por Rebeca | May 6, 2021 | Ciberseguridad, Noticias, Soffid
Today is World Password Day. Every year on the first Thursday in May World Password Day promotes better password habits. Despite what is going on in the world this might be the most important Password Day there has been.
With so many of us working from home our cybersecurity will be stretched to the limit. The basis of great cybersecurity is using strong passwords. So to a good way of improving your security is making sure employees are using strong passwords for all accounts your business uses.
Why is World Password Day so important?
Well despite all the warnings about using the same weak passwords on our accounts, we are still doing it. We are still making it easy for cybercriminals to hack into our accounts. If a hacker gets access to one account and you use that password across different accounts, they now have access to all of them.
A survey held in the UK by password manager LastPass found some shocking behaviours around using the same password.
- 92% know that using the same or a variation of the same password is a risk, but:
- 50% of us do it regardless!
Passwords are now an expected and typical part of our data-driven online lives. In today’s digital culture, it’s not unusual to need a password for everything—from accessing your smartphone, to signing into your remote workspace, to checking your bank statements, and more. We’ve all grown used to entering passwords dozens of times per day, and because of this, we often take passwords for granted and forget how crucial they are.
With that in mind, what steps can you take to ensure that your personal data is protected at all times?
Consider a password overhaul—at home and at work
We know… just the mere thought of coming up with (and remembering) yet another new password is daunting. The average person has about 100 different passwords for the various tools, apps, websites, and online services they use on a regular basis. With so many passwords to keep track of, those familiar “Update Password” prompts tend to get bothersome.
But, unfortunately, we live in a world of constant hacking attempts and security breaches. While changing passwords may be inconvenient at times, following this password best practice can help prevent the following data catastrophes:
- Giving hackers easy access to your most sensitive accounts
- Breaches to multiple accounts that share the same or similar passwords
- Attacks by keystroke loggers who steal common login credentials
- Loss of data through shared (and easily stolen) passwords
Although it requires time and patience, password protection is one of the most important things you can do to safeguard your personal, professional, and sensitive data. The list below includes four easy and practical tips for creating better password policies.
1. Increase the complexity and length of each password
There’s a reason that websites and online services provide so much direction when prompting users to create new passwords. Variation in both the complexity and length really does matter when it comes to protecting your accounts. Always incorporate both upper and lowercase letters, numbers, special characters, and symbols into each password you create.
When used in combination, complexity and length make passwords much harder to guess at random. This tactic also prevents users from relying on common phrases or personal identifiers (such as date of birth) when making new passwords. A password that contains only lowercase letters of a simple phrase is much more vulnerable than a complex combination of different characters.
2. Use a password manager
Password management software takes some of the brunt out of remembering the many different combinations you use around the internet. Generally, a password manager requires the creation of one master password. Then, you’ll be given the option to connect different logins that are then placed into your password “vault.”
Many password managers also encrypt passwords to create an additional layer of protection. This means that once you’re logged into the password manager, you may be able to login automatically to different websites, but the exact characters of your unique passwords aren’t always visible.
3. Never store passwords in plain sight
Although it’s tempting, you should never record passwords on paper or in plain sight somewhere on your desktop (such as on a notes app). These methods are easy to spot, which makes them even easier to steal. Additionally, it’s not very difficult to lose, misplace, or throw away passwords that you store on paper.
If you ever need to share passwords or login credentials with another individual (perhaps a family member or an approved coworker), always choose a secure method. Password management software also comes in handy when you need a secure way to share passwords.
4. Use multi-factor authentication wherever possible
Strong passwords make a big difference, but sometimes, additional security is necessary. Multi-factor authentication (MFA) is the process of protecting your digital password with a physical form of identification. For example, when you enter your password into an online account like Gmail, you may receive a code to your mobile phone that you’ll have to enter for an extra line of security. MFA is an effective way to prevent cybercriminals from accessing passwords via third party online systems.
Multi-factor authentication can be conducted in a variety of ways—it might include a quick fingerprint scan, a phone call, a text message, or a code. While MFA does add another roadblock to accessing your account, it’s a simple, yet powerful way to strengthen data security.
