Have you ever considered the network security vulnerabilities that your business may be exposed to? Whether these weaknesses exist inside your perimeter or out, it is imperative to identify and deal with any type of system access intrusion event that your network may encounter. This could range from a brute force attack to a social engineering attack.
When you and everyone else in your business remain vigilant about these attacks, you’ll be more able to defend the network against the most common vulnerabilities.
Hackers, spammers, and scammers are becoming more sophisticated than ever. Anytime your business publishes a person’s name, email address, and photo on a website, it provides a blatant weak spot in network security that anyone can take advantage of.
The information included can even give potential hackers an entire list of usernames to try and crack. Many companies have inside email addresses along the lines of JohnD@company.com or @DoeJane@company.com. Anyone who sees a list of your employee’s names can easily start trying to crack your network simply by trying variations on this theme. If those are the usernames utilized for emails, they are often also the usernames used to log in to the network itself.
When you keep this information out of public knowledge, potential hackers now need to work harder to find a point of entry or way to access an account. Making it that much harder for them may lead to them looking for an easier victim elsewhere. You’ll reduce the likelihood of a social engineering attack (the most common form of cyber attack) and protect your end users.
When end users have administrator access to their desktop PC, they are able to download and install applications without interruption. This poses a major security risk for the data on your network.
For example — a user with administrative privileges could decide to download Dropbox and sync a main file server for the business with his or her own personal Dropbox storage account. Once this is done, the user in question could make off with confidential or essential company information without anyone being the wiser.
It may seem silly to protect against these vulnerabilities. After all, if a particular user has been granted administrator access, it’s usually because they are considered trustworthy. Nonetheless, if someone does steal that person’s login information, they can do a lot less damage without administrator access.
For businesses that want to be absolutely sure that they aren’t unintentionally allowing an end user the ability to install a rogue software package, it is a best practice to disallow administrator access for end users unless absolutely necessary.
One of the most common IT security issues that small businesses deal with is their external facing web assets. More specifically, many businesses have chosen to implement the popular WordPress content management system as a way to deliver information to their visitors. WordPress is currently one of the most popular content management systems in the world — which makes it one of the most common targets for those looking to steal information.
WordPress does have a few problems. One of the biggest is the fact that you must rigorously work to ensure that your blog is kept up to date. Security weaknesses (and updates that help remove those weaknesses or protect against their exploitation) are discovered weekly. Not only is the WordPress install itself vulnerable, the plugins published for WordPress could also expose your website to related attacks.
There are websites that can help scan your WP blog for weak and exploitable code, making it easier to find and fix potential security issues. Even if you don’t use WordPress itself, you’ll still want to ensure that your web-facing apps are always up to date. Otherwise, you risk falling through the cracks.
IT security policies exist for a reason. When you require complex passwords, regular password updates, and stringent group policies that lock down exploitable features of the desktop PC, you can ensure that your environment is operating at its most optimal state.
When you allow the inmates to run the asylum, you risk losing all control of your IT policies. This makes your IT support provider’s job much harder, as they will spend more time reacting to problems as they appear than they will being proactive and keeping those problems from happening in the first place.
At BACS, we are experts at network security policies. We’ll work with you to decide the most important security requirements for your business, whether it’s an SMB or a large enterprise, and ensure those policies are implemented correctly. Even better, we can grow with your business, scaling up to meet your changing needs and acting as a true partner, instead of just another IT support staff. Interested in learning more? Click the banner below or contact us by phone at (650) 887-4601.
Published on 8th January 2016 by James Berger.