Today (15th September 2020), is the 25th Anniversary of 1995 film “Hackers” was released. The cyber-thriller film was one of my first insights (as well as the other 1995 film “The Net” starring Sandra Bullock) to how the super information highway, the tool designed for free exchange of information and ideas could be used for crime.

In the movie, teenage hackers hack into the “Ellingson Mineral Company” to download corporate data, only to find evidence that the company’s computer security officer had created a virus that will capsize the company’s oil tanker fleet which he then blames the hackers for. The film showcases hacking techniques such as Phreaking (the practice of hacking telecommunications systems, especially to obtain free calls.) & Social Engineering (the use of deception to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes). So, what can we learn from this film that we can apply to today’s cyber security?

We can learn that corporate data is just as big as a commodity like gold or oil that needs to be protected from criminals. Whilst we might not see many phreaking attacks any more, there are many more ways for hackers to break in especially since technology, and therefore, hacking techniques have evolved and advanced so much more since 1995. So let’s use this anniversary as a reminder to review our IT security policies to try to minimise the risk of a cyber attack.

Here at Innov8 I.T., we often use an analogy that compares your I.T. infrastructure to a Castle from the Middle Ages… The Castle and it’s walls are your network, the hidden treasure being your corporate data and intellectual property, the firewall would be your moat, draw bridge, and guards controlling what and who is allowed in and hackers & cyber criminals are the dark knights trying to force their way in to steal your treasure! However, all these measures are useless if your staff are tricked into letting in a trojan horse.

Innov8 IT is taking this opportunity to go over our cyber security tips for each of our clients to secure their networks as much as possible. We welcome you to share these tips with your I.T. team so that they can review your company’s network.

1. Reviewing all file and folder permissions on file servers

Locking down corporate data to only the essential employees that need to access it decreases the chance of Data Loss.

2. Cleaning up Old & Generic User Accounts

This doesn’t just apply to Active Directory, it applies to every system (on premise and cloud) in your business that requires a login. Old & Generic User Accounts may be providing previous & disgruntled ex-employees access to your network and data. These accounts should be cleaned up, disabled and passwords changed as soon as possible.

3. Resetting the WiFi Password

Resetting the WiFi Password should be done often, usually once every 3 months and should be as complex as possible without using dictionary words. Another idea is to use a RADIUS server for authentication so that access based on user accounts and is revoked when an account is deactivated.

4. Verifying your MX, SPF & DMARC DNS records

Your MX records tells the world where and what server to deliver your emails to. SPF & DMARC records allow other email servers (providing they are configured correctly) to verify emails that come from your domain are really from your server and not from a hacker pretending to be you.

5. Enabling 2FA for all user accounts where possible

2FA (Two Factor Authentication) is a protocol designed to protect accounts from un-authorized access by requiring you to enter an additional code when you sign in. Having this enabled for all user accounts reduces the risk of hackers accessing your systems by adding an extra element to the login process.

6. Running a port scan on your network and externally on your WAN IP

Running a port scan both internally and externally checks if any active services are running on your network that could be used as a vulnerability. Think of it as checking to ensure that the doors and windows are locked on your castle to prevent break-ins.

7. Reviewing your Firewall Rules & Policies

As mentioned previously, the Firewall is the moat, draw bridge, and guards controlling what and who is allowed into your network. Reviewing the rules and policies is just like checking the list of who is allowed in and what they are allowed to bring in with them.

8. Removing any remote access applications & services

Even with a firewall, users might have installed Remote Access applications like Teamviewer or Remote PC. They might have enabled services like SSH, VNC & RDP that can also provide remote access. This is a perfect way for a hacker to avoid going through the draw bridge (firewall) and accessing your castle (network) by climbing through a window.

9. Using up to date Software & Firmware

Software & Firmware updates provide security updates and to close off vulnerabilities to your network. Using supported operating systems (i.e. Windows 10 or OS X Catalina) ensures that you can receive future updates to continue closing off vulnerabilities.

10. Educating your staff

Teaching your staff to be vigilant for possible signs of cyber threats is important. For example, just 1 click of a dodgy link in an email can be the equivalent of letting a trojan horse into your castle (network). Training should also include things like proper use of passwords, verifying unusual requests involving financials or information, and the age-old lesson of “If it’s too good to be true, it probably is”. Regular testing and refreshing of education help keep the cybersecurity message at the forefront.

11. Limiting Administrator Access

Limiting how many admin accounts active limits how many accounts that can be used by hackers to have control of your network. Limiting administrator rights to a workstation also decreases the chances of malware and the damage it can cause if a machine becomes infected.

12. Reviewing your backup solution

If malware or hackers do get access to your network and cause havoc, a great backup solution will help restore things to normal providing your backup solution wasn’t collateral damage from the attack.

If you aren’t sure about any of these steps or want more information, contact us by clicking here!