Cyber hygiene measures are extremely necessary, regardless of the type of organization, whether we are talking about multinationals, SMEs, government institutions or even hospitals. Following simple rules can often thwart very complex cyber-attacks.
According to a recent Microsoft report, 99% of cyber-attacks can be prevented by implementing basic cyber hygiene measures. Below are ten measures considered essential by the M247 team and presented in order of importance:
- Endpoint Security: Endpoint devices such as laptops, smartphones, and tablets are vulnerable access points for cyber-attacks. Implementing a robust endpoint security solution is critical to protecting these devices and their data. A PwC report from 2022 shows that approximately 19% of all Romanian employees (two out of ten) work exclusively remotely. As a result, securing end devices becomes a necessity. There are many such solutions. Microsoft Defender for Endpoint, for example, is a cross-platform, end-to-end solution that uses artificial intelligence to secure Windows, macOS, Linux, Android, iOS, and IoT devices;
- Zero Trust (Never trust, always verify): Zero Trust is a cybersecurity model that assumes that no device or user on the network is trusted by default. Essentially, this model rejects the conventional idea that once an entity or device has gained access to the network, it is considered trusted and can access resources freely. Instead, Zero Trust assumes that access must be granted and validated on an ongoing basis, based on the identity and context of each access. The Zero Trust model is based on multiple solutions and technologies: continuous authentication, network segmentation, privileged account management, etc.;
- Multi-Factor Authentication (MFA): Multi-factor authentication (2FA or MFA) adds an extra layer of security by requiring users to provide multiple forms of authentication, such as a password, a unique code generated from a mobile app or a hardware token. This makes unauthorized access much more difficult. Experts believe that multi-factor authentication should be standard for any access to an organization’s digital resources;
- Regular Back-up and Data Redundancy: Making regular back-ups and storing them in a safe place is essential to ensure data recovery in case of data loss or cyber-attack. Also, implementing data redundancy in various geographic locations provides additional protection against data loss. M247 Backup as a Service can be a simple and effective choice for establishing a coherent backup policy;
- Single Sign-On (SSO): Using a single sign-on solution allows users to access multiple applications and services with the same login. This not only improves the user experience, but also reduces the risk of password compromise;
- Applying Security Patches and Updates: Security vulnerabilities are often exploited by attackers to penetrate systems. By promptly applying security patches and updates, companies can fix these vulnerabilities and reduce the risk of cyber-attacks;Pay attention to this chapter, because many basic software products, especially from the Microsoft portfolio, periodically remain without support, which means they will no longer benefit from Security updates and become vulnerable to attacks. For example, in January 2024, an operating system such as Windows Server 2008 was left without support;
- Continuous Security Monitoring: Implementing continuous security monitoring solutions helps to quickly detect and respond to cyber threats in real time. This may include monitoring network traffic, analyzing logs and using intrusion detection solutions;
- Educating and Training Users: Users are often the most vulnerable component of the security infrastructure. Through education and regular training on cybersecurity practices, companies can reduce the risk of falls or compromises caused by human error. Bitdefender warns that Romania had five times more phishing attacks in 2023 and that many spread due to user negligence. They should be instructed not to access suspicious links embedded in e-mails or open files from suspicious e-mails. We also recommend periodic testing of employees’ knowledge and vigilance, by using specific Breach and Attack Simulation (BAS) solutions;
- Data Encryption: Encryption of sensitive data is an essential measure to protect it during transmission and storage. The use of strong encryption algorithms ensures that data is inaccessible to unauthorized persons, even if intercepted;
- Regularly Assess and Review Security Policies: Cyber risks are constantly evolving, so it’s important for companies to regularly review and update their security policies to ensure they remain relevant and effective in the face of new threats.
Protecting users’ IT infrastructure and company data against cyber threats requires a comprehensive and proactive approach. No one can say they are 100% secure, especially since the threats themselves are evolving at a fast pace. Adopting essential cyber hygiene measures can go a long way in strengthening security and protecting your business against cyber-attacks in an increasingly dangerous digital world.
If you have any further questions or would like further information on our MSecure cyber security services, contact us today https://m247.com/eu/services/msecure/
