Cyber Security – Where To Start And Where To Stop?
Potential Entry Points Into Cyber Security
Cyber attacks lead to more significant damage in small and medium-sized enterprises. As a result, the topic of cyber security – as the logical counterpart to cyberattacks – is increasingly moving into the limelight. To make it easier to get started with this necessary protection – and thus with the topic of cyber security – practice-relevant, joint and essential security measures are taken below.
Get An Overview Of The System Landscape
The existing system landscape must first be known to find and implement suitable, sufficient, but efficient measures. Even if this requirement may seem relatively banal, many companies need to learn which systems and applications they operate and use. Of course, the methods and applications cannot be protected without this knowledge.
Separate Network Areas
After the overview has been created, the first step of the actual security follows network management. In principle, a network separation should be implemented. If possible, systems that can be accessed externally, such as web servers, email servers or similar, should be integrated into a demilitarized zone (DMZ). A DMZ is a network section that is restricted by firewalls and their regulations and from which no direct access to other internal systems is possible.
Use Secure Communication Channels
Once a network separation has been implemented, the issue of secure communication channels can be addressed. An attacker could read data and gain information if insecure or unencrypted channels are used. However, this requires some prerequisites, such as a so-called man-in-the-middle scenario, but is not impossible in practice.
Implement Orderly And Reliable Patch Management
The overview of the systems and applications used results in network security options. Of course, the methods and applications themselves should also be protected. This usually starts with the most fundamental problem – the lack of patch management.
Harden Systems
In addition to keeping the hardware and software up to date, basic measures for system hardening should also be implemented. Thus, only the required software should be available on all systems. New applications and system functionalities should be deactivated and uninstalled. Likewise, possible standard accounts should permanently be changed or even halted.
Require Secure Choice Of Passwords
Insecure passwords are a frequent and, unfortunately, often a straightforward gateway for attackers. Appropriate specifications can significantly prevent this danger for secure passwords. Organizational specifications for the safe design of passwords should be defined, which, in the best case, can also be implemented technically in the systems in a restrictive manner.
Secure Use Of Cloud Applications
For many companies – especially in times of digitization – the cloud environment is considered a panacea for various problems in IT operations. Individual applications, entire systems or even the entire data center can be outsourced to one or more cloud service providers. The advantages here are mostly the – sometimes supposed – higher availability, operational expenses not to be paid and simple administration. Disadvantages, such as dependencies, a fundamental threat to confidentiality, and the lack of direct influence or dependence on public Internet access, are often ignored.
Conclusion
Cyber security is not uniformly defined, and the term is not always welcomed. Hopefully, the article’s brief introduction and definition could shed some light on the darkness. Since many SMEs face the problem of finding the right way to get started with cyber security, eleven measures have been listed that every company can, should and must implement. However, these steps do not represent complete protection, but they are the most common and critical problem areas in practice.
