Cyber-readiness Strategy 12: Multi-Layer Security Strategy

Security is asymmetrical. Where businesses must plan, prepare and defend against every threat or scenario, cybercriminals only need to find a single weakness or hole in your defenses to carry out their malicious plans.

Protect your data and your business by deploying multiple security strategies together as one. By using a multi-layer security approach, you can make it much more difficult for cybercriminals to penetrate your organization and cause serious damage.

When it comes to cybersecurity, businesses cannot afford to take chances. Deploying a multi-layer security strategy is the best way to protect your data and your business from the ever-growing threat of cybercrime.

A multi-layer security approach uses multiple security measures to create a defense in depth. By using multiple layers of security, you can make it much more difficult for cybercriminals to penetrate your organization and cause serious damage.

Here are 5 tips for building an effective multi-layer security strategy:

1.     Implement Strong Authentication Measures

One of the most important components of a multi-layer security strategy is strong authentication. Authentication is the process of verifying that someone is who they claim to be. There are many different authentication methods, but the most common are something you know (like a password), something you have (like a security token), or something you are (biometrics).

Using multiple authentication factors – known as two-factor (2FA) or multifactor authentication (MFA) – is the best way to ensure that only authorized users can access your data. Requiring MFA makes it much more difficult for cybercriminals to gain access to your systems, as they would need to have possession of all the required factors.

2.     Encrypt All Sensitive Data

Another important element of a multi-layer security strategy is encryption. Encryption is the process of transforming readable data into an unreadable format. Encrypting sensitive data helps to protect it from being accessed by unauthorized individuals, even if they can penetrate your defenses.

Encryption should be implemented for data “at rest” and “in flight”. Most web services today will use secure socket layer (SSL) encryption to encrypt communication sessions “in flight” between users and the service. Data sitting on a storage device – hard drive or SSD – is “at rest” and can most often be encrypted using features the device operating system (OS). It usually needs to be activated during setup and a policy control needs to be set so it cannot be turned off.

3.     Implement Perimeter Security

Your workforce and company resources in your offices need to be protected by sophistication perimeter security techniques. A firewall controls the flow of traffic between your private network and the public Internet. It can be used to allow or block traffic based on a set of rules. This helps to protect your network from unauthorized access and malicious activity.

Intrusion detection and prevention systems (IDPS) are another important layer of security. These systems are designed to detect and prevent unauthorized access to computer networks. IDPS can be deployed as hardware, software, or a combination of both. They work by monitoring network traffic and looking for suspicious activity that may indicate an attempted intrusion. When IDPS detect suspicious activity, they can take action to block the attempt and alert the system administrator. This helps to prevent attacks before they can do any damage.

4.     Utilize Perimeterless Defense Systems

When your workforce is working outside the office, they are also outside the firewall. When this is the case, other “zero-trust” or “perimeterless” tactics need to be added. If the user’s device OS supports a firewall, it should be activated and managed by policies that can be pushed from a central authority. DNS Security – both DNS filtering and DNS encryption should be implemented to prevent users being redirected to fraudulent sites without their knowledge.

Finally, endpoint detect & respond (EDR) software should be installed on any user device to help prevent malware, ransomware or other malicious code from infecting the device.

5.     Educate Your Employees

One of the most important components of a company security strategy is education. It is essential that all employees are aware of the risks associated with cybersecurity and the best practices for avoiding them. Employees should be trained on how to identify phishing emails, spot social engineering attacks, and understand the importance of keeping their passwords safe.

In addition, employees should know what to do if they suspect that their account has been compromised. They should know how to report suspicious activity and whom to contact for help. By educating your employees about cybersecurity risks and best practices, you can help to protect your business from attacks.

A multi-layer security strategy is the best way to protect your business from cybercrime. By implementing multiple security measures, you can make it much harder for cybercriminals to succeed in their attacks.

By following these tips, you can make it much harder for cybercriminals to succeed in their attacks. Implementing a multi-layer security strategy is an essential part of protecting your business from the ever-growing threat of cybercrime. By doing so, you can help to ensure that your business is as safe as possible from the ever-growing threat of cybercrime.

