Safeguard Your Business,
Mastering Cybersecurity Risks

Watch Probrand’s Mark Lomas present his take on these findings and the actions you need to take today

Email Security:

Findings

• 28% of organizations have no apparent email filters
• 72% employ robust offsite email tool like Mimecast to block a significant portion of spam and phishing emails
• 58% of admitted that impersonated emails, often used in phishing and whale phishing attacks, are not entirely blocked
• Some have fallen victim to these scams, leading to financial losses

Implications

Poor email security invites phishing attacks, risking financial loss, data breaches, and reputational damage. Business Email Compromise (BEC) can lead to unauthorized fund transfers, while data breaches result in legal and financial consequences. Ransomware disruptions, regulatory non-compliance, and compromised relationships further underscore the need for robust email security.

Key actions

• Implement Robust Filters: Use advanced email filters to catch phishing and spam.
• Employee Training: Educate staff on recognizing and avoiding phishing attempts.
• Multi-Factor Authentication (MFA): Enable MFA for an added layer of protection.
• Regular Security Audits: Conduct frequent audits to identify vulnerabilities.
• Encrypted Communication: Use end-to-end encryption for sensitive information.
• Update Systems: Keep email platforms and security software up-to-date.
• Incident Response Plan: Have a plan for responding to email security incidents.
• Backup Critical Data: Regularly backup essential data to mitigate data loss risks.
• Access Control: Limit access to sensitive emails based on job roles.
• Vendor Security: Ensure third-party email service providers maintain high-security standards.

Firewall Security:

Findings

• 15% are not aware of, or have no apparent firewall to protect against internet threats
• 85% of organizations have firewalls that cover essential protocols and web sites, scan for viruses, malware, intrusions, and more
• Only 75% of them have implemented logging for traffic analysis, a critical tool in verifying data breaches and responding effectively

Implications

Whilst the majority have adopted firewalls, 15% still haven’t! That aside, not having implemented logging for traffic analysis leaves an organization blind to potential cyber threats. In the event of a security breach, the absence of detailed logs hampers the ability to identify the extent of the attack, hindering effective response measures and exposing the organization to prolonged vulnerabilities and legal consequences.

Key actions

• Deploy a firewall to cover the basics – if you firewall is older than 3 years old, replace.
• Implement Traffic Analysis: Invest in and deploy traffic analysis tools.
• Training and Awareness: Train staff on the significance of traffic analysis.
• Policy Development: Develop policies for regular traffic monitoring.
• Incident Response Plan: Establish an incident response plan for immediate action.
• Continuous Improvement: Regularly update and refine traffic analysis processes for ongoing effectiveness.

VPN Security:

Findings

• 25% of organizations do not ensure their VPN appliances are situated in a Demilitarized Zone (DMZ) so do not scan incoming traffic
• Only 43% have implemented logging
• Most organizations rely on managed VPN services for better security

Implications

Having no VPN security exposes organizations to several risks. Firstly, without proper encryption, sensitive data transmitted over the network is vulnerable to interception. Additionally, lacking VPN security increases the likelihood of unauthorized access to internal systems, posing a threat to sensitive data and confidentiality.

Key actions

• Enable Multi-Factor Authentication (MFA): This adds an extra layer of identity verification
• Update VPN Software: Patch vulnerabilities and ensure all security features are in place
• Encrypt Data Transmission: Use strong encryption to secure data transmitted over the VPN
• Implement Detailed Logging: Monitor VPN activities and investigate potential security incidents
• Deploy Role Based Access: Only grant VPN access to personnel based on roles and responsibilities

Multi-Factor Authentication (MFA):

Findings

• 64% of VPN users had no MFA enabled, posing a substantial risk
• 45% of users now use number verification when using the Microsoft Authenticator App

Implications

Enabling MFA is increasingly required for cyber insurance policies. Not having MFA enabled poses a significant risk, as it allows unauthorized access with compromised credentials, making accounts vulnerable to cyber threats and security breaches. Why make it even easier for the criminals, just enable MFA.

Key actions

• Enable MFA Across Platforms - especially for critical systems – often it’s free to do so!
• Educate Users: Provide training to employees on how to use MFA
• Use Authenticator Apps: Consider using MS Authenticator apps for stronger authentication
• Regular Audits: Periodically audit MFA settings to ensure continuous protection
• Policy Enforcement: Make MFA a mandatory policy, especially for sensitive systems

Microsoft 365 (MS365) Security:

Findings

• 43% of organizations had no MFA enforced to access their MS365 environment
• 78% did not secure data for third-party cloud services, HR and financial systems with MFA

Implications

The findings indicate the majority are still overlooking the importance of protecting sensitive information in their 365 environment as well as their 3rd party apps and services – where sensitive data exists. Neglecting Microsoft 365 security risks data breaches, phishing attacks, and compliance violations, potentially leading to financial losses and reputational damage. Prioritize securing your tenancy to mitigate these risks effectively is absolutely critical.

