Security is essential for a business. However, on the other hand, security is something we all wish would just happen by itself. We don’t want to spend much time adjusting settings or fixing problems. We just want our devices and data to be safe as if by magic. At least I do. And companies do not wish to appoint too many resources to the management of security, but wish to find a cost-efficient but still totally reliable way to handle security.
Since joining the company a few months back, I have had the pleasure to listen to many talented and extremely enthusiastic people talk about security – and the solutions related to it. In these months I think I have learned more about the security threats and how to prevent them than in all the years of my working life so far. One of the key learnings is that the foundation of security is to have the right tools for all levels of security.
Wouldn’t you want to stay on top of this all 24/7, but effortlessly? For that, you need a central, holistic security management tool. Without it, this can all be too hard and time-consuming and you would need a lot of resources to take care of the security issues.
Luckily, this can all be very easy with the right tool. F-Secure Policy Manager is a security management tool that lets you shift your security to autopilot. As Yoshito Sato from Green House company puts it: ”We do not have to worry if each computer is secure or not anymore”.
This is the second in a series of posts about Cyber Defense that happened to real people in real life, costing very real money. Peter came into work thinking, “Today is gonna be boring as hell. I can’t wait till my shift ends”. He couldn’t have been more wrong. One terrible password “Policy 2014” would soon turn his insurance agency upside down. Peter had been working in a 24/7 security centre for a couple of years. He was an IT security specialist and he thought that he’d seen it all. This illusion was shattered when he picked up the phone. “We have a problem. We are losing clients!” he heard through the receiver. He kept listening, though he had no idea how this applied to him. “I think someone might have broken into our sales system! He calls our clients whose contracts are soon to expire. Just before we have a chance to do so ourselves”, the caller complained. The situation was beginning to look serious, and confusing. The system had recently been updated to boost security. At first, the staff who drafted offers for sales reps were accused of leaking the information. It had to be them. They had full access to the system. However, after close monitoring of the system, these suspicions proved to be unfounded. A lead was discovered by sheer coincidence: someone tried to log into the internal sales system using the account of an employee who was currently on holidays. The situation required immediate action. Peter had to identify the exact time and place the system was hacked into through sales reps’ accounts. For this purpose he used a Network Monitoring System of his own design. Unfortunately, it didn’t shed much light on the matter. The login location shifted each time he scanned the system. What is more, these locations were often miles away from each other! Then he started to think like a detective – he decided to lay some bait for the hacker. He created a fake profile for a client whose contract was about to expire. A sales rep was to call him in exactly five days. However, Peter entered his own phone number in the client’s profile details. It only took three days for the hacker to bite. After a two-minute phone call, everything became clear enough. It turned out that the mysterious hackers were in fact employees of a distributor with whom Peter’s company had entered into a contract for the sale of its insurance policies. These suspicions were only made more certain when it was discovered that the company had recently recorded an increase in its sales of insurance products through the distributor. The investigation revealed that an employee from the IT department had facilitated the hacking. He confessed, and revealed that temporary passwords to the sales system were always the same (“Policy 2014”) and that hardly anyone ever changed them – this was enough to obtain customer account data. Finally, the situation was brought under control. The sales system was secured and sales specialists were properly trained in data and password protection techniques. However, the company’s image suffered. Although much effort was made to keep the case confidential, many clients grew concerned about the safety of their personal data. Nevertheless, it was the sales personnel who suffered the most as their commissions dwindled. For the latest on business security, be sure to visit F-Secure's Business Insider.
