What You Don’t Know Can Hurt You: The Perils of Inadequate Cyber Security Asset Management.

cyber security asset managementWe’re often surprised at how frequently companies fail to adequately track their IT resources. But while tracking the life cycle of your IT devices is important to assure you maximize their value, it is also a critical safety issue. BYOD devices, mobile devices and third party cloud service providers only enhance the need for effective cyber security asset management.

A Wake Up Call

A recent, much read and passed around blog post from cybersecurity expert Daniel Miessler detailed many of the issues regarding lax cyber security asset management. Miessler wrote: “Asset management is arguably the most important component of a security program, but I know of virtually zero companies that have a single person dedicated to it.” He goes on to point out that, “Companies pay hundreds of thousands a year to keep snacks in the break rooms. They pay to send people to training and conferences that usually have very few tangible benefits … But pay 100K a year to have a list of what we’re actually defending? Nope.”

The Life Cycle of IT Assets

An IT asset life cycle refers to the stages that an information technology asset goes through during its time of ownership. Determining the current life cycle stage for each IT asset is a necessity for effective cyber security asset management and may look like this:

  1. Procurement. It should be a matter of course that, whenever an asset is purchased, it is recorded in your organization’s asset management system, and your IT devices and software should be no exception. Information should include model numbers, serial numbers, name of manufacturer and the department the equipment was purchased for.
  2. Distribution of assets. Recording to whom the assets are distributed, or redistributed, is the next necessary step to take for cyber security asset management. Many organizations lose track of who has what devices, and this can only get more muddled as employees leave, shift departments and so on. You’ll also want to tightly control what devices run which software assets; employees who have access to programs they won’t use or don’t need may only needlessly impair security.
  3. Maintenance and Upgrade. Software and hardware updates often have security patches (see our earlier post about the importance of patching). Each update or patch should be recorded, and verified. An organization should also record the last time a device was scanned or antivirus software run, or antivirus schedules.

Be thorough. In 2014, JP Morgan Chase overlooked one of their network servers when providing a security update. Hackers were able use this exposed server to steal data from roughly 83 million customers.

Maintaining devices also means making sure employees aren’t uploading or using unauthorized or unmanaged software. This software may be benign, or it could be an entry point for a hacker to invade

  1. A list of log-in users for each device. Even if a device is assigned to one specific employee, a device may be shared or passed around. Keeping a list of every user for each device can help protect them, especially when a staff member leaves, as a reminder their log in should be deleted.
  2. Disposal/Retirement. When a piece of equipment has run its course, don’t forget to verify that all the information on it has been wiped clean, so that company data is not vulnerable to hackers. You also may want to cancel or transfer licenses.

Keep in mind that cyber security asset management cannot be a one-time only chore; it’s success hinges on its continuity. You have to know when each asset changes hands, becomes outdated, needs updating and so on.

As cybersecurity company Compuquip says, “IT asset management is a lot of work—which may explain why so many companies fall behind on this critical task. But, the importance of asset management for your company’s IT components cannot be overstated.”

Let’s Get Started With Your Cyber Security Asset Management

Our recent blog post on cyber security monitoring stressed the importance of being proactive in keeping your organization safe form cyber threats. Cyber security asset management is a critical component of proactive security, and can be the difference between rebounding quickly after a cyberattack and not recovering at all. Understanding the importance of an active cyber security asset management system is a first and proactive step, but you also need to put that understanding into action. Single Path can help. We offer a wide selection of security offerings including infrastructure patch management, 24/7/365 network monitoring services, proactive desktop and server security and more.

Let us help get your asset management program started. Contact us for more information.

The Benefits of Proactive Cyber Security Monitoring

cyber security monitoring A business team can take a wait-and-see reactive approach to cyber security, delaying action until it is a victim. Or, it can play a proactive role in anticipating the risks, finding the weaknesses, and putting the processes in place that may prevent or soften a cyber crime from even happening. Cyber security monitoring is one such proactive move that can pay back an initial investment many times over.

Cyber security monitoring involves the collecting and analyzing of information to detect suspicious or unauthorized behavior or changes on a network, triggering alerts, and often taking automatic, precautionary actions. Think of it as a high quality security alarm. You can leave your doors unlocked and check every now and then to see if anything has been stolen and, if so, notify the insurance company. That’s reactive. Or, you can set an alarm and not only will you know when a break-in occurs, but the system can notify the police, lock doors, and stop the break-in its tracks.

Now, or never?

Even the most secure system can be broken into, and even the most experienced IT professional can leak a password. But with proactive cyber security monitoring you can find and respond swiftly to these mistakes, and threats. In contrast, a reactive cyber security policy leaves you vulnerable, and recovery can be slow. According to the Ponemon Institute, it takes an average of 191 days for a business to detect a hack. The consequences of being hacked for days, weeks or months before noticing it may be substantial, with data continuously compromised or leaked, used and shared across a broad network of cyber criminals. The immediate and long-term ramifications of such a delay is likely to far eclipse any cyber security monitoring investment. Just a few months ago for example, Marriott International announced their network had been hacked since 2014, and wasn’t discovered until September, 2018. Information from 500 million customers was compromised.