So what are you waiting for? Implement a multi-layer security strategy today to help keep your business safe from cybercrime. If you would like more information or have questions about how strong your cyber-readiness is, please contact Montra at sales@montra.io.

Cyber-readiness Strategies 9 and 10: Passwords and Insurance

It’s becoming increasingly difficult to keep up with the cyber security threats out there. From ransomware and phishing to malicious insiders and business email compromises, there are many dangers lurking in the digital world that can affect your organization. To stay safe, it’s important to have a robust cyber readiness strategy in place. This starts with making sure your employees are aware of the threats and know how to protect themselves, but it also includes implementing technology solutions and procedures that can help you mitigate or prevent attacks. In our prior installment of this series, we touched on Continuous Network Intelligence and Security Awareness Training. Keep reading for strategies #9 and #10; Combating the Password Crisis and Don’t Skip Insurance.

Combat the Password Crisis 

In today’s fully connected world, passwords are the first line of defense against cyber-attacks. However, they are also often the softest target for attacks. This is because many people use weak or easily guessed passwords, and they often reuse them across multiple accounts. This makes it easy for hackers to gain access to your systems if they can just crack one password. To combat this, it’s important to have strong password policies in place. This includes using a mix of letters, numbers, and special characters, as well as changing passwords regularly. This can be managed by policy on many systems so that users are forced to use strong passwords and unique passwords across systems. For some systems, these controls cannot be set, but alerts can be triggered so that IT staff will get notified when users set their passwords poorly. 

When users are forced to use difficult and unique passwords, it’s also critical to use a password manager to help users keep track of all their different login credentials. This will make it easier for your users to comply with the password policies. Some desktop browsers have a basic password manager built-in and third-party software can also be used that provides additional features like secure password sharing within groups. 

Don’t Skip the Insurance 

No matter how well you prepare, there’s always a chance that your organization could be the victim of a cyber-attack. This is why it’s so important to have insurance in place. Cyber insurance can help cover the costs of an attack, including business interruption, data recovery, and legal fees. It can also help with reputational damage control if your organization’s name is dragged through the mud. 

Cyber-insurance is a relatively new area of business insurance, so there are a wide variety of cyber insurance carriers with different underwriting policies. It is important to do your research and find one that fits your organization’s needs and that is cost-effective. It is also helpful to work with cyber experts, who can help you make some small changes to your IT operation that can have a big impact on your cyber insurance costs. Implementing multi-factor authentication across all your applications and using DNS Security can have a positive impact on your risk scoring with an insurance carrier. 

These are just two more of the many things you can do to improve your cyber readiness strategy. Stay tuned for our next, and final installment, where we’ll be covering strategies #11 and #12; Reduce Supply Chain Vulnerabilities and Deploying a Multi-Layer Security Strategy. If you would like more information or have questions about how strong your cyber-readiness is, please contact Montra at sales@montra.io.

Microsoft 365 Trends in 2022

After a somewhat late start and mixed approach to offering services versus software (remember ASPs and Hosted Exchange), Microsoft 365 has become the dominant SaaS platform for mid-market and SMB companies. Microsoft 365 now has over 50 million subscribers. Not all of the other major SaaS providers provide their subscriber numbers but they include Adobe Cloud with 26 million subscribers and Salesforce with an estimated 17.8 million subscribers. 

With such a dominant role in corporate IT, our final trend predications for 2022 is focused specifically on the trends for Microsoft 365. 

1. More AI Features will Be Added 

 Artificial Intelligence (AI) is already a central focus of some 365 applications like Dynamics AI, but where most users feel the impact of AI is when these smart features are embedded into the core 365 apps. Like dynamic translations between languages in Word or the resume helper feature that pops up when Word believes you are working on one. 

