CS Nov-Dec 2020

More documents

Recommendations

Info

industry insights THE NEW ORDER IS NOW THE PERFECT TIME TO GET YOUR (I.T.) HOUSE IN ORDER? PAUL HARRIS, MANAGING DIRECTOR, PENTEST, OFFERS HIS THOUGHTS There's a lightbulb in the bathroom at home that's been burnt out for about eight months. It's always been on the list of things to fix, but I've either forgotten about it when at the shops or had more pressing things to do; after all, it wasn't really a big deal, especially when there are plenty of other bulbs working in the bathroom. I say 'wasn't' a big deal, as things changed. Lockdown happened. Spending all your time at home makes you more aware of the small, and not so small, jobs that need to be done around the house. Previously insignificant home improvement jobs start to play on your mind. The clock on the oven is out by three minutes, the living room door isn't quite sitting correctly, there's a small crack in one of the bathroom tiles, one of the kitchen chairs has been wobbly for years. Things you could easily dismiss and ignore before suddenly start to play on your mind, growing until they become critical issues. It's no surprise that people were queuing outside Ikea for over two hours on the first day after lockdown was eased. (To clarify, I wasn't one of them!) I usually go to great lengths to avoid doing the home improvement jobs, hence why the lightbulb has been out for so long, but during lockdown they have often given me a welcome distraction from what's going on in the outside world. I've even got around to tackling the big jobs, the ones I really hate, like cleaning out the garage. Paul Harris, managing director, Pentest. It's amazing the stuff you find when you do that: old games consoles you've not 16 computing security Nov/Dec 2020 @CSMagAndAwards www.computingsecurity.co.uk
industry insights seen in years, records that you never knew you had, a million and one Allen keys, an assortment of sports equipment, the traditional tin of Quality Street from the 80s, now containing screws and wall plugs, cables, and lots and lots of electronic wires and cables. Whilst some of this stuff is useful, most of it will either end up at the charity shop or the tip, but at the end of it all there's a great sense of satisfaction that you know where everything is and that everything is in order (for now at least). Organisations aren't so different and it's easy to collect a host of information technology 'stuff'. It's even easier to lose track of this technology as time goes on - especially as the company grows and people move on, vital knowledge can easily get lost along the way. But when it comes to organisations, the consequences of not knowing what you have or how it may be connected to the outside world can be dangerous, providing malicious threats with a potential way into your networks. KNOWING WHAT YOU HAVE One of the fundamental IT security challenges within organisations, especially larger ones, is the shadow IT 'visibility gap' between assumed or known infrastructure and what actually exists. Understanding this is a first vital step in developing a robust security posture for an organisation. After all, if you don't know a legitimate device or application exists on your network, how can you properly defend it? Similarly, if you are missing legitimate devices, you may also be missing unauthorised devices. Could any of these anonymous devices provide backdoors into the network, and perhaps leave your infrastructure exposed and vulnerable? "But I know exactly what I have on my network," I hear you say. Well, you'd be surprised. There have been plenty of cases where we have heard this, only to discover an unknown device or application on a network during an estate discovery investigation, whether it be a legacy server situated at a remote site, a website that has been put online as a test by an internal department, an IoT device plugged into your network by a member of staff, IT infrastructure inherited as part of an acquisition or an application that was meant to be internal, but is available to the internet. It can be hard to have a full oversight on what's truly sitting on your network. ASSESS THE RISK, PROTECT OR GET RID Like the stuff from my garage, once you know what you have, you need to decide whether it's still needed. If it is useful to the organisation, then you'll need to take the necessary steps to conduct an analysis of the security and data compliance risks, and to put in place effective measures that bring it in line with corporate policies. If it's not useful, then it's best to remove it from the network and from external view. But how do you go about securing a previously unknown device or application that you wish to keep on the network? Well, it will all depend on what you've found and the nature of the data it stores or processes, but there is one standard thing you should be checking as a matter of course. One of the easiest things you can do to improve security of a previously unknown device or application on your network is to make sure you have up-to-date versions of software where possible. If a device or application is running on an old version of software, then it is highly likely there will be security flaws present. Attackers are all too aware of the security vulnerabilities within unpatched software, meaning these could be potentially used to gain entry to a network and to ultimately exploit your organisation. STARTING WITH A CLEAN HOUSE There is no doubting that the coronavirus situation has been terrible. As businesses and as a society, we are likely to face more turbulence as we ease back towards normality, however that normal may look. But before the stresses, strains and busyness of this new 'normal' take over, I would argue that now is the perfect opportunity to step back, to take a look at some of the jobs we've always put off and to prepare our organisations for better times ahead. Gaining a full understanding of your IT estate should be considered one of these vital jobs and, as a company, we've seen first-hand that it's a job that many organisations have put off over the years. Yes, you want to be doing something more exciting, but it's not as painful as you may think; we do all the leg work for our clients. And, unless you know what you have and what the risks are, you won't be able to gain the peace of mind that your network is as secure as possible. www.computingsecurity.co.uk @CSMagAndAwards Nov/Dec 2020 computing security 17
Page 1 and 2: Computing Security Secure systems,
Page 3 and 4: comment TIME TO TAKE GDPR UP A GEAR
Page 5 and 6: Pragmatic and experienced risk mana
Page 7 and 8: editor's focus "Well trained staff
Page 9 and 10: health monitoring within the compan
Page 12 and 13: smishing SMISH, SMASH, BASH! A RELA
Page 14 and 15: smishing scams, while the Associati
Page 18 and 19: mergers & acquisitions HITTING THE
Page 20 and 21: Data privacy BEYOND THE EU-US PRIVA
Page 22 and 23: contact tracing WE HAVE CONTACT THE
Page 24 and 25: contact tracing smartphones in mind
Page 26 and 27: hacking surge HACKERS FOR HIRE HACK
Page 28 and 29: hacking surge Adrian Rowley, Gigamo
Page 30 and 31: threat intelligence APTS AND COVID-
Page 32 and 33: gender inequality TIME TO REBALANCE
Page 34 and 35: gender inequality equates to - and
Page 36: NEW Sensitive Data Discovery and Re

CS Nov-Dec 2020

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?