Three Common Business Mistakes Hackers Love to Take Advantage of
“90% of all data today was created in the last two years—that’s 2.5 quintillion bytes of data per day.” (Domo, Data Never Sleeps 5.0)
Did you know that you are managing one of the world’s most in-demand commodities? What is this hot commodity sitting within reach of your fingertips? It’s simple, complex, structured, and unstructured—it’s data. At the epicenter of the modern digital landscape, fueling the machines of modern industry, is data—and you are managing this data, day in and day out.
Data is the New Oil
Data is the hottest and fastest growing commodity in demand right now, and there are no indications that the production or demand of data will slow down any time soon.
Much like oil, data holds little value in its original state. Oil must be processed and refined into the consumable product that we recognize as plastic or gasoline. Businesses and consumers produce an incredible amount of structured and unstructured data on a daily basis. And similar to oil, data requires refining and processing in order to become the insights that are so heavily relied upon by businesses of today.
However, there is one group that values data in all its forms: hackers.
In 2017, the cost of data breaches hit $1.3 million for large businesses, which is an increase compared to $1.2 million for 2016. Large businesses are not the only ones bearing the high data breach costs. Small to medium-sized businesses are seeing an average cost closing in on $120,000 per incident. (Kaspersky Lab and B2B International, “IT Security: Cost Center or Strategic Investment?”) Data protection measures have never been more important than they are today.
Not all Press is Good Press
An alarming trend worth noting is the seemingly frequent and severe reports of cyberattacks making headlines over the past few years. Equifax, HBO, and Yahoo are among the organizations that quickly come to mind.
One of the most recent major data breaches featured Equifax and the revelation that may have compromised the financial futures of more than 143 million Americans. If you haven’t been watching the situation unfold, Equifax is a consumer credit agency that manages sensitive data ranging from social security numbers, driver’s licenses to addresses. Technology publication Wired reported a procedural failing where Equifax failed to update software components that were readily known to have security vulnerabilities, which ultimately led to scores of sensitive data being left open and vulnerable to attack or loss.
However, Equifax wasn’t the only one to recently face serious scrutiny over a major loss of sensitive data. HBO recently found itself in the heat of news spotlight, when it was discovered that more than 1.5 terabytes of data were stolen by a hacker identified as “Mr. Smith.” Among the stolen data, internal communications, marketing collateral, and unaired episodes from the popular HBO series, Game of Thrones. While there are no clear answers to the HBO breach, some media outlets like Digital Trends are reporting theories of outdated and insecure legacy systems as the culprit that exposed their security vulnerability. Hackers found their way through an outdated system, and then followed up by installing malware.
These high profile breaches demonstrate how easy it can be for hackers to take advantage of a system through security or policy vulnerabilities and human error.
In fact, in 2016, Yahoo faced serious criticism after a breach was disclosed two to three years after it occurred, where more than 500 million accounts were stolen. How did Yahoo find itself as the victim of one of the most expensive and wide-reaching data breaches? In one report by the Mercury News, the chief strategy officer of a San Francisco cybersecurity firm blamed a late implementation of encryption, late adoption of bug bounty programs, and a failure to implement automated password refreshes for Yahoo-users following the initial breach.
Whether you’re managing data for a small to medium-sized business or you’re managing data for a multi-million dollar global enterprise, there are many proactive ways to take back control of data protection within your organization.
Three Risky Mistakes You Don’t Want to Make
Here are three common mistakes that hackers love to take advantage of:
1. Outdated Security Training and Policies
What your employees don’t know can hurt your security and compliance initiatives. Are they using unsecured personal computers, tablets, mobile phones, smart watches or accessing their Internet of Things (IoT) devices on your network? The non-stop, 24/7 access makes it all the more important to not only ensure that you have a clear security policy in place, but it becomes all the more important that you separate user folders and control network access in order to better protect your data.
Consider offering regularly scheduled security training, not only on the proper handling of data, but also on organizational security policies. Data protection must be a team effort, requiring collaboration and full participation at every level of your organization.
If you are:
- Not securing or managing the endpoints within your IT infrastructure,
- Allowing the practice of shadow IT,
- Not properly controlling administrative access to your data,
Then, it’s time to reevaluate your data security hygiene, and take the necessary steps to update your security training and policies. Otherwise, you increase the risk that your data could be compromised.
2. You’re Using FTP or a Legacy File Transfer System
According to a recent FBI warning, hackers targeted many smaller sized medical facilities, including family and dental practices, if they were using file transfer protocol (FTP) as their mechanism of file transfer. And if an FBI warning isn’t enough to deter you, Debian announced that it will no longer support FTP services. Google’s Chrome browser seems to be moving in the same direction, as they recently announced their plan to label FTP as insecure.