Enhancing your unique passwords is just one of the many ways that you can lock down any potential vulnerabilities and prevent cybercriminals from accessing your information.
Sources:
(1) Infotech
(2) Techsecurity
por Rebeca | Abr 28, 2021 | Ciberseguridad, Noticias
Today’s network-dependent organization faces an array of challenges and threats. Information and its critical role manifest in many different ways and formats, and are subject to countless outlets for distribution and sharing. Organizations find themselves balancing several factors.
- How do you properly manage and protect the information within the confines of an organization’s best interest and regulatory environment while still taking advantage of new and disruptive technologies?
- How do you address not only risks on the edges of the next technological advance but also within the core fundamentals of information technology management? There are daily challenges behind the mundane tasks of managing a modern information technology environment.
While trust is a major element in cyber security, it can’t be assumed completely. Here are some ways to evaluate trust in your organization so you can make adjustments as needed.
Evaluate How Your Business Assumes Trust
People with cyber security contract jobs will almost always suggest limiting access to only certain users who need the information to do their jobs. By allowing any given user access to the information they don’t necessarily need, you’re assuming trust that they won’t use the information maliciously. Professionals with a cyber security career will evaluate this assumption of trust throughout the organization in order to evaluate the possible risks and consequences. Many times access controls have to be implemented if there’s the potential for a major data breach.
Determine Your Risk Levels
Once your assumptions of trust are evaluated, you have to determine what risks you’re willing to take. If all employees have access to confidential financial or business information, what could possibly go wrong? Most of the time the list of cons is much longer than the list of pros, so hiring people for cyber security contract jobs to limit access is typically the best option. Some risks aren’t worth taking, no matter how much you want to trust your employees.
Cyber Security Education is Invaluable
We’ve talked a lot about not necessarily trusting employees with confidential information, but one thing you can do to build trust, even more, is offering cyber security education. Employees may not know the ramifications of every action they take online. People with cyber and network security jobs can educate them on what can happen in different situations and how the results directly impact them. Whether you trust your employees currently or not, educating them on cyber security is invaluable for giving you peace of mind if nothing else.
In conclusion, the Internet population, network-connected devices, and threats equal to, and perhaps exceed, our dependence on the modern network. In order to continue prospering from the use of this technology, the all organizations must address this challenge. Soffid is a natural partner in any enterprise cybersecurity strategy, because the network platform plays an important role in this environment. For your organization to keep pace with the dynamic environment, you must learn to use the network to achieve trust, gain visibility, and provide resiliency in your enterprise.
Sources:
(1) Researchgate.com
(2) Information Security
por Rebeca | Abr 21, 2021 | Recursos, Soffid
The rise in remote-work has accelerated the need for organizations to change how they do business. One of the biggest challenges they face is having visibility in securing the business without compromising workforce productivity and user experience. They also face regulatory compliance pressures, with 66% of organizations expecting to spend more in this area.
IGA is the branch of identity and access management that deals with making appropriate access decisions. It allows your company to embrace the benefits of hyper-connectivity while ensuring that only the right people have access to the right things at the right times. When it’s done right, IGA makes security easier and gives you valuable insights about employee activity and needs.
The digital workplace brings constant change, innovation, and technology updates. In this new work environment, employees must be agile and innovative to meet customer expectations for a superior experience, and organizations must empower employees to make the right decisions and find new business opportunities.
The challenge for organizations is to attract and retain the right people with the right skills for the digital workplace—and give them the right digital tools to boost their productivity.
The benefits of moving to a digital workplace far outweigh the costs. These benefits include attracting the best talent; increasing employee productivity, satisfaction, and retention; and using cutting-edge communications tools. For the organization, the digital workplace breaks down silos and other barriers to employee productivity. At the same time, digital transformation brings more significant information security challenges, such as increased vulnerabilities that attackers can exploit.
The right identity governance and administration (IGA) solution can help an organization implement a zero-trust framework to enable the digital workplace. IGA bolsters the zero-trust security model by managing access based on profiles of users, devices, and services. It provides visibility into user identity and privileges, and it controls access to apps and data, thereby minimizing damage from attacks.
