10 months ago


human error Graham Mann,

human error Graham Mann, Encode Group UK: still too few board members with sufficient knowledge of cyber security. Nic Scott, Code42: provide an effective endpoint recovery system to ensure business continuity. Access to sensitive systems or privileged accounts within the environment is then managed through privileged password management and true least privilege solutions (where the user/process has the least privilege necessary to be productive). "Access to those additional layers is controlled simply and appropriately with additional authorisation being required in direct relation to the sensitivity of the resource being accessed. Each layer in the solution is simple and almost transparent to the user, aiding adoption and simplifying management," adds Chappell. NO FOOLPROOF SYSTEM Nic Scott, UK&I managing director, Code42, points to how cyber security today is a far more complex issue than just looking at preventive measures. "No single security measure is foolproof - after all, how many times have you heard security professionals say, 'It's not if, but when, you will get hacked?' "As a standard today, there should be twofactor authentication (2FA) protecting access to the corporate network - comprising of one strong password [usually made from letters and numbers] and some sort of biometric authentication, such as a fingerprint or a special code generated by a dedicated 2FA app. At the same time, you can't forget the importance of adequate training of staff on cyber security issues, in order to help minimise the insider threat. It is important to let employees know how ransomware, phishing and whaling attacks may present themselves, and how to be extra cautious when receiving downloadable files from unknown senders or familiar, yet unexpected, email requests from colleagues," says Scott. ENDPOINT RECOVERY SYSTEM "Finally, having erected the barricades and drawn up the drawbridge - e.g. set up firewalls, 2FA on the one hand and set up a staff training program to ensure adherence to security measures - there is one final step left, in order to complete the defensive preparations. And this is to provide an effective endpoint recovery system to ensure business continuity for those rare moments that the defences are breached." I.T. BEST PRACTICE Andrew Tang, security director, MTI Technology, is also a firm believer that all employees, irrespective of their seniority, must be taught IT best practice, and how best to safeguard against internal and external intrusions, with education extending beyond a simple explanation of guidelines and procedures. "Employees must be aware of the significant consequences that a breach of cybersecurity can have on the business generally. Everyone from the CIO through to junior members of the team should know that clicking a suspect link or opening an unknown attachment could set off a chain of events that may lead to reduced revenue, lost customers and a lower share price," states Tang. You cannot take a cookie-cutter approach to this education, though. "Content for board directors will obviously differ to that for IT workers. It should be focused on the specific technology they use in their roles." What authentication controls should be in place, in his view? "Employees should be educated on the importance of setting sophisticated passwords. Similarly, staff must be shown how variations of existing passwords are a source of vulnerability when used in other parts of the network." Two-factor authentication is also important, he points out. "This may involve employees entering a one-time passcode (OTP), in conjunction with their regular login details." Finally, only a small number of people within an organisation should be allowed to move freely through a company's system, Tang advises, reducing the potential for sensitive information falling into the wrong hands - either intentionally or by accident. 20 computing security March/April 2017 @CSMagAndAwards

MSc in Software and Systems Security flexible, part-time, professional education • programme in software and systems security leading to an MSc from the University of Oxford • choice of 30 different courses, each based around an intensive teaching week in Oxford • MSc requires 10 courses and a dissertation, with up to four years allowed for completion • applications welcome all year, with admissions in October, January, and April