Microsoft’s enormous user base puts them in a unique position to use AI techniques like machine learning (ML) that need a lot of user behavior data to work well. Microsoft will roll out these types of smart features in 2022 to offer uniqueness to their offerings that can only be added at their scale. 

2. Microsoft 365 will Get More Complex – not Less 

The approach that Microsoft has taken with 365 has been to constantly add to features and capabilities often without much of an announcement, documentation, or support. Many of these features are included in one or more of their subscription levels. The approach makes sense at the scale at which they operate, but it leads to adding more capabilities that make the 365 more complex to understand and utilize well. 

In 2022 this trend towards more complexity will continue. New features and new pricing plans will be an expanding story throughout the year. In Microsoft’s defense, it is really the right strategy for them right now. It is relatively low cost for them to add features to 365 and effectively test them on their large customer base. The features that are working and being used (like Teams) get more development and support effort, while the features that don’t work get less support and will even get removed (like Delve). 

3. More API Tendrils will Deepen Microsoft 365’s Grip 

The number of application programming interfaces (APIs) in Microsoft 365 is mind-boggling. In 2022, the breadth of API coverage will increase. This is a strategic play and a practical benefit associated with the size and scale of Microsoft 365. Providing broad API support gives an incentive to enterprise developers or third parties to use the 365 features and applications in the automation of their business workflows. 

Look for more API support in the core IT processes that are associated with email, security, remote working, and data loss prevention. 365 is at the center of where most company’s employees interact with technology and communicate with one another. API support for automation that leverages this unique position for 365, is highly strategic to companies and therefore to Microsoft also. 

4. Remote Collaboration Will Take Center Stage 

Regardless of what happens with the pandemic and changing attitudes about remote work, Microsoft 365 will see many new features added or expanded to enable better remote work. While there are clear indications that many employees will return or continue to work from an office location, the remote work wave among software and services will lag the trend since rolling out these features has taken so long. 

For 365, extensions to Teams and the collaboration features of the Office application suite will feature prominently in 2022, if for no other reason than they were in development in 2020 and 2021. These features will provide value to remote workers and remote teams but will not see as much impact as was originally expected in 2021. 

We are big believers in Microsoft 365 and the increasing influence it will have on users across companies of all sizes. What do you think about Microsoft 365 in 2022? Where do you think Microsoft will expand this juggernaut for the upcoming year? Let us know what you think at info@montra.io. 

Cloud Compliance in 2022

This is the second in our series of 2022 trends. Last week we covered employee information management trends for 2022. This week we look at the trends for cloud compliance in 2022. 

Compliance – which in our context is specifically cybersecurity compliance – continues to be the way in which cybersecurity is managed and measured in modern IT. This is especially true is cloud services, where compliance standards have been an enabler to cloud growth. Cyber compliance standards like HIPAA, PCI DSS, NIST, and ISO 27001, help set the standards that businesses can use when evaluating how secure the cloud services are that they are evaluating and purchasing. 

As the nature of cybersecurity attacks change, so too do the standards for cybersecurity compliance. This leads to our big trends in cloud compliance for 2022. 

1. Companies Will More Broadly Apply CMMC to Their Non-Federal Clouds 

We discussed Cybersecurity Maturity Model Certification (CMMC) in a post a couple of weeks ago. This measurement standard from the Federal government will continue to expand into and provide influence over cybersecurity in the private sector. 

CMMC incorporates NIST SP 800-171 standards and provides a convenient five-level maturity measure. This type of measure has been used in IT in the past with the Capability Maturity Model (CMM) which was used by many CIOs in the early 2000s to measure their path toward better IT process and service orientation. 

With the recent announcement of CMMC 2.0, and with the prevalent knowledge of consultants that can lead IT organizations down the path of better cybersecurity, 2022 looks to be the year that CMMC measurement and reporting of the cloud becomes commonplace. 

