With the rise in cyber-attacks and intelligence growing alongside technology in these attacks, it’s more important now than ever to ensure you have a fortified front. This is to avoid the risk and stress of losing not only what is important – but everything.

In this article, we will discuss how to improve passwords, and how to stay on top of them in 5 easy steps.

Nothing simple

This one is obvious, but it’s easy to forget when we’re in a time crunch or feeling a bit lazy. Don’t put anything easy that can be guessed just because you can’t be bothered to take the time to make a proper one.

Ransomware works

Recent ransomware attacks have demanded upwards of US$70 million¹ and cybercrime itself costs organisations $6 trillion per year in global damages². Spreading through means including phishing emails, unprotected personal computers, exposure to public Wi-Fi, and Zero-Day vulnerabilities, 46% of those hit with a ransomware attack pay the ransom at an average of over US$800,000³. The money behind ransomware makes it an increasingly professional criminal endeavour.

The human element is a greater liability

Ransomware’s rise has much to do with the vast growth in network-connected hardware and software. IoT devices, particularly if not patched, can act as a gateway to an improperly secured network. The speed at which IT departments were forced to roll out remote access systems during the pandemic left many inadvertent loopholes. These are easier to exploit following the move to more home and hybrid working, which sees employee hardware placed on insecure home networks and public Wi-Fi.

While Zero-day attacks, which exploit platform vulnerabilities, are a real and present threat, they aren’t something that can be easily prepared for. Moreover, phishing – a common method of network infiltration – has become ever more complex and devious over time. The richest prizes have come from those with the highest level of access, and hackers perform detailed reconnaissance on key targets.

Employing a Zero Trust strategy

Minimising the possibility of IT infrastructure attack means taking a Zero Trust approach – building a framework whereby no entity which interacts with your organisation has any implicit trust. Every device, user, platform, tool or vendor must clearly demonstrate its security credentials, particularly as liability for data breaches is highly unlikely to be passed on to third parties. Employees must be trained to understand this, and a workplace culture must be built around cyber hygiene and resilience.

However, even savvy employees can slip up in a tired moment. Hackers with enough insider knowledge may be able to gather sufficient information to infiltrate a network regardless of an organisation’s policies. The tactic now must be to secure the key asset of any business – its data – by implementing consistent encryption and employing a backup policy. Backups must be as protected as core data, ideally with strong encryption, and kept in triplicate online, offline, and off-site.

Rising cybercrime and the emergence of ‘ransomware-as-a-service’ means that the safeguarding of company and personal data has never been more critical. With data being regularly moved between home, fixed office and even a co-work space, it’s imperative to consider security hygiene and how it can be improved if the hybrid model is to succeed long term.

Transport files securely

The demand for flexible working means a growing number of devices that are potentially on the move, rather than being kept at a permanent desk within a fixed office. The likelihood of a device being left or stolen, therefore dramatically increases, potentially placing sensitive files and company data directly into the hands of a malicious threat actor.

The demand for flexible working means a growing number of devices that are potentially on the move, rather than being kept at a permanent desk within a fixed office. The likelihood of a device being left or stolen, therefore dramatically increases, potentially placing sensitive files and company data directly into the hands of a malicious threat actor.

Encrypt data in the cloud

The cloud is often the preferred option for remote workers to connect and collaborate. However, concerns over cloud security mean that a business might hesitate to utilise its services for data storage. To ensure total privacy, data must be encrypted, but this requirement for encryption cannot be dependent on the cloud service provider (CSP) where the encryption key is stored in the cloud and therefore accessible to hackers and cloud staff alike.

The solution is to remove the encryption key from the cloud and physically store it within a PIN authenticated external USB module. This allows users to access data stored in the cloud, while also being able to securely encrypt information from a local computer, a network drive, or sent via email or file sharing service.

Centralise data management

Multifactor authentication is a highly recommended best practice for data protection compliance. If a hacker were to obtain a cloud user’s credentials, the breach would go unnoticed to the cloud service provider as it wouldn’t be able to differentiate a legitimate user from an attacker. The encryption module increases security measures to as much as five-factor authentication.

Use of an encryption module by authorised staff will reduce the risk of data loss due to human error but doesn’t eliminate the possibility entirely. This is where central management is needed, enabling those responsible for cloud and data security to monitor file activity, set geo-fencing and time-fencing restrictions, encrypt file names and disable users’ access to data remotely.

Use encryption technologies to reduce risk

State-of-the-art encryption could save a business from hefty fines in relation to the GDPR in the event of a data breach. Yet worryingly, recent figures suggest that as much as 82% of the databases in the public cloud are not encrypted². While cloud providers do offer encryption to customers, the only information required to access their data is a username and password. It therefore falls to financial services organisations to take matters into their own hands and ensure data is securely encrypted before it is sent to the cloud, both in transit and at rest.

For ultra-secure encryption, data should preferably be encrypted with a FIPS certified randomly generated AES 256-bit encrypted encryption key, providing the highest levels of security and protection. The user should retain full control of this key, ensuring that it is stored separately to their data. Taking this approach means that even if the cloud account is targeted and hacked, the data cannot be accessed.

Share information securely using multi-factor authentication (MFA)

In the financial services sector, highly sensitive information is shared regularly between businesses. While the cloud facilitates instant collaboration, co-operating parties should ensure that data is encrypted and that relevant stakeholders are provided with a copy of the encrypted encryption key to access the files. This introduces a multi-factor authentication (MFA) security procedure, even when data is sent to a third party.

As an example of unsecure third-party access causing major issues, a data breach suffered by a South African bank in 2020 effectively put the data of 1.7 million customers at risk. While the bank’s own network remained secure, the breach concerned the premises of a third-party business who had been entrusted with customer data for marketing purposes. Here, encrypted data with an encrypted encryption key stored separately would have prevented the incident.

Despite initial concerns about data hosted in the cloud, providers have been quick to promote security capabilities along with other benefits of scalability, cost and convenience. Yet, the security element can be somewhat misleading. The terms and conditions of many major cloud providers include a ‘limitations of liability’ clause which places data-security responsibility with the cloud user. More stringent measures, therefore, should be considered when considering cloud storage.