5 Tips to Prevent Cyber Attacks & Protect Your Business

The ongoing conflict between Russia and Ukraine and the threat of attacks from cyber groups has put Australian businesses on high alert. 

Cyber security should be top of mind for every organisation, regardless of the time or place. However, given recent conflicts and the potential threat of cyber-attacks, we suggest you take the time to evaluate your organisation’s current security strategy and consider whether there is more you could be doing to stay protected. 

In this blog, we take a look at 5 tips to mitigate potential cyber-attacks on your business. 

1. Now is not the time for massive, complex change. 

Fight your instincts. When there is a real or perceived threat, your instinct may be to drastically change the way your organisation manages cyber security. If your business has a well thought out security strategy with effective measures in place, now is not the time to alter this and introduce complex change.  
 

Check whether your cyber insurance policy will cover you in the event of an attack and ensure your employees understand the security measures your business has in place. Take the time to undergo additional staff training if required.  

2. MFA is a must! 

There is no excuse not to have Multi-Factor Authentication (MFA) set up if it is available. MFA is one of the most effective and easy ways to prevent unauthorised access to your accounts. It works by requiring two or more proofs of identity before granting access.  

If you’re unsure of what MFA is, think of the times when you have logged into a system using your email and password credentials and receive a text to your mobile with a verification code that you need to enter before accessing the system. This MFA setup makes it more difficult for cyber criminals to attack. They may have a password but the second step of mobile phone authentication means they will be locked out.  

3. Check your Internet connected devices. 

Nowadays, pretty much all of our devices connected to the Internet. From the obvious mobile devices and laptops to the not so obvious baby monitors, thermostats, printers, webcams and countless more.  

Believe it or not, there are search engines out there that work like Google but instead of locating relevant websites, they find unprotected Internet of Things (IoT) devices.  If your business or employees use a device that connects to the internet and is not protected, these search engines can tell potential hackers everything they need to know to break into your network. 

On the less scary side, organisations can take advantage of these engines to search for an IP address, find vulnerabilities - such as using default passwords, not using a secure VPN to connect, login credentials revealed in content banners – fix them and get these devices removed from IoT search results. You can use tools such as Shodan, Censys and Thingful to search for devices, identify and resolve security gaps and get the devices unlisted.   

4. Remember the Essential Eight.  

There are endless security measures your organisation can put in place to mitigate risks and make it more difficult for cyber criminals to attack and compromise your systems.  

The Essential Eight was developed by the Australian Cyber Security Centre (ACSC) and lists eight measures that should form the foundation of your cyber security framework. Some of these include MFA which we mentioned earlier, restricting administrative privileges and conducting regular backups.  

Use the Essential Eight to look for easy to deploy, low risk security controls that can be adopted with minimal effort. Go back to basics and ensure your file backups are validated, tighten permissions and access controls and of course, make sure MFA is activated on every system that offers it. 


5. Avoid geopolitical posting or commenting.  

Your organisation should avoid any geopolitical posting and commenting online – this goes for all employees as well. Cyber criminal groups and individuals may have a political objective in mind when planning and executing attacks. Do not make your business a prime target for these groups. 

If commenting on current world events, keep your messaging clear and avoid taking a stance on controversial topics. Staff should also follow this recommendation, even when it comes to their personal online accounts. Employees should add a disclaimer when posting online that their opinion is just that – their opinion – and does not necessarily reflect the views of the organisation they work for.  

In Summary 

During times of uncertainty and heightened states of security awareness, remember to focus on enhancing your current security framework and avoid introducing complex change.  

Use the Essential Eight to assess your current cyber security strategy, take the time to educate your employees, increase staff training if necessary and remember MFA is a must! 

If you need a hand evaluating and improving your organisation’s security strategy, please get in touch with our security and infrastructure specialists.   

Additional sources
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trustwaves-action-response-russia-ukraine-crisis-defending-your-organization-from-geopolitical-cybersecurity-threats/
 
https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/ciso-bytes-podcast-russia-ukraine-crisis-combatting-nation-state-threats-for-critical-infrastructure-and-beyond/