The use of FTP or legacy file transfer systems are often designed over time for various specific file transfer needs, however both methods of file transfer are not sustainable or secure when it comes to the long term needs of a business operating in today’s high risk and fast-paced environment. While FTP can move a file from one location to another, it wasn’t designed with today’s data protection needs in mind. Legacy file transfer systems are sometimes highly customized. In the legacy system scenario, data security can be challenging without a centralized platform for data management and operational visibility.
Additionally, if your organization operates with a customized legacy system, and there are a limited amount of administrators with the skills and experience to manage it, your organization may be left vulnerable if there is any unexpected change—from employees illnesses to employee separation.
3. Not Providing the Proper Tools for the Job
Every day, your users are just trying to get the job done, often under deadlines and SLAs. If they can’t do it with the tools you provide them, they’ll download applications that they find on the Internet, turning to unvetted, unsanctioned tools to transfer sensitive data to partners, vendors, and other external parties over unsecured paths. And they aren’t just transferring work-related data. Your users are at work 9-12 hours per day. It’s understandable that they will send the latest kid-pics to grandma, forward mortgage documentation to their bank, or download that cool PDF of the truck they want to buy.
How to Stay off of a Hacker’s Favorite List with MFT
A good managed file transfer (MFT) platform can help you build the kind of IT infrastructure that makes things difficult for hackers. MFT can plug many of the holes in your security and help you protect your data, integrate legacy workflows and authentication systems, and provide oversight over your entire network, watching (or blocking) what’s coming into and going out of the network 24/7.
Managed File Transfer (MFT) is a very important defensive layer that is often overlooked or ignored based on a misconception of being unwieldy, expensive, or requiring new employee skillsets to manage it. An MFT platform can save you money by eliminating multiple, home-grown scripts to manage workflows, and multiple administrator logins to multiple, disparate systems. MFT allows you to monitor and control each of those systems and security layers all in one location.
Here’s a look at more of the MFT features that will help you keep the hackers away:
Use of Standard Secure Protocols
Secure protocols, such as SFTP, provide protections that plain FTP can’t, such as providing a single secure—and faster—transfer through firewalls. In SFTP, encryption can’t be disabled, as you can with FTP. And of course, you receive more information about the transfer through SFTP. HTTPS is also more secure than HTTP or plain FTP. An MFT solution should have all of these industry-standard protocols available to ensure your systems can communicate with each other and with external networks.
Monitor What is Happening on Your Network
Visibility into what is going on in your network is critical to maintaining security. MFT solutions can provide monitoring tools and dashboards for both real-time status and historical reporting. Not only file transfer activity, but user activity, administrator activity, server up/down time, and other file transfer-related information can be monitored through the MFT platform.
Knowing exactly what is transpiring on your network is key to preventing data breaches and other abuses of the network. A good MFT platform can show you exactly which user is transferring data, where/to whom they are transferring data, when they are transferring data, and what exactly they are transferring. Real-time activity monitoring, auditing, and reporting to track corporate file sharing, review statistics, and query data for reports is important to understanding what goes on in your network.
Never Store Data in the Demilitarized Zone (DMZ)
Many MFT solutions offer a “store and forward” method of transfers through the Demilitarized Zone (DMZ) which can put your data and internal network at risk. “Store and forward” refers to the way the DMZ does not store or process data, ensuring that data is secure behind a firewall ready for an MFT platform to process. A better MFT choice is a DMZ server that never stores file transfer data and never initializes access to the internal network. The server in the internal network should establish an outbound connection (a Peer Notification Channel) with the server in the DMZ. The connecting client communicates only with the DMZ server. The DMZ server does not forward the client’s connections; only the data is forwarded or passed through to the internal server without ever storing the data in the DMZ.
Use Data Wiping to Thoroughly Delete Data
Your MFT solution should have the option to configure data sanitization/ data wiping options to securely delete or purge the files by writing over the initial data using encrypted and/or pseudorandom data. Many government regulations and standards require data wiping to ensure the deleted data does not end up in the wrong hands.
Use Malware and DLP Tools at the Network Level
The Internet Content Adaptation Protocol (ICAP) is often used to implement virus scanning and Data Loss Prevention (DLP) tools at the edge of the network. These tools can be configured to permit or prevent file transfers based on your organization’s policies, preventing incoming malware from infiltrating the network. With the proper tools, you won’t expose your network to files containing malware, or share confidential or proprietary information.
Are you doing enough to keep the hackers away? Download our guide, “Is FTP Really Enough?” In our guide, learn about the critical challenges businesses face when they use FTP and how to better reduce data security risks and gain the optimal efficiency of your data.