What your clients need to know to protect their intellectual property and other mission-critical data.
eFax Corporate recently hosted a webinar to inform covered entities in healthcare of the dangers that today’s sophisticated cyber hackers pose to their electronic protected health information (ePHI) and other intellectual property.
We chose healthcare because it is a favored target among hackers and other “malicious actors,” as the FBI calls them. This is largely because the personal data that health providers hold includes information valuable to criminals--names, birth dates, Social Security numbers. According to the Department of Health and Human Services’ Office of Civil Rights, data breaches of health providers in 2014 affected as many as 10 million people. And breaches like these were up an astonishing 1,800% from 2008 to 2013!
But the common pitfalls and best practices we identified in this webinar relate not only to healthcare-related businesses; they can also apply to organizations in all industries. So here’s a brief overview of the key points we discussed in the webinar--details you might want to share with your corporate clients.
6 Best Practices for Preventing Cyber Attacks
Many of the best approaches to cyber security today can be found in the SANS Security Model, articulated by the SANS Institute for information security training and research.
These six coordinated steps--referred to as “Defensive Walls”--might sound like a military strategy, and that’s by design. The model is built on the longstanding military approach to protecting assets, by creating multiple layers of security around them.
The military metaphor is also appropriate because, when it comes to securing their sensitive data and intellectual property, your clients are already in a cyber war.
Defensive Wall 1: Proactive Software Assurance
This first step in the cyber security best practice is to make sure your organization’s software applications do not have holes or vulnerabilities that an attacker might be able to exploit.
Defensive Wall 2: Blocking Attacks (at the Network Level)
Here’s where our military metaphor begins, creating the outermost physical security layer to protect your data. This security layer is at your organization’s perimeter--the network. A strong network-based security infrastructure should include several complementary systems and processes, including:
Network firewall
Intrusion Detection System (IDS), which will detect and then alert you if someone tries to penetrate your network
Intrusion Prevention System (IPS), which will automatically thwart an attempted attack on your network
Managed Security Services (MSS), third-party security experts monitoring and proactively protecting your network and data against hackers
Defensive Wall 3: Blocking Attacks (at the Host Level)
This is the next security layer inward from your organization’s network perimeter. “Hosts” in this context refer to any device or location where your data is housed--servers and databases, desktop computers and mobile devices, now often called “endpoint devices.”
For these endpoint devices, you need more than simple antivirus software. In fact, reacting to the flood of new viruses being detected--upward of 5,000 every week, by some estimates--the Symantec CEO admitted in late 2014 that antivirus as we know it is dead.
Your “host” devices are no longer always kept within the physical confines of your offices: Your employees are working and accessing your data at home, in their cars, at Starbucks. This is why best practices now dictate that corporations apply the same levels of security to your “host” devices as you do to your network:
Firewalls
Intrusion Detection (IDS) and Prevention (IPS)
Content Filtering
Anti-malware
Defensive Wall 4: Eliminating Security Vulnerabilities
This layer of security involves putting into place strong security management practices, including:
Vulnerability Management, which refers to proactively identifying and wiping out vulnerabilities to cyber hackers in your networks, applications and process
Patch Management, which goes hand-in-hand with vulnerability management, where identifying a security vulnerability in an operating system requires a security patch to fix
Penetration Testing, which involves actually testing the security controls you have in place, looking for weaknesses. Essentially, it means acting like a hacker to determine if a hacker could penetrate your systems
Defensive Wall 5: Safely Supporting Authorized Users
This security layer involves providing several related protocols to allow your staff, consultants and other authorized personnel to safely access your data from anywhere. This defensive wall requires the coordinated use of:
Encryption, which refers here both to data at rest (on a server or database) and data in motion, such as when the data is accessed from the cloud or sent or received over any communication medium (email, fax, etc.)
Virtual Private Network (VPN), necessary for when your staff or other authorized users access your data over the Internet. This is a common shortfall among corporations’ overall security protocols--failure to secure access to networked data for their remote workers.
Data Loss Prevention (DLP), which is essentially monitoring your network for critical data you’re trying to protect and keeping it from “leaking” out of your security umbrella. A strong DLP system will alert you if this data moves, and automatically stop it from being transferred outside your secure network.
Defensive Wall 6: Tools to Manage Security and Maximize Effectiveness
This final security layer includes additional processes, applications and practices, such as:
Log Management, generating and storing a complete audit trail for every device that accesses your network, so you can conduct a thorough forensic review in the event of a security breach
Security Incident and Event Management (SIEM), which layers analytics over your log data, to analyze this data looking for security incidents
Training, including training your entire staff on smart, secure data protocols and training your IT staff on how to recognize and prevent security vulnerabilities
More Hacking-Prevention Details in the Free Webinar
We answer several related questions in the free eFax Corporate webinar on cyber-hacking prevention. Additional topics covered in the webinar that you might find interesting, and might want to share with your clients, include:
Why are firewalls are not enough?
What are some of the new threats to corporate networks and data?
What are the most common data-protection mistakes corporate entities make?
Offer Your Clients a Secure-Faxing Solution
Another way you can offer your clients a proven solution to protect their critical and sensitive data is with the world’s No. 1 online fax service, eFax Corporate, often complemented by eFax Secure. eFax is entrusted every day to transmit millions of pages of sensitive corporate documents by businesses in the most heavily regulated industries. Our proven process helps enterprises meet the strictest federal mandates regarding data transfer, tracking and storage.
And this solution is now part of our support-driven, high-touch, lucrative Partner Program. Please visit our eFax Corporate Partner page to learn more.
Peter Ely is Leader, Channels, Enterprise Marketing. Currently responsible for the Enterprise Partner Program for j2 Cloud Services, Peter is a 27-year technology veteran, having held senior executive positions looking after Presales Support, Product Management, Product Marketing and Technical Evangelist teams in the telecommunications and data networking arenas in positions located across two continents and three countries. Guest blogs such as this one are published monthly and are part of MSPmentor's annual platinum sponsorship.
No comments:
Post a Comment