As one security industry company writes, “You need to assume that your business will be breached at some point and have appropriate monitoring controls and procedures in place to mitigate the risks.”

Cyber Security Monitoring Basics

Cyber security monitoring utilizes a variety of mechanisms to continuously keep tabs on network traffic, and then send out alerts or take action at the right moment. As international cyberthreat intelligence provider Blueliv reports, there are typically four stages to the lifecycle of a breach:

  1. Attempting to get the information, like passwords and network credentials (via phishing or other schemes)
  2. Collecting the information (from people falling for the schemes)
  3. Validating the information (to make sure the information works, often though an automated bot)
  4. Monetizing the information (selling it to a third party, using it to steal data, and so on).

With the right threat intelligence, however, an IT security team can step in and stop the lifecycle midstream. With cyber security monitoring, action can be taken while attackers are still attempting to validate the information, or before they’ve finished fully collecting it.

Proactive Help

From hackers to disgruntled employees, to outdated devices to third-party service providers, companies are routinely exposed to security threats, often from unexpected sources. Quick response time is essential, and automated, continuous cyber security monitoring is the key to fast threat detection and response.

At Single Path our proactive monitoring services have saved our clients countless times, not only from outside threats, but from a whole host of unexpected issues. For example, our proactive cyber security monitoring for the Chicago White Sox revealed signs of imminent failure within their Contact Center Server. We were able to apply a patch to the server before it failed, preventing any disruption to customer service. At Single Path, our 24/7 proactive cyber security monitoring and problem-solving are part of what make us an outstanding partner in the continual battle against cyber security breaches or issues, and is just one of our many IT as a Service offerings.

Contact us to find out more.

6 Ways to Improve Employee Cyber Security Awareness, for Businesses and Schools

According to Accenture’s Cost of Cyber Crime Study, the average cost of cyber crime in the United States reached $21.22 million per organization last year (compared to $17.26 million the year before). But you can’t depend solely on your IT department for your cyber security. After all, a chain is only as strong as its weakest link. Improving cyber safety means increasing employee cyber security awareness throughout your entire business or school.

Here are the 6 top ways you can get your employees on board to increase engagement and improve employee cyber security awareness.

  1. Education

Do your employees or staff know:

  • Working remotely using an unsecure Wi-Fi connection leaves computers vulnerable to attacks?
  • Using personal, unsecured devices for work can open the door to compromising an organization’s network?
  • What employees say and do on social media can be tracked by cybercriminals and used against them in the workplace?

Chances are, some if not all of those points may surprise some people on your team. Most experts agree that the #1 key to cyber security compliance at a business or school is educating staff on the risks. For example, in addition to the above bullet points, does everyone on your team know how to spot a Phishing email (see our earlier blog post, How to Spot a Phishing Email), or the risks of using a thumb drive (see our post, USB Security Risks: When Flash Drives Become Dangerous)? An educated team, with increased employee cyber security awareness, makes for a more secure organization.

  1. Assign Mandatory Training

Recently we came across an article in Forbes Magazine that recommended, “Employees and management from all industries should be assigned mandatory cyber security compliance training every year.” This requirement can be administered with computer-based training modules and tied into annual reviews. When implementing training you’ll want to ensure executive and management support, a way to measure success, and also consider incentivizing participation (for more information, check out our earlier blog post, We’re Only Human: The Importance of Security Awareness Training.)

You may want to work with an outside partner to implement training, such as Single Path. We’re well versed in educating and training staff in the most up-to-date cyber security best practices.

  1. Establish and Promote Simple Procedures

More often than not, employees are happy to follow procedures as long as they are aware of them, and they are easy understand. Create organization-wide procedures for your team to follow. Make sure they are functional, actionable and simple.

Once you have those procedures in place, figure out the best way to communicate them within the organization. Keep communication friendly, and avoid hard-to-understand cyberspeak. Says Ashwin Ramasamy, co-founder of marketing intelligence company PipeCandy, “We use comic book-like imagery and sci-fi and comic language in posters across the office that reinforces the message without being suffocating.” Choose a method of communication that will resonate with your team.

  1. Encourage Reporting of Incidents

The best-trained employees can still fall for a hacking ploy from time to time, such as opening a file or clicking a link without thinking. Even IT professionals fall for these tricks. But if a user feels foolish for falling for an attack, and are embarrassed, he or she is less likely to report it. Create a reporting system that rewards staff for reporting suspicious messages, and that allows them to share mistakes without penalty or stigma.

  1. Have Employees Manage Initiatives

Rather than protocols created only by management, make cyber security policy an employee-managed initiative. Create a committee with representatives from every department, and make it their responsibility to set procedure, communicate policy and enforce compliance. Department participation, where everyone feels included, helps ensure individual buy-in.