IGA also provides visibility into cloud-based applications. An IGA solution can automate provisioning and deprovisioning for the joiner, mover, and leaver scenarios. The joiner scenario is when the employee is first recruited, the mover is when the employee moves to another position within the company, and the leaver is when the employee leaves the company. By automating the process for each scenario, organizations can avoid mistakes often caused by manual processes. These mistakes can lead to additional costs as well as security breaches.
IGA also provides a role-based access policy. The access granted is based on the role that the employee performs in the organization. He or she is only allowed the access required by that role. When the employee changes roles, the access changes accordingly.
Do you need help with digital access management in your company? we can help you
por Rebeca | Abr 14, 2021 | Soffid
The CISO ( Chief Information Security Officer ) is a leadership position responsible for: Establishing the right security and governance practices, Enabling a framework for risk-free and scalable business operations in the challenging business landscape,… The position of a Chief Information Security Officer (CISO) can take a variety of job tasks and responsibilities depending on the size, hierarchy, industry vertical and compliance regulations applicable to the organization.
In 2020, a world inexorably going digital was sped up by COVID-19, necessitating businesses to enable remote workforces overnight, without planning or preparation. This change required chief information security officers (CISOs) to ensure digital security on the go, simultaneously reckoning with new and emerging threats, while ensuring business continuity in a workplace that now featured a multiplicity of systems, networks, devices, programs, processes and overflowing information.
With the rise of digital transformation initiatives in 2020, a Chief Information Security Officer’s (CISO) already stressful work environment has become even more complex. A post-pandemic world has spawned other challenges for security professionals with the rise of remote work—like making sure data remained secure in an environment that wasn’t constantly monitored, Zoom hacks, secure API integrations, and dozens of other issues. CISO’s are facing more scrutiny about security posture from the Board of Directors than ever.
CISO’s needed to be on the top of their game—because, in addition to those high-risk challenges, countless businesses found themselves fast-forwarding their digital transformation initiatives to adapt to the new normal. 2020 has been coined as the year of the great accelerator because initiatives that had been put on hold were now suddenly necessary to support remote work. With the lack of in-person face time, combined with security risks, many businesses were playing catch up as threat models and control points changed, and they seemed always to find themselves one step behind.
Get here more information about A CISO’s 2021 Cybersecurity Wishlist
We can help CISOs to make their work easier. Soffid 3 provides the most intuitive and user-friendly interface, making the transition smooth and convenient. Proceedings are more flexible, so that you will have more committed users. Shall we talk? (más…)
por Rebeca | Abr 7, 2021 | Sin Categoria
No one wants a security breach to happen, but the media will be sure to pick it up when it does. By then, it is too late. Millions of dollars in fines or ransom notes later, and with a tarnished marketplace reputation, the company or government agency wishes they had paid more attention to their security protocols.
One way to achieve higher security is to instill a proper Privileged Access Management (PAM) initiative into the cybersecurity workflow. PAM is the process of determining who has access to what types of information as it creates an integrated view of risk, threats, and controls. PAM incorporates all-encompassing methodologies for how to use identities securely, how to enable logging and auditing for privileged identities for the quickest cyberattack response, and how to define what is privilege and what is not for an organization. In other words, PAM refers to a multi-dimensional cybersecurity strategy involving processes, technology, and people that aims to secure and monitor both human and non-human (machine)-privileged activities and identities throughout an organization’s IT landscape. For it to be successful, any such system has to be a part of the entity’s culture.
Privileged Access Management (PAM) helps organisations provide secure access to critical applications and data by addressing the very first security layer – the passwords.
Why is this important?
For hackers getting access to Admin or super user passwords is like hitting the goldmine – instant access to an organisations most critical assets and potentially right across the network
Key benefits
There are many benefits of a robust PAM system. Its effectiveness is enhanced with the knowledge of how to determine risk tiers, how guidelines are established, and best practices for implementing procedures, including how to overcome team-level resistance. Not having a protective system is imprudent. PAM providers offer various methods that achieve comparable results and benefits.
- It sets up the equivalent of a barrier wall to guard against attacks.