2. Private-Public Hybrid Cloud Models Will Add Compliance Nuance 

In 2022, more companies will generate more of their data in the public cloud. Many of those companies will have policies to move portions of that data to their private cloud within defined periods of time. Which data is moved and when and where will continue to be a compliance challenge both for security as well as privacy. As compliance rules shift – like frequency of vulnerability scanning – companies that maintain hybrid clouds will need to update their procedures in both private and public contexts as well as the reporting for audits. Enforcement of data-related policies such as right to erase personal data will increase  

 3. Multi-cloud Application Compliance Will Become More Complex to Track  

When companies implement applications in a cloud today, they mostly isolate each application in one cloud – typically called hybrid cloud. Multi-cloud applications span more than one cloud and are increasing in popularity as different cloud vendors develop specialized and unique services. In 2022, more companies than ever will be using multiple clouds for a single application. 

For instance, maybe you develop a customer relationship management application for your sales team. You might store customer phone numbers in one cloud because their database service has privacy protections built-in, but you use a slick emailing app from another cloud that is easy to implement and extend. When emails and first names are temporarily stored in the second cloud, there becomes a second location for personally identifiable information (PII) to reside. Privacy policy understanding and enforcement is needed in both clouds, but without a rather technical review of each component of the application, this can be missed. 

Compliance audits and policy enforcement will need to get increasingly into the “weeds” on each application to understand where the cyber-risks are and how cyber-compliance policies apply. 

4. Compliance Ownership When Using Cloud-native Services Will Shift 

All the major clouds – AWSAzureGCPIBM – have co-management models for cloud compliance, but the policies are mostly utilized for first-gen cloud technologies like virtual machines. The differences in co-management of cloud compliance with cloud-native services have been treated as a special case by cloud providers. In 2022, the prevalent usage of cloud-native services will make it necessary for cloud providers to address the ambiguities of cloud compliance responsibilities that these services create. 

For example, with virtual machine implementations, responsibility for user credentials is clearly on the side of the customer. With cloud-native services, though, user credentials are exposed as they are used to access various services and/or are passed between services. How the user credentials are being handled by the cloud provider becomes important for compliance and security purposes for the cloud customer. 

What do you think about cloud compliance in 2022? What are your big concerns for the upcoming year? Let us know what you think at info@montra.io.

Tis the Season for Cyberthreats: 3 Ways to Keep Your Device Secure Over Turkey

It’s that time of year for travel, visiting family, eating too much, and rushing around for last-minute errands and gifts. It is a hectic and wonderful time but if you are like me, it is also when you are trying to fit work into different locations, times, and levels of sobriety.  

It is easy to be distracted in this season. Cyber attackers know this and you should be rightfully concerned. 

Here are a few ways to keep you and your devices safe as you find yourself in new workplaces during the holidays. 

1. Watch Where and How You Connect 

Whether you are connecting on your parents’ wifi or from the closest Panera, you will be connecting differently and probably less securely than your normal home office. If your mom’s wifi doesn’t have “one of those silly passwords”, then you need to protect your presence on that connection: 

 

  • If your company has a VPN, you should use it. Or consider a paid VPN service. 
  • Keep your laptop firewall always running. Windows and Mac both have this built-in. 
  • Set yourself in stealth mode if you can. 
  • Make sure you have updated antivirus (AV) or endpoint detect and respond (EDR) software installed 
  • On your mobile device, use a security app like what AT&T and Verizon provide for free. 
  • If you want to be the safest, skip the wifi and tether your laptop to your phone with security app running.  

If you follow these basic steps, you should be safe at your closest coffee shop to “get some work done” while enjoying some peace and quiet.  

2. Think About How You Are Mixing Your Work and Personal Tasks 

You are going to be doing a lot more personal tasks on your laptop than you normally do. This could lead to exposure on shopping sites, gaming sites, or elsewhere, which opens you to new threats. Be mindful of where that search for “adult sized Elf costume” or “Thanksgiving movies on Netflix” is taking you. Also keep in mind that if you are connected to your company VPN, you are traversing company property and are subject to their acceptable use policy. Tread carefully. 