Key actions

• Implement Multi-Factor Authentication (MFA) for all users
• Regularly monitor and improve the Microsoft Identity Security Score
• Enforce strong password policies
• Limit admin access and use dedicated admin accounts
• Educate users on cybersecurity best practices

Backup and Disaster Recovery (DR):

Findings

• 25% of organizations still store backups on their network without an air gap
• 15% only back up selected data, which may lead to longer recovery times

Implications

In short, most are failing to have adequate backup and recovery solutions and practices in place to recover their business when the worst happens. Poor backup and recovery practices expose businesses to extensive data loss in the event of a cyber attack or system failure. It can result in prolonged downtime, affecting productivity and revenue. Without a robust DR plan, organizations risk irreparable damage to their reputation and financial well-being.

Key actions

• Review, define and implement a robust disaster recovery plan
• Ensure regular offsite backups to prevent data loss
• Invest in reliable backup solutions – preferred is to backup entire virtual servers
• Regularly test the recovery process for effectiveness
• Seek professional guidance to enhance backup strategies and resilience against cyber threats

Patching:

Findings

• A surprising 29% of organizations had no patch management in place
• 43% are not automatically patching common third-party apps, exposing further vulnerabilities

Implications

Patch management involves the systematic process of acquiring, testing, and applying updates or "patches" to software applications and systems to address vulnerabilities, enhance security, and ensure optimal performance. Patch management is critical in maintaining ongoing security. Having no patch management in place at all is commercial suicide, and without auto-patching on third party apps the exposure to further vulnerabilities is increased.

Key actions

• Initiate Regular Audits: Conduct thorough assessments of your software applications and systems to identify vulnerabilities
• Establish Patching Policies: Develop and implement clear policies for acquiring, testing, and applying patches promptly
• Automate Patching Processes: Utilize automated tools to streamline the patch management workflow and ensure timely updates
• Prioritize Critical Vulnerabilities: Focus on addressing high-risk vulnerabilities promptly to minimize the risk of exploitation
• Consider outsourcing patch management: Research MSPs offering IT support

Endpoint Security (Anti-virus):

Findings

• 98% ensure their endpoint security application is updated regularly
• 47% did not have advanced features to detect ransomware and hacking attacks

Implications

Endpoint or anti-virus protection appears widely adopted, however, nearly half do not have advanced features enabled to tackle the fastest growing threat of ransomware attacks. The implications of lacking endpoint security are severe, exposing systems to malware, ransomware, and unauthorized access.

Key actions

• Ensure your endpoint security software includes advanced features for detecting ransomware
• Keep security software up to date for the latest threat intelligence and protection
• Explore managed endpoint security services for comprehensive and proactive protection against evolving threats

Cyber Hygiene and Access control:

Findings

• 52%/half of organisations allow users to have local admin rights
• 50% of organizations do not review admin accounts periodically
• Only 19% had a process to disable user accounts promptly when staff members leave
• Shockingly, 69% used weak passwords, contrary to best practices

Implications

Allowing users to have local admin rights, is essentially giving all users the ‘keys to the castle’, risking security breaches, and with employee turnover increasing, it is surprising to find only 19% have the ability to quickly disable user accounts. This means ex-employees can access corporate networks, allowing them access critical data and files. With it, strong passwords are a simple, effective and rudimentary way of securing network access, without that, 69% of those assessed are wide open to the increasing threat vector.

Key actions

• Implement Least Privilege Access: Restrict user accounts to the minimum level of access required for their role to minimize
• Enforce Strong Password Policies: Mandate the use of complex passwords, encouraging a mix of uppercase, lowercase, numbers, and symbols for enhanced security
• Establish User Account Management Processes: Develop and enforce processes for promptly disabling user accounts upon staff departure or role changes
• Employee Training: Provide comprehensive cybersecurity training to educate users on secure practices and strong passwords
• Regular Security Audits: Conduct periodic security audits to identify and rectify vulnerabilities in user account management and access control

Training and Awareness:

Findings

• 48% of organizations did not provide any form of cybersecurity awareness training for their end users.

Implications

Human’s are the weakest link in your defences. Neglecting employee cyber awareness training exposes an organization to heightened risks. Staff may inadvertently fall prey to phishing attacks, lack awareness of cybersecurity protocols, and become potential vectors for cyber threats. Investing in training is crucial to fortify the human layer of defense and mitigate security vulnerabilities.

Key actions

• See John Scott’s Cyber Expo presentation on human error to understand more
• Review providers and implement regular cybersecurity awareness training for employees
• Simulate Phishing Exercises: Use simulated phishing exercises to test and educate employees on recognizing and avoiding phishing attempts to check your training is working
• Promote Reporting Culture: Encourage a culture of reporting suspicious activities and mistakes, fostering a proactive stance against potential cyber threats