- It helps mitigate risk by ensuring compliance and confirmation with integrity.
- It improves IT efficiency for application teams by increasing efficiency and enabling seamless user workflows.
- It integrates with other tools to further enhance the organization’s cyber maturity as it creates more layers of security.
- It acts as a centralized system with clean dashboards, reports on systems in place, and an AI-assisted subsystem to provide safety based on user profile and risk factors.
Tools
Key features include a layering of sound, proven security protocols atop hardware, software, technology assists, and culture shifts.
- One key protocol is granting the least privilege possible while still getting the job done.
- Storing multiple-use passwords is dangerous.
- Leveraging AI decreases team member “slips” through automated monitoring, reporting to dashboards and real time alerts that are also used in many industries’ audits.
- Training must include accountability and responsibility, even using screen-recording capabilities to train entry-level resources and monitor third party vendor access to protect the organization.
Sometimes losing a customer or a breach itself will be the catalyst for establishing new and better guidelines. Ideally, a report showing minor violations ahead of a problem would trigger a new guideline. Sometimes the Chief Information Security Officer (CISO) needs an inventory in the form of a “gap” analysis of where the company is versus where it would like to be protection-wise. From there, guidelines and levels of access can be created, tightened and enforced.
Determining appropriate levels of access across the enterprise might seem numbingly painful and time consuming. However, access identifiers must travel the full length and breadth of the organization and are a critical preemptive measure against cyberattacks. Sometimes the step is rushed in the attempt to do something — anything, to stop attackers. Industry PAM suppliers such as CyberArk, Centrify, and Thycotic offer company-specific combinations of determining appropriate privileged access levels that start at the tippy top of the IT system (the CISO or CIO for example) and rain down across and through workstations within or among network domains. The contradiction of job title against access point challenges all systems. Cyber attackers have infiltrated structures as large as Yahoo and the U.S. Office of Personnel Management by finding and exploiting privileged credentials. The exact level of access comes down to adhering to a few generally accepted best practices.
Start by answering the questions below to build a tight, impenetrable system:
- Who has access to critical infrastructure, systems, and data? Build access levels from the ground up and top down. Study automatically updated reports daily. A reputable PAM cloud or on-premise solution can inform this step.
- Does the company use the tools/solutions they have efficiently? Are they making time to have meetings, train the troops, and enforce the protocols in place? How mature are users’ knowledge base and how recent are the tools? Is everyone on board to secure the company’s digital assets?
- Is there an adequate budget for purchasing recognized Privileged Access Management software and the support that comes with it?
- How do external audit findings reflect compliance? Examples are General Data Protection Regulation (GDPR) for the EU and Network Information Service (NIS) in the U.S. Are failures quickly fixed?
- Is management at all levels supporting or thwarting safety measures? Getting the job done is not as important as getting the job done safely.
There are many challenges to maintaining a safe yet productive and efficient IT environment. Surprisingly, one of the most challenging roadblocks with Privileged Access Management systems is not making the financial investment to purchase them. The greater challenge is often overcoming employees’ general resistance to change and “adding one more thing” to complete their day-to-day activities. Whether for budgetary, personnel, or other reasons, this resistance puts the company at risk. Meanwhile, as user-friendly and feature-rich as the best PAM systems are, the ultimate test is micro-managing all the way down to the customer-facing employees. These are the bastions of protection against internal (unfortunately) and external marauder/cyber attackers chipping against the walls of the IT fortress. Stretched team managers do their best to hold their team members accountable, but they cannot afford to fire their noncompliant employees. The work must be done, so the task often becomes one of negotiating with an employee. “Here are ten things we need you to do. Do two now, and we’ll work on the next ones in coming weeks.”
But coming weeks may bring newer protocols. The task is ongoing, because next week may require more and different responses and procedures depending on the attackers’ targets, be it Big Data, the Cloud, DevOps, Databases, the Infrastructure, or Network Devices. Last month’s Multi-Factor Authentication (MFA) might need strengthening. As quickly as the Bad Guys change their strategies, the technologies to keep them out must change apace.
Sources:
(1) Security Magazine
(2) Security Intelligence
