where the layers of security are designed to detect and thwart attacks before they can do any damage.

1. Basic Technical Controls

Firewalls, Patching / Updating Software, Network Design

Think of basic technical controls as the method you use to close and lock the doors to your data and IT systems. Keep in mind that older software and hardware don’t have the advanced capabilities that newer technologies include. Your network design should promote controlled access to data and minimize damage if/when a hacker does get through your defenses.

2. Advanced Security Tools

Threat Detection and Response, Artificial Intelligence, Email Security

The need for advanced security tools can’t be ignored when it can take more than six months for an intruder to be detected without them. That’s a lot of time for cyber criminals to plan out how they can get the biggest strike.

Advanced security tools use artificial intelligence to learn about your network traffic so that they can recognize activity that is not normal and act when something out of the ordinary occurs, which could be a sign of an intruder.

3. Endpoint Security Protection, Detection, and Response

Agent-Based Software on Connected Devices

Endpoint protection can be considered an advanced security tool, but it’s worth calling it out here because of the increasing number of devices that are connected to your network. Whether it’s your remote workers’ corporate or personal computers, your cloud services, or your smart devices, anything connected to your network is a potential access point for a cyberattack.

Endpoint security protection detects and responds to potential threats.

4. Mobile Device Management

Monitoring Software, Identity Management, Security Policies

Using smartphones makes it easy for employees to be in touch when they’re not in the office, but when you think of smartphones as doors to your network, then it’s scary to think of who could get access to your data if the phone is lost, stolen, or used by an unauthorized person.

Software can be used to control what employees can do on their phones. Teaching people how to use the security features that are available on their phones and providing training on acceptable use will help to instill in the employee their individual responsibility for using their smartphones with safety in mind.

5. Advanced Email Security

Spam Filters, Encryption, Identity Management, Cybersecurity Awareness Training

Phishing continues to be a preferred cyber criminal tactic because it works. The bad guys use tricks to impersonate companies and people whom your people trust to get them to do something that they wouldn’t otherwise do.

If your email software is up to date, you probably already have advanced security tools available but they may not be activated. This could be for many reasons, but it’s usually because your IT team doesn’t know about them or your leadership team has declined to use them due to the potential impact on workflow.

Cybersecurity Awareness Training (discussed below) and Identity Management are essential parts of email security.

6. Identity and Asset Management

Password Management, Multi-Factor Authentication, Biometrics

Identity and Asset Management (IAM) is like the set of keys that allow your people to access their accounts, your network, and your information. Cyber criminals want to get those keys because it’s a lot easier for them to unlock your doors than to figure out a way around or through them.

The biggest problem with identity management is in getting people to take it seriously. Methods like multi-factor authentication (MFA) and biometrics have evolved so that you don’t have to rely on password management and human behavior alone to keep accounts safe. But they still require training. If a user will click on a pop-up to authenticate even when they weren’t the one who initiated it, then the cyber criminals will still be able to get in.

7. Secure Network Access for Remote Workers

Virtual Private Network (VPN)

Enabling your remote workers with security includes many components. VPN is the tool you need to let employees access your network securely.

A VPN opens a secure path through your firewall that requires any connections to be encrypted and authenticated. It’s essentially a tunnel that prevents outsiders from seeing the traffic that goes in and out of your network.

8. Securing Cloud Applications

Encryption, Data Backup, Identity Management, Email Security

Whether your whole infrastructure is in the cloud, or you have several departments using cloud services, you can’t leave security totally up to the cloud provider.

Before using cloud services, make sure that the service meets your parameters for security and compliance. (Get help with this technical discussion if you need it.) Make sure you backup your cloud data and secure the devices that are accessing your cloud services with Endpoint Protection and Identity Management.

9. Cyber Forensic Tools

Logging and Security Information and Event Management (SIEM) Software

Cyber forensics is what you need after you have a cyberattack so that you can prevent the same thing from happening again and to determine the extent of the data breach.

These tools must be in place before the incident takes place.

The ability to track down how an intruder gained access and then determine what damage was caused will be critical when it’s time to make an insurance claim or defend your organization in legal proceedings.

10. Security Policies

Documenting, Training, and Enforcing How to Access Information and Your IT Systems

Think of your security policies as the way you answer your employees’ questions about how they should access your network and data. It starts with “What data do I need to do my job?” and details how that data may or may not be shared.

Your policies set out your expectations for how employees should act in certain situations, like what to do when a vendor needs to access your network. The effectiveness of security policies is directly related to the level of training and enforcement that is present.

11. Cybersecurity Awareness Training

How to Recognize and Respond to Potential Cyberattacks

Although both are directed at employee behavior, cybersecurity awareness training is different from security policies.

Cybersecurity awareness training uses simulations, tests, and interactive instruction to teach employees to recognize potential cyberattacks. Much of this training is focused on social engineering and how it’s used in phishing and spear phishing attacks, because these are favorite cyber criminal tactics.

12. Physical Security

Restricting Access to Facilities and Devices

Whether at the office, out and about, or at home, physical security matters when it comes to keeping prying eyes and sticky fingers off your business data. Part of physical security has to do with limiting access to your facility, but EVERY employee must play their part too. This can be as simple as getting into the habit of locking their screen when they step away from their workstation or making sure that someone doesn’t enter a building behind them.