What is Security Hygiene?
Security Hygiene is an assessment of how well you are managing your network security. Do you know what activities your employees are doing on a daily basis that may compromise the security of your business?
Poor security hygiene can lead to an increase in phishing and cyber attacks, as companies with poor hygiene are considered “low hanging fruit” by attackers. Cyber attacks often succeed through something as simple as weak passwords or lack of software updates. Financial implications, damaged reputation, and client loss are just a few things that can result from a cyber attack on your business.
Employee Activities
Most exploits occur when employees let cyber criminals access company information unknowingly. The security industry calls this the Unintentional Insider Threat problem (more here).
Examples of employee behavior that could expose your network include:
- Running old vulnerable software such as Flash or Java versions that are littered with exploitable problems (here is a good article on what the FTC thinks of Java, and here is an example of how an old version of Flash can be harmful).
- Running risky software such as BitTorrent and Tor.
- Sending Personally Identifiable Information (PII) data such as passwords or credit card numbers over the internet in clear text.
- Visiting nefarious websites.
- Clicking on phishing messages.
In the latest 451 Research study User Behavior (14%) is the leading internal IT security pain point.
NetWatcher sends users a weekly email detailing the security posture of the network. The email provides you with a network score (out of 100, normalized over the number of assets on the network), and how many violations have resulted in open alarms, of various priorities, over the last two weeks.
NetWatcher also provides widgets that show the number of users running risky software or vulnerable software.
Additional Network Security Considerations
Monitor what’s getting through your firewall by following countries that have triggered anomalous events once they made it through a company firewall.
Set “Trip Wires” to send you an SMS message if an event causing security concerns occurs. For example, here is a SMS trip wire set for any event from China, Iran or Russia.
Monitor any “Scanning” that is making it through your firewall. Learn more about scanning here.
Addressing Hygiene Issues
It’s important to deal with security hygiene issues as they arise by:
- Upgrading the software if necessary.
- Removing the software if it is too risky.
- Training the user on why the activity or software they are using exposes them and the company to exploit.
- Updating employee policy documents to include what a user can and cannot do on the network.
- Blocking the software at the firewall/router &/or use web gateways to block the users for visiting bad sites &/or use email phishing services to force users to be smart about what they are clicking.
Some other questions to ask yourself are:
- Do you need to blacklist IP addresses or entire countries at the firewall/router so they can never enter the organization?
- Do your users do business in those countries?
- Do your users do business with the organizations that own the IP address of those scanning you?
Check out the NetWatcher Scorecard to find out the status of your company’s Network Hygiene and what areas need improvement.
You must be logged in to post a comment.