Cyber threats are occurring at an alarming and growing rate. Why is this? Companies are online and the pandemic pushed many of them to change their tech stacks to a more modern infrastructure that allowed employees to work from home and capitalize on the distributed workforce. The downside? The shift to working from home was one of the fastest tech changes ever and companies weren’t ready to build an accompanying strategy. Instead, they simply made it work. They didn’t future-proof their tech. So?
While this shift is generally positive and supports the modern mindset, many of your customers have not security-proofed their environments. That, combined with small to medium-sized businesses (or SMBs) generally lacking the revenue to invest in dedicated security personnel, means the bad guys have even easier opportunities to make your clients pay. But remember—these people aren’t just “cybersecurity threats.” They are real people looking to make a quick buck and your clients are making it easy for them. Here’s how to help.
The Need for Detection
According to IBM’s 2020 Cost of a Data Breach Report, it takes 197 days to detect a cyber breach and an additional 67 to stabilize your organization after the breach. That’s 197 days for a non-ransomware event, and that downtime costs money. However, cyber breaches cost far, far more than just downtime. They curtail the victim’s ability to take new orders, which eats at revenue. They can also spread fear, uncertainty, and doubt among employees and partners, and they decrease market confidence in an organization. Keep reading and discover 4 simple ways you can help your customers detect Security threats before it’s too late.
Best Practices for Cyber Threat Detection
So, how can you guide your clients through threat detection and response? As a Trusted Advisor, you can’t be everywhere at once for your customers. But that doesn’t mean you can’t offer helpful tips that will set their organization up for success, not to mention establish yourself as a Security expert and go-to resource for additional technology needs! Help your customers better detect potential incoming threats with these easy-to-implement best practices.
Note Slowed Network Traffic
Network monitoring should be a layup for your clients! Simply monitoring both internal and external traffic rates is an easy way to watch for the noisiest of bad guys. Sometimes, they just want to prevent your clients from being able to work. We’ve seen everything from launched DDoS (distributed denial of service) attacks on the wrong targets to targeting clients during their peak e-commerce hours. Often, victims only learn about external attacks from clients trying to use their service. Internally, the noisiest bad guys will start scanning the network as soon as they get in. These scans often slow down the network and your clients may only learn about it from their own employees submitting trouble tickets. While slowed traffic probably won’t help your clients detect a more sophisticated adversary, it can help identify a common cybercriminal who is up to no good.
Watch Unusual User Behavior
There’s a very real cyber bad guy that “guarantees” someone who buys their software will get access to a victim. Scary, right? Well, it’s not as impressive as it sounds. The software writers require that the buyer sends their poorly written attack software to 100 users. In that pool, they know at least 1 person will click and then they’re in. Once they receive access, attackers will look for administrator accounts or even make their own. One of the best ways to detect this type of attack is to watch user account changes and how users login. This is especially true for users who don’t have MFA (multifactor authentication) enabled. Another great way is to watch for proprietary documents that are shared outside the organization. The takeaway here is to monitor and raise the alert on any interesting or unusual user behavior!
Start at Day Zero
A recent study revealed that 88%, or nearly 9 out of every ten, breaches are caused by employee mistakes. Though most people believe cybersecurity is a technology issue, the truth is, it’s a people issue. Often, the stress of rapidly speeding to market, combined with the deployment of technologies a team hasn’t been trained on, creates a perfect storm of misconfigurations. Unfortunately, that combination tends to lead to breaches. This happens far more often than we’d like to admit. Yet, human error can be improved. Coaching employees to evaluate new tech and training them on how to evaluate that tech before they adopt it is crucial. This process doesn’t start during annual training. In fact, it starts far earlier.
A short but impactful training session included in the employee onboarding process ensures they’re prepared from Day Zero to be vigilant and engage the right stakeholders when there’s a question. This is actually considered prevention, the step before detection! Beginning with the IT team and focusing on shaping traffic, a process in place that also accounts for prevention and misconfiguration detection will help decrease the risk of breaches and lighten the load of those attempting to detect breaches that stem from misconfigurations.
Get Visibility Everywhere
We all hate that little update that tells us we need to restart our apps, programs, browsers, and devices. But while we may hate it, most of us know that we need to do it. It is necessary to patch our devices to make it harder for the bad guys to get us. However, that alone is not good enough. If your clients don’t have visibility into their devices (including servers and network infrastructure servers!), they need it. Potential cybercriminals will get access and when they do, your clients need accurate, actionable alarm bells! Antivirus isn’t enough. They need the ability to detect bad behavior on all endpoints and other assets. Their security operations center (SOC) needs the whole picture and they simply can’t see the whole picture if they are missing visibility into endpoints
As a Trusted Advisor, your work doesn’t end at implementation. It’s also important to conduct regular check-ins with customers! Not only can this help determine satisfaction of the implemented solution on your end, but it also gives you a chance to provide additional resources that can contribute to a more secure organization. Set your customers up for success and guide them through the best practices of easy cyber threat detection with these helpful tips!
To discover more ways to aid your customers in creating a secure technology framework for their organization, check out our Technology Insights podcast on developing an in-depth IT Security strategy. Plus, grow your knowledge and discover how to tap into the exploding Security market at one of our upcoming events in your area!