Tag: Cybersecurity

05 Nov 2019

How to Expand Your Tech Stack Responsibly

Contemporary enterprise organizations continue their migration to the cloud to save money, increase flexibility and reduce the burden of keeping experts on staff to manage infrastructure. But, while the benefits of moving to the cloud are real, it’s essential to expand your tech stack responsibly—and that starts with security.

Contemporary security considerations for enterprise-level organizations:

 

  • Sensitive data leaving the company firewall – Once sensitive data leaves the perimeters of an organizational firewall, it’s vulnerable to malicious actors. Some firewalls protect the enterprise network and users while others protect information in transit between cloud applications. As the workplace marches towards all things cloud-based and digital, it’s essential to protect data both in transit and at rest.
  • Bring-Your-Own-Device (BYOD) and remote work culture – Companies now allow—and even encourage—employees to use their personal cell phones, tablets and laptops for work activities. This is another avenue for organizational information to leave the safety of the company network and once it moves onto personal devices, it’s a security risk. The popularity of the BYOD culture is driven in part by the uptick of remote employees.
  • Breaches, hacks and attacks – According to a recent report, 38 per cent of organizations aren’t equipped to detect a sophisticated breach and in 2017, the average cost of a data breach was $3.62M.[i] A strong cybersecurity infrastructure can mean the difference between shutting down operations and business as usual.
  • Shiny object syndrome – Everyone wants to download the latest and greatest tech gamechanger. And while most third-party SaaS solutions are safe, organizations can’t afford to jump on board (or let their employees do so) before conducting their own cybersecurity due diligence.
  • Shadow IT – Employees may be downloading or using third-party software or apps to exchange sensitive information. Organizations need to make a better effort at making the protection of data the path of least resistance.

 

Four ways to expand your tech stack responsibly

 

  1. Lay the foundation with encryption – Encryption converts information or data into a code for the purpose of preventing unauthorized access. Before you do anything else, make sure your data is encrypted in transit and at rest. Encrypting communications secures sensitive data and protects it from nefarious use by malicious agents (including insiders) and from accidental breaches by employees. Choose a user-friendly encryption platform that makes encryption the path of least resistance. With Echoworx’s OneWorld encryption platform, you can turn cybersecurity into a competitive edge, increase digital trust and enjoy a significant return on investment.

For example, a recent Forrester Total Economic Impact™ study, revealed that a typical enterprise-level organization using Echoworx’s OneWorld encryption platform can expect an ROI of 155 per cent—with upwards of $2.7M in cost-mitigating benefits. This same study showed that using the OneWorld platform to replace legacy on-premises encryption solutions could save the software cost of previous solutions and avoid other legacy-related costs for a three-year savings of $793K.

Get the full Forrester Total Economic Impact™ study of OneWorld now.

  1. Apply good governance – Is governance part of your cybersecurity framework? If not, start today. Who oversees and is responsible for managing technological expansion, assessing cyber risks and vulnerabilities and creating a way forward? If the answer isn’t clear, it’s time to make changes and get your board of directors involved too. Did you know that only 40 per cent of corporate boards participate in their organization’s security strategy?[ii]
  1. Assess your current tech stack – In the old days, IT vetted all the tech brought into the business. But in large organizations, tech slips into departments based on team needs, with little regard for the big picture. Many organizations vastly underestimate the amount of software being used across their operations, marketing, sales, human resources, business intelligence and project management teams. When you reveal the real current state, it gives you the information you need to move towards a sensible future state.
  1. Provide the tools your employees need – The biggest culprit of shadow IT are apps and programs designed to streamline employee workflow. You need to provide your employees with the best tools to do their jobs effectively and safely.

Here’s more on how you can minimize your risk of insider threats.

  1. Implement privacy by design – The Privacy by Design framework, developed by privacy expert, Dr. Ann Cavoukian, is based on seven foundational principles. They are proactive not reactive, lead with privacy as the default setting, embed privacy into design, retain full functionality, ensure end-to-end security, maintain visibility and transparency and respect user privacy. If each new item in your tech stack follows these principles, it reduces the risk and costs of taking a reactive approach to data security.

To learn more about Privacy by Design, download our white paper here.

At Echoworx, encryption is all we do. If you’d like to make secure communications easily accessible across your organization, contact us.  We’ll show you how the right encryption technology can differentiate successful digital transformations from the rest.

By: Wen Chen, Senior Manager of IT and Support, Echoworx

——————–

Source:

[i] EY Global Information Security Survey 2018-19

[ii] 2018 Global State of Information Security Survey (PWC)

09 Sep 2019
Capital One Breach

A Lesson in Cybersecurity Simplicity from the Capital One Breach

The lesson from the recent Capital One data breach can be summed up with the KISS principle. Simplicity is hard to beat, even in cybersecurity. Let’s look at why this breach happened and what organizations can do to shore up their cybersecurity defenses with seemingly simple solutions.