  1. Make Awareness a Part of New-Employee Orientation

Employees expect to learn rules and processes when they start a new job, and making cyber security a part of their new-employee orientation stresses its importance, and immediately lays the groundwork for your expectations. An employee handbook is also a great place to publish protocols and procedures.

Your Employee Cyber Security Awareness Partner

To implement an employee cyber security awareness program it helps to have a proven partner. Single Path has helped countless businesses, schools and other organizations create a robust, living program that connects employees and staff to best practices. We can help you create a functional and effective cyber-threat strategy for your school or business. Single Path Security offerings are extensive, collaborative and modern.

Ask us how to get started!

12 Cyber Security Tools to Keep Your Business or School Safe

Happy Hacktober! We’re already well into this, the 15th annual National Cybersecurity Awareness Month. NCSAM is a joint effort between the U.S. government and various businesses to raise awareness of cyber security, and emphasize the importance of protecting your organization with cyber security tools and education.

Make no mistake: the need for education continues and cyberattacks are still on the rise. According to data from the Department of Homeland Security, 600,000 personal and business accounts are hacked every day and 47% of all American adults have had their personal information exposed by cyber criminals. What’s surprising is that Millennials, despite having grown up in a digital world, are particularly vulnerable to cybercrimes, with 44% of them victims of online crime in the past year alone.

Get Smarter, Get Safer

The best protection is education. The principle behind Hacktober, which has remained the same since the beginning, is the need to promote proactive, smart behavior in organizations in order to foster a security-conscious culture. Fortunately, there are thousands of cyber security tools and resources available, whether for individuals, SMBs, schools or other organizations.

We’ve collected some of our favorite cyber security tools here. Some of these have been created specifically for Hacktober, and others are evergreen. We hope this list of resources can help you stay more secure.

Cyber Security Tools for Small Businesses

1. This Cybersecurity Awareness Toolkit for Small and Medium-Sized Businesses was published by the Cyber Security Alliance, Facebook and MediaPro specifically for National Cybersecurity Awareness Month. It includes a great deal of information on how to create your own internal company Hacktober awareness kit and, more importantly, tips on how to implement your own cyber security protocols.

2. This 30-minute online assessment tool from the Michigan Small Business Development Center (SBDC) helps small and medium-sized businesses evaluate their own cyber risks.

3. The U.S. Small Business Administration offers a free cyber security course for small businesses.

Cyber Security Tools for Schools

4. A resource library from the Higher Education Information Security Council contains cyber security tools specifically targeted for colleges and universities including brochures, banners and more.

5. k12cybersecure.com is a site filled with “a curated list of recent information and resources to help U.S. public K-12 school leaders and policymakers navigate cybersecurity and related issues.” There are lots of links to articles and reports.

Cyber Security Tools for Everyone

6. This 2018 Toolkit from the Department of Homeland Security was created for National Cybersecurity Awareness Month. This is a comprehensive report that includes government contact information, cyber security tips, a glossary of terms and a list of online cyber security tools.

7. The national STOP. THINK. CONNECT™ campaign is a “national public awareness campaign aimed at increasing the understanding of cyber threats and empowering the American public to be safer and more secure online.” The STOP, THINK, CONNECT website has materials you can display at your organization, plus videos and resources aimed specifically for small businesses and educators.

8. Staysafeonline.org is a website from the National Security Alliance that features a list of upcoming cyber security conferences, online safety basics, advice on how to get your organization involved in cyber security, and many other resources.

9. Create your own custom cyber security planning guide for your organization with the help of this cyberplanner tool from the FCC.

10. The U.S. Chamber of Commerce offers cyber security tools such as tip cards, videos and posters that provide business security essentials.

11. US-CERT (The United States Computer Emergency Readiness Team) provides “no-cost, voluntary, non-technical assessment to evaluate an organization’s operational resilience and cybersecurity practices.” They also offer a self-assessment package, information sheets, downloadable guides and more.

12. The National Institute of Standards & Technology developed a CyberSecurity Framework that recommends standards, guidelines and best practices to manage cybersecurity risk for organizations.

We know we promised 12 tools, a solid dozen online resources, but we have to add a few more—

13. While not specifically created for Hacktober, we’ve published many blog posts that detail cyber security across a wide range of topics including blog posts on Phishing Tactics (part 1 and part 2), How to Spot a Phishing Email, Why Password Security Is Important for Your Business, How to Create Your School Cyber-Threat Strategy, The Growing Threat of IoT, and We’re Only Human: The Importance of Security Awareness Training.

There are many more cyber security tools out there, and we hope you’ll find the ones listed here, or others, are exactly what you need to create a more secure organization.

The Best Resource: Single Path

Single Path is your cyber security expert, with both the experience and resources to protect your organization. We provide a comprehensive menu of security options including audits, penetration testing, vulnerability scans, data loss prevention, ethical hacking/employee training, managed security incident event management (SIEM), managed advanced malware protection, next generation firewalls and email/content filtering. We also can help you rebound from an attack or natural disaster with our incident response services. Of all the vast array of cyber security tools that protect your organization, one of the easiest steps to take is simply calling Single Path.

Ask us how to get started!