Are you hopping into an IT team, or moving into an organization with a relatively new -or outdated- IT structure? Then here’s a piece of advice: step 1 is security.
We have been covering cybersecurity for almost a year with a series of posts dedicated to teaching the basics of cybersecurity that any organization should be aware of. You can see our in-depth articles covering all the details of Cyber Threats, Endpoint Security, and even Remote Cybersecurity.
We also created an eBook, with all the data in one place. Here are some excerpts from our eBook The Essentials to Cybersecurity. You can download the full eBook below.
Types of Cybersecurity
Data Security
Hackers are often after data. They want to see or steal information that’s off-limits. Their reasons vary. In some cases, the hacker is simply stealing information like credit card numbers to sell on the black market (The “Dark Web”).
Other times, the information thief wants to embarrass the target by revealing private conversations and files (e.g. Sony Pictures) or spy on a geopolitical enemy. Data security involves protecting data from unauthorized access. It includes data encryption, data access control technologies, and policies.
Network Security
In order for a cyberattack to work, in almost every situation it is first necessary for the hacker to gain access to the target’s network. Protecting networks is one of the most serious areas of cyber security and typically the focus of significant investment. Network security is the province of firewalls, bastion hosts, appliance hardening, intrusion detection systems (IDS), security incident and event management (SIEM) systems, and so forth.
Application Security
Hackers also like to get inside software applications like Enterprise Resource Planning (ERP), CRM, email servers, and the like. Sitting inside an app is a great way to spy on the target or disrupt its operations.
Application security has many facets, but it usually combines policies (e.g. who is allowed to access the application and its administrative “back end”) and controls over the Application Programming Interfaces (APIs) that let other software programs gain access to the app.
Maintaining IT Cybersecurity Practices
Achieving and maintaining cyber security can be quite challenging. It’s not a push-button process. No single element will do it all, but a weakness in one area can spell disaster for everyone. And, the bigger and more complex the organization, the bigger and more complex the cyber security program will have to be. While security is inherently technical in nature, it relies on a foundation of security policy. These are the rules and guidelines that dictate how cyber security will be implemented and maintained. For example, security policy might state that passwords must be of a certain length, containing multiple character types. Security policy can define who has access to which system—and who can approve or reject access requests. A lawyer should get involved, too, to make sure processes are aligned and compliant with relevant regulations.
IT Cyber Threats
Cyber threats are a big deal. Cyber attacks can cause electrical blackouts, and threaten sensitive data like medical records. They can disrupt phone and computer networks or paralyze systems, making data unavailable. It’s not an exaggeration to say that cyber threats may affect the functioning of life as we know it.
The threats are growing more serious, too. Gartner explains, “Cybersecurity risks pervade every organization and aren’t always under IT’s direct control. Business leaders are forging ahead with their digital business initiatives, and those leaders are making technology-related risk choices every day. Increased cyber risk is real — but so are the data security solutions.” The US government is taking cyber threats seriously but appears to be moving too slowly to mitigate them.
Cyber Defense
Enterprise best practices for defense from cyber defense include basic but extremely important countermeasures like patching systems. When a tech vendor discovers (or is informed of) a security flaw in their product, they typically write code that fixes or “patches” the problem.
For example, if Microsoft finds that a hacker can gain root access to Windows Server through a code exploit, the company will issue a patch and distribute it to all owners of Windows Server licenses. They, among many others, do this at least once a month. Many attacks would fail if IT departments applied all security patches on a timely basis.
A host of new technologies and services are coming onto the market that makes it easier to mount a robust defense against cyber threats.
The Importance of Cybersecurity
Cybersecurity is essential to the existence of technology in the same way civil security and legislations exist to protect its citizens from threats, and exploits.
The name may sound like a heavyweight terminology meant only for big corporations, and top-tier secret Hollywood hackers, but in reality, it is a subject that concerns us all, tech-savvy or not.
Now, you can access this content uncovered basic concepts, such as three-level security (people, processes, and technology), to the list of most common threats any organization needs to be ready for, and the cybersecurity frameworks that you can utilize to make sure your company is compliant with standard security protocols.
In this eBook
1. What is Cybersecurity
- The 3 Types of Cybersecurity
- How to Maintain Effective Cybersecurity Practices
2. What are Cyber Threats
- Types of Cyber Security Threats
- Sources of Cyber Security Threats
- Best Practices for Cyber Defense and Protection
3. What is a Data Breach
- Is a Data Breach Just a "Breach"?
- How can Data Breaches Happen?
- Phases of a Data Breach
- What Types of Data are Stolen?
4. Cyber Security Frameworks 101
- What is a Cyber Security Framework?
- Choosing the Correct Framework (NIST, CIS, ISO/IEC)
- How to Comply With Multiple Regulations
Nicolas Poggi is the head of mobile research at Prey, Inc., provider of the open source Prey Anti-Theft software protecting eight million mobile devices. Nic’s work explores technology innovations within the mobile marketplace, and their impact upon security. Nic also serves as Prey’s communications manager, overseeing the company’s brand and content creation. Nic is a technology and contemporary culture journalist and author, and before joining Prey held positions as head of indie coverage at TheGameFanatics, and as FM radio host and interviewer at IndieAir.