To help keep your focus, you might consider using one browser for your personal stuff and one for your work. Or if your browser supports tab groups, you can group your personal and work tabs separately. If you keep your screen organized, you are less likely to be confused by a popup or email request that is really a phishing attempt. 

3. Be Aware of Who is Using Your Device 

It’s easy to leave your laptop open on the table after you’ve found that recipe for leftover turkey melts. While you are searching your mom’s fridge for gruyere, your weird Uncle Steve might ask to “check his fantasy team.” You and your uncle might have a different idea of what a fantasy team is, and you could get the leftover spyware and bloatware that his surfing has put on your laptop. 

A few items to help you with your potentially “over-shared” device: 

  • Make certain your device quickly locks when not in use. This is easy on phones, but on laptops you may want to set it to the minimum setting for the holidays. 
  • Close your devices and put them away if you won’t be using them for a while. Not that anyone is going to do anything to them, but gravy in the keyboard is just as problematic as privacy loss. 
  • If your device is running the Jackbox game or your phone someone got volunteered to play Heads Up!. Just make certain that you get it back at the end of the game. It is easy after a few glasses of wine to forget that your work laptop with all your year-end data is still sitting by the fire when midnight rolls around. 

 So while your uncle or cousin may not be trying to hack your device themselves, they are not going to be as concerned as you about what sites they visit and what fun new games they download. It is the season of giving, but I think you should be a bit selfish with your devices. 

Stay safe and stay private this holiday season!

CMMC and Cloud Compliance for Mid-Market Companies

The Cybersecurity Maturity Model Certification (CMMC) is a new and still developing standard for measuring a company’s cybersecurity effectiveness. It has been developed by the Department of Defense to measure and rate the cybersecurity practices of the Defense Industrial Base (DIB) who are supplying services to the DoD. 

While the CMMC only applies to DoD contractors, it is based on NIST CSF and NIST SP 800-171. These NIST frameworks are used across all industries to help companies gauge their cybersecurity effectiveness. CMMC combines NIST and other standards into a unified standard for cybersecurity, which can be applied to any company that wants to method for achieving higher levels of cybersecurity over time. 

CMMC is simply divided into five levels to allow organizations to put measures in place to reach the minimum cybersecurity necessary to protect customer data. The addition of a third-party audit organization (3PAO) certification provides proof that any organization working to achieve a certain CMMC level has the proper security measures in place.  

The five maturity levels range from “Basic Cybersecurity Hygiene” to “Advanced/Progressive.” Each maturity level includes progressively more demanding process and practice requirements to achieve the certification level. 

Click To Download

Most mid-market and SMB companies will never need to go beyond Level 3 in the CMMC model unless they are doing work for the Federal government or another customer that maintains highly sensitive data and processes.  

In addition to the level, there are 171 practices and 5 processes across the five levels of CMMC maturity. These practices and processes are organized into 17 capability domains to make them more manageable. 

Looking at the number of practices and the capability domains can seem daunting. Since the CMMC and NIST are highly related, you can organize the CMMC Capability into the NIST Core Functions and then think about how you manage your cloud compliance to the CMMC levels by the functions. 

CMMC and the Cloud 

Since most mid-market companies are moving or have moved all their IT operations to the cloud, it is helpful to think of the CMMC in that context. If you move all your IT operations to the cloud, do you even need to worry about cybersecurity maturity? The answer is “yes”, but the good news is that the cloud and SaaS providers with whom you work will take on much of the cybersecurity burden and make achieving higher levels of CMMC easier. 

Looking at the following table, you can see that moving to the cloud allows a company to “outsource” much of its burden of CMMC requirements to the cloud provider. It is important as you look at a cloud or SaaS provider to know whether they are CMMC compliant themselves. You can use this as a framework to analyze whether they are following the necessary steps to be a partner in your CMMC success. 

CMMC compliance of cloud operations is very achievable for mid-market companies. The key to success is breaking the compliance process into smaller pieces and setting goals for achieving each level. Working with a company that can help you manage the project and work through implementing the needed security standards can make the process much easier and the likelihood of the success of the program much higher.