Six Steps to Avoid Becoming a Data Breach Statistic

NOTTINGHAM, England, August 30, 2016 /PRNewswire/ --

The first time many businesses know they've been hacked is when someone from outside the business tells them, but it doesn't have to be this way 

In the first half of 2015, 246 million records were breached globally and 82% were classed as mega-breaches, because of the numbers of records hacked. Often, the first an organisation knows of their systems being compromised is when an external party tells them.

Even where this isn't the case, data breach notification obligations mean businesses can't always remain silent about a breach while they deal with the fallout. As a result, rarely a month goes by without a news story on a high profile data breach emerging.

Whether from malicious hackers, an insider job or employee errors, there are a number of proactive steps organisations can take to mitigate the risk avoid becoming one of this year's data breach statistics.

Address authentication 

Stolen credentials are a prime entry point to systems for hackers. Introducing Identity and Access Management (IAM) technology means that regardless of how a network and data is being accessed, it's being accessed securely through correct identity mapping, correct access assignments and robust authentication flows.

Enterprise IAM solutions can even provide real-time, continuous risk analysis on users, detailing who has access to what, who has access to privileged resources, their activity and summarising their behaviour and access rights with a risk score per user.

Enhance security around applications 

Building on this, one of the best practices for securing data is extending security around applications by using multi-factor authentication - providing several separate items of evidence to be authenticated - right across systems.

This can mean, for example, proving identity through possession of a hardware token in addition to the user's password. Multi-factor authentication should particularly be used for granting access to privileged users.

Limit access to systems and applications and apply fine grained controls 

However, the fact that someone has established his or her identity as an employee should not result in unfettered access. It's important to work on the principle of least privilege here to ensure employees only have access to the services they really need.

Should everyone have root access to server? Should everyone have access to every system? Routing access through a single point, role based access can be used to limit who has right to use to which systems and applications. In general, businesses need to be more rigorous on who has access to what.

Finally, businesses should consider provisioning and de-provisioning systems to help with automating new hire enrolment and performing necessary clean up tasks when employees leave. No one wants a disgruntled employee using their old account to hack into the company network.

Password management and self service 

Password management and self-service solutions can also be part of an organisation's security arsenal and help mitigate against data breaches.

Access to the network may be well locked down with applications secured behind firewalls and DMZ's or perimeter network, authentication and IAM in place, but one element that can be lacking is security from the end user's perspective in the form of a password policy and password management.

Passwords are so commonplace that people can become complacent with their use. Repeated, simple, low entropy passwords can result in increased attack vectors.

Password self-service solutions can help combat identity theft, account hacking, data theft and improve security practices of end users by introducing strong password policies with the ability for a user to self-reset should they forget.

Hackers rely heavily on mining information from social networking sites, so employees should avoid using the same passwords on social sites as they do on accessing company resources.

Create a security-aware culture 

There is one final element that is less to do with systems, authentication and access, but can make a huge difference to how successfully an organisation can stand up to a potential hack - culture. Best practice in network, systems and data security needs to be enshrined in a strong and well communicated security policy.

It needs to be embedded with a company's culture, rigorously monitored and taken seriously at every level - from the CEO down.

Key protocols here include having unified data protection policies that cross the entire organisation, and a consistent policy across all servers, networks, computers, devices to help reduce risk.

A prevent and response plan needs to be constantly updated, outlining critical actions in the event of a breach, for example locking and moving sensitive information.

While reports of data breaches might be appear to be getting more frequent and the hackers ever more sophisticated, the reality is that most data breaches are low level in their complexity and are often the result of simple employee error.

Following these steps and employing security best practices throughout the organisation covering everything from office security to password, authentication and access policies will go a long way to reducing the chances of a breach.

Notes to Editors 

About Hypersocket Software 

Hypersocket Software provides enterprise level network security and access management software to help businesses create more secure IT environments. Affordable Single Sign-On, Managed File Transfer Server and Virtual Private Networking products give organisations of all sizes the tools to enable people to work smarter and more securely. And by creating solutions that focus on areas where security is paramount and tackling the IT security challenges that businesses face every day, Hypersocket Software provides customers not only with peace-of-mind but also an outstanding return on investment.

Press contacts
Stephanie Dobson
Lumiere PR Limited
Direct: 07831 623 533
Stephanie@lumierepr.com

Reha Joshi
Hypersocket Software
Reha@hypersocket.com