F-Secure announced today that it has acquired nSense - a Danish cybersecurity firm that specializes in providing security consultations, vulnerability assessment, and related services to large enterprises. So you might be asking yourself why this matters. Well, the answer is that it matters because “large enterprises” provide products and services to people, and so the kind of security measures these services use to defend against cyberattacks is what protects the personal information you give to these enterprises from would-be attackers. The 2011 attack on Sony’s Playstation network provides a textbook example of how important corporate cybersecurity is for regular people. The Playstation Network was hacked in April 2011, and while it was initially reported as a disruption in service, Sony’s investigation eventually uncovered evidence that the attackers were able to steal the personal data of people subscribing to the gaming service. The compromised data included names, email addresses, physical addresses, and even login details of around 70 million subscribers. Sony also admitted that the attackers may have stolen credit card numbers, although they could not confirm this. And this isn’t an isolated incident. Target experienced a massive data breach in 2013, as did Home Depot in 2014. Both instances exposed the credit card information of shoppers to risks - risks that people don’t necessarily want to take when they go shopping at brick-and-mortar stores. So the cybersecurity of large enterprises is an issue that concerns us all, which is why F-Secure’s acquisition of nSense is big news. F-Secure’s award-winning products already protect tens of millions of people and thousands of businesses. nSense is one of Northern Europe’s leading cybersecurity firms, and specializes in providing protection services for large enterprises in the entertainment, finance and service provider sectors. You should care about whether or not the businesses and organizations you entrust with your data are taking care of it, and providing it with the best protection. Now F-Secure is in an even stronger position to provide its vaunted Best Protection to large enterprises, and to their customers. And that's why it matters. [ Image by carlosalbertoteixeira | Pixabay ]
Online criminals are in the business of finding holes -- holes in your software. "Pieces of software will always have vulnerabilities, and there will always be criminals creating exploits for those vulnerabilities," says F-Secure Senior Researcher Timo Hirvonen. "It's become a whole business model for these criminals, because the security patches that companies release basically expose the vulnerabilities in software. The criminals reverse engineer the patches to find vulnerabilities, and then they target those vulnerabilities with exploits they develop." Given that they spend all day thinking about how to get into your network and you spend all all day trying to run your business, they may have the advantage. But there is a lot you can do to make your data and customers safer. Our Security Advisor Sean Sullivan recently responded to questions we frequently hear from businesses trying to secure their IT infrastructure. He explained with what the most common vulnerabilities tend to be, the steps you can take to patch them and the biggest mistakes businesses make. Mobile apps and cloud systems allow employees to access documents, systems, data and other work product from anywhere, but always-on access comes with always-threatening security risks. What are the most significant of those risks? Always on and working from anywhere means more devices and a larger attack surface area. Even a diligent and tech-savvy person who is cautious about not opening a suspicious file can still be a victim of exploits, as these kits automatically take advantage of vulnerabilities in software that are commonly used by browsers and programs, such as Adobe Reader, Flash players, etc. More than half of what F-Secure is blocking these days are exploits, and they’re among the biggest threats to SMBs because people frequently don't update their software and this puts the business at greater risk. A Java plug-in update, for example, that people often ignore thinking it’s not a mission-critical application for their day-to-day activities can be the chink in the armor that lets in a malicious attack. Some of the exploit kits we're detecting are using exploits that have been detected and patched MONTHS ago, but the attackers are betting that many businesses haven’t updated their software, and their bets are paying off. What are the most important steps small and medium-sized businesses should take to protect themselves against those risks? The cybersecurity landscape is fluid so invest in sending your IT person to training seminars so he or she can learn more about protecting your users and network. Additionally, selecting a cloud-based security solution helps you and your employees not have to worry about updating plugins and applications. What are some of the biggest mistakes SMBs make in this area? They undervalue their data and content. Training documents for new hires, for example, aren’t mission critical to the business functioning, so it’s likely the business wouldn’t see it as valuable, but if they had to recreate all of those files from scratch, it would likely take a lot of time and resources, right? Thinking an attacker won’t go after certain items because it’s not important to them is the wrong mindset — they care about what’s important to you. Backup files in multiple locations — online and physical hard drives. Use a VPN to encrypt your communication and encourage or provide VPN applications for your employees to use on their work and personal devices. Lastly, keep your systems updated. Using a cloud-based security software that takes care of all that helps saves you time and money and lets you focus on your business and the professionals handle security. Our F-Secure Booster's premium version contains a software update feature that can you monitor their drivers and applications to keep them patched in protected. Our business products also feature Software Updater to keep software updated and safe from exploits. [Image by elineart | Flickr]