\nIn this article, we will discuss the worst cybersecurity practices you might have seen, practiced, or been hit for.<\/p>\n
Bad Practice #1: \u201dIt Won't Happen to Me\u201d<\/h2>\n
Nobody likes to think about possible bad things happening in their lives. These are troubling thoughts that don't make your life easier, and nobody says that life is easy in the first place. But how does that habit turn out to be one of the worst cybersecurity practices?<\/p>\n
You see, your network is under constant attack. Malefactors seek loopholes, there are bots that search for open ports, and dozens of phishing emails are sent to you and your end users daily.
\nAnd the chances that at least one of these attacks will be successful are alarmingly high. At this point, some might say that such attacks are aimed exclusively at enterprise-grade businesses, and \u201dIt won't happen to my small company.\u201d However, such an opinion is a big mistake.<\/p>\n
Yes, cybercriminals are aiming for enterprise-grade companies for the enterprise-grade ransom. But they typically face enterprise-grade cybersecurity policies and tech. When we talk about small and medium-sized companies, yes, the average amount of ransom paid is probably smaller, but the chances that smaller companies will have thorough cyber-protection are also significantly lower.<\/p>\n
According to Purplesec<\/a>, 44% of small businesses were hit by ransomware at least once in previous years, and 48% were hit multiple times. And about 70% of small businesses are not protected well enough against cyberattacks.<\/p>\n So why exactly does this \u201dit won't happen to us\u201d thought emerge? It's because of the expected expenses and the complexity of adopting thorough cybersecurity solutions. Yes, it's expensive and you won't have budgeted for the full-on SIEM suite and an additional security engineer. And then comes the complexity factor. You need to audit, fix, maintain, manage, and set up, and do this regularly.<\/p>\n In the end, most people tend to start thinking, \u201dWell, it's too expensive and complex for us. And after all, attacks are aimed at enterprises.\u201d<\/p>\n So, you've been breached. You have successfully recovered and fixed the consequences. Some tend to think that this will be enough, since you've recovered. Not so. At this point, what you should do is to perform a security audit to find and fix the flaws in your network that made the attack possible.<\/p>\n On the other hand, you shouldn\u2019t be ignorant about the attacks happening to others. Check out the news and determine whether there are new attack patterns that you can learn from to protect your infrastructure.<\/p>\n Attacks evolve and the malefactors are using new ways to sneak through your defenses each year. And the cybersecurity market has answers to this. New tools and approaches emerge, not to mention the new complex platforms that can defend your infrastructure as a whole.<\/p>\n So what you really shouldn't do is stay with the same \u201dgood old\u201d apps that you've been using for ages.<\/p>\n Your password policy is the first frontier for most attacks aimed at your network, your email services, and your cloud applications. As soon as you start thinking, \u201dI\u2019ll use \u2019123456admin\u2019 as the password here, since no one will ever try to intrude into this service,\u201d you're laying yourself open to an upcoming disaster.<\/p>\n Also, there are two more worst password security<\/a> practices that you should be aware of:<\/p>\n The poster pack includes:<\/p>\n Once your passwords are secure and strong, your network is well protected, and your applications are up-to-date, it's time to up-level your security policies. You should create proper documentation, including your incident response plans and postmortems of recent incidents.<\/p>\n The reason for this is simple. Ask yourself, do you have an action plan against a successful ransomware intrusion<\/a>? And do your end users know how to act if they notice such an intrusion, and whom to notify? If you have a well-documented and acknowledged incident response plan, and your employees and tech staffers are trained in accordance with it, only then you will be able to notice the attack in time and minimize its consequences.<\/p>\n Some CEOs and CTOs tend to follow every technological trend on the market. And sometimes this makes your network, infrastructure, and application portfolio a chaotic and unmanageable mess. You will face dozens of integrations, a lot of interconnected security rules, and more passwords for the end users than you can safely manage.<\/p>\n All that raises the number of possible attack vectors. Don\u2019t get me wrong, though; you should not be afraid of new technology. Most times it\u2019s essential when you need to up-level your company\u2019s operational potential. It\u2019s adopting it without a proper plan in the first place that makes things uncontrollable.<\/p>\n Nowadays, even when you are running a fairly small organization, you are managing at least a dozen interconnected cloud and local applications, and network services. Not to mention that after the pandemic there is a strong culture of working from home, which means that your resources are decentralized.<\/p>\n Thus, you are either overattentive to what happens to your network, or you \u201dset it and forget it\u201d, until some lucky malefactor finds a hole in your infrastructure and uses it.<\/p>\n Further reading<\/span> IT Security Audit: A Comprehensive Guide<\/a><\/p>\n Some say, \u201dIt's always DNS,\u201d when their network is down. Others say, \u201cIt's always end users,\u201d when an attack happens. Both these parties are right, at least to some extent.<\/p>\n Many attacks are aimed at end users in the hope that they lack training. There are different types of such attacks: phishing<\/a> and spear-phishing<\/a> emails that are designed to fool people into downloading corrupted files; brute force attacks on weak passwords; and social engineering to discover the strong ones, to name just a few examples.<\/p>\n And normal people focused on doing their jobs rather than on everyday cybersecurity training are simply not prepared for all this. So it's unfair to make fun of or be angry with users who fail to comply with standards and practices. They have no idea about such practices in the first place.<\/p>\n Without proper education and regular training, your users will be the biggest glaring hole in your cybersecurity. Although experienced system administrators know that, even with proper training, most users tend to forget things and mix them up, at least some of them will pay attention to the emails they open next time.<\/p>\n Further reading<\/span> Ransomware Awareness Training: How Are You Talking to Customers About Ransomware?<\/a><\/p>\n Building a production environment with no setup or tested backups is like jumping out of a plane with only one parachute. Nine times out of ten it will open, for sure, but the tenth jump won't be fun.<\/p>\n No matter how secure your network is or how good your users are in not downloading corrupted files, there are still chances of being hacked. And they are quite high, as you can see from the statistics above. Your backup and disaster recovery practices<\/a> are the last, the essential, line of defense in the cybersecurity world.<\/p>\nBad Practice #2: Being Careless About Recent Attacks<\/h2>\n
Bad Practice #3: Staying Basic<\/h2>\n
Bad Practice #4: Poor Password Security Rules<\/h2>\n
\n
\n
![\"CTA\"](\"https:\/\/no-cache.hubspot.com\/cta\/default\/5442029\/88fb277b-8296-40db-9698-b362eb68ccaa.png\")
<\/a><\/span><\/span>\n<\/div>\n![\"Whitepaper](\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2020\/04\/MSPs-Educational-Posters-on-Password-Security.png\")
<\/div>\n<\/div>\nBad Practice #5: No Proper Documentation<\/h2>\n
Bad Practice #6: Mindless Adoption of New Technology<\/h2>\n
Bad Practice #7: No Audits or Assessments<\/h2>\n
Bad Practice #8: No Security Awareness Training in Place<\/h2>\n
The Worst Practice: No Disaster Recovery<\/h2>\n
![\"CTA\"](\"https:\/\/no-cache.hubspot.com\/cta\/default\/5442029\/aa07fdb8-7776-46a5-9fa0-ec6e93f0f0a6.png\")
<\/a><\/span><\/span><\/div>\n