Peeking behind the Capital One headlines

The headlines about the Capital One data breach emphasize impact: more than six million Canadians were compromised in this data breach. Over a million Social Insurance Numbers (SIN) were exposed. Victims can receive free credit monitoring and identity theft insurance to reduce the sting of their private information being stolen from their trusted provider.

This is scary stuff, but the most chilling part of the story isn’t even covered in some of these reports: The data was breached due to a vulnerability caused by a misconfigured server. Those two words—misconfigured server—left chief technology officers and chief information security officers around the globe trembling. Server configuration is part of the basic line of defense in cybersecurity.

The lesson from Capital One is about simplicity. Good cybersecurity hygiene matters and it’s the first and best defense against data security breaches. To manage this ongoing and increasing threat, enterprise-level organizations must get serious about mastering the basics.

Getting back to basics: 5 simple ways to boost cybersecurity in your organization

 

  1. Resource your IT department appropriately – According to the EY Global Information Security Survey,[i] 87 per cent of organizations don’t have enough money in their IT budgets to fund the cybersecurity and resiliency programs they want to implement. And, as we saw with Capital One, missing a basic security protocol can lead to costly and embarrassing outcomes. Dr. Ann Cavoukian, Executive Director of the Privacy by Design Centre for Excellence, told the CBC, “Companies are simply under-resourced. They’re not devoting the resources required for strong security.”[1] Having enough properly trained IT resources means your team can dedicate time to testing and uncovering vulnerabilities and mistakes before it’s too late.

 

  1. Encrypt your data – Encryption protects private data in transit (such as in email and other communications) and at rest (on your network). It’s important to have a scalable encryption solution that offers multiple delivery options, is easy for employees and clients to use, lets users recall encrypted messages even after they’re opened and is easily integrated with solutions you already use, such as Office 365. In a recent Echoworx survey, 53 per cent of the IT professionals and decision-makers surveyed said encryption technology was very important or critical to their organizations. And yet, only 40 per cent of respondents said their organizations are using data privacy technology extensively. Again, here’s where simplicity triumphs: an encryption solution can only be effective when it’s used.

 

There are also financial incentives for using encryption. A recent Forrester Total Economic Impact™ study, revealed that a typical enterprise-level organization using Echoworx’s OneWorld encryption platform can expect an ROI of 155 per cent—with upwards of $2.7M in cost-mitigating benefits.

Get the full Forrester Total Economic Impact™ study of OneWorld now.

 

  1. Know your risks and assets – Cybersecurity efforts are more effective when they’re based on a strategic framework, instead of piecemeal solutions. It’s important to identify (and address) risks such as outdated security protocols, data protection, careless employee behaviour, identity and access management, etc. Identifying key assets and data—and increasing security around them—is another essential part of a strategic cybersecurity infrastructure. Increase support for cybersecurity initiatives by helping your board of directors understand the real risks companies face with inadequate cybersecurity programs and resources.

 

  1. Use a privacy by design approach – With so many organizations pursuing digital transformation, there’s a perceived need for speed. What’s even more essential is building privacy and data protection into new digital programs and processes. Frédéric Virmont, a cybersecurity industry expert, says, “Security is like quality; it must be from the beginning to the end of the life cycle. If you wait until the end of the product, it’s too late. Once the house is built, it’s too late to add emergency exits.”

Learn more about mitigating internal vulnerabilities.

 

  1. Train your staff on cybersecurity – A recent PwC reportfound that 32 per cent of respondents consider insider threats more costly and damaging than external incidents. Insider threats can be accidental or intentional, so education and proper security protocols are the first line of defense against them. Educate employees about the importance of using security programs and processes and how to identify and report suspicious incidents. And by choosing effective cybersecurity platforms –encryption for example—that are also easy to use, you make data protection the path of least resistance. Cybercrime, including social engineering and spear phishing, is more sophisticated than ever; wise companies create informed workforces capable of identifying these cyber threats.

 

With the average cost of data breaches at $141 per breached record (and more than double that for healthcare organizations),[ii] isn’t it time for organizations to keep it simple and master the basics of cybersecurity?

By: Brian Au, IT Specialist, Echoworx

 

Sources:

[1] https://www.cbc.ca/news/business/capital-one-data-breach-1.5232952

[i] https://assets.ey.com/content/dam/ey-sites/ey-com/en_gl/topics/advisory/GISS-2018-19-low-res.pdf

[ii] https://www.ibm.com/downloads/cas/ZYKLN2E3