Cyber threats are a major scourge in our time. Thousands of euros quickly fly out the window and the customers’ trust has to be regained if data falls into the wrong hands. When a hacker breaks in to an email account and starts impersonating the managing director, the organisation will suffer much more serious reputational damage.
The answer to promoting our society’s cyber security is vaccinating our computer systems against cyber threats. If most organisations were to regularly protect their information security, major epidemics caused by security flaws could be avoided. On the other hand, every single organisation that leaves their system and technology unprotected will also subject others within their network to cyber threats that spread like a national disease.
How do such vaccines work in practice?
1) Encrypt and verify all data – especially in telecommunications – with a standardised and appropriate encryption algorithm. Unencrypted connections are usually a piece of cake for hackers. Unverified data can also be modified without it being detected. Users often have difficulty evaluating which information should be encrypted – it would be wise to consistently encrypt and verify all data. Current encryption methods are so efficient that they can be applied in almost any system, apart from the most restricted ones.
2) Verify and cleanse all the input entering your system. Various malicious input, such as computer commands embedded in textual input, expose systems to attacks. Attacks can lead to database corruption, loss or theft, and even to full system takeovers. Not even reliable data sources can be trusted under all circumstances; it is better to verify all the data received and perform data cleansing to remove parts of the data that could potentially be harmful.
3) Keep your system hardware and software updated. Software libraries, software and hardware often have vulnerabilities that expose them to cyber threats. As challenging as updating every single part of a large system is, it is still recommended. If updating is not feasible, other means must be used to identify the threats and manage the risks arising from the system’s parts that are not updated.
4) Keep a record of events and information security breaches. Logs are a key way of detecting, identifying and managing risks that unavoidably come with current systems. Attacks are the hardest to identify and react to when the system has already been breached. Identifying the root cause of a problem afterwards is almost impossible without a proper past event log.
5) Deploy multi-factor authentication at least in your critical systems. A user authentication process based solely on a password leaves the system vulnerable to both manual and programmatic attacks. Multi-factor authentication (MFA) makes cyber attacks considerably more difficult because it often requires targeting a specific system or individual.
Everyone is responsible for taking cyber security vaccination regularly. In addition to regular vaccination, personalised and custom solutions may also be needed to protect high-risk systems.
Medical science has eliminated many serious illnesses with vaccines. Why couldn’t we do the same for cyber security? Many organisations have already adopted the responsible approach and are deploying the necessary cyber security measures. However, ever-accelerating technological development is constantly leading new private users and businesses to fall victim to cyber attacks. As a result, the same mistakes keep taking place in different environments and new, unvaccinated systems keep spreading the same cyber threats that others have already been vaccinated against. Together we can stop this vicious circle. Won’t you please vaccinate your system against cyber threats?
