Here are the 10 most important things that an entrepreneur should do to keep the online systems up, secure and running:
1. Improving physical security to prevent unauthorized access to the confidential data by an attacker getting physical access to a device:
Ensuring security from attacks requiring physical access to the devices will lower the risk of getting hacked to a great extent because of the fact that these kind of attacks are most probable among all and are easy to carry out, as these do not require really good technical knowledge. Improving physical security involves:
- Keeping external computers(like the one used on the reception) on a separate network than that of the internal computers.
- Keeping routers, switches and other connected devices well encased and locked.
- Using strong passwords on the systems and logging out of the accounts whenever leaving the system unattended.
2. Encrypting important data:
Data stored on internal hard drives/SSDs as well as removable media should be encrypted to prevent access to its data due to theft or loss of the media or the device containing the internal hard drive/SSD. Backup files should also be encrypted to prevent an attacker from stealing it and restoring it somewhere else.
3. Securing the production network against external attacks:
If your internal network faces the internet, it is crucial to protect it from the malicious traffic that may come from the internet by some attacker. Firewalls can be used to protect your internal network. There are multiple vendors providing many types of firewalls.
Firewalls mainly fall into two categories i.e. stateful and stateless. The correct type can be chosen by properly analyzing the type of traffic the network will carry and expected malicious traffic.
4. Using up to date software:
Software components that are used in the development and deployment of products are as potentially vulnerable to various attacks as end-user software. Using outdated versions with known security problems can turn out to be a big problem and cost a lot to the company in terms of money and reputation.
Although there are measures to prevent attackers from identifying the version of software components being used. But there are ways to circumvent these and new ways are being discovered by attackers every day. These updates are usually free and easy to install. A better way is to create a policy on update availability checking and implementation frequency.
5. Getting Security Audits done regularly:
Assessing the security of your product gives you an insight into what you can do to strengthen its security. A security audit done by experts helps a lot in identifying weak areas and exposed attack surfaces. This can either be outsourced to the firms that provide security services or a group of experts can be hired and classified into a “red team” and a “blue team“.
The job of the blue team is preventive maintenance and secure product development. The red team, on the other hand, comes into the picture after the product is ready. The red team performs what is called a “penetration test“, where the red teamers try to hack the product in the same way an attacker might do. This helps to patch the vulnerabilities before hackers can find and exploit them.
6. Ensuring proper and secure backup of sensitive and useful data:
Even after all the precautions being taken properly, cyber attacks may be successful against your organization. Frequent backups should be performed to prevent data loss. Backup files should be password protected and/or encrypted. In the case of cloud backup, the files should be protected with a strong password.
7. Starting a crowdsourced security testing program or a bug bounty program:
A bug bounty program is a program that lets the freelancer white hat hackers try and find security vulnerabilities in your online assets connected to the internet. Much like the internal red team. The main benefit is that the assets are tested by hackers from a variety of backgrounds and skillset and there is no payment for testing. A payment or reward is provided only when a potential security issue is discovered. This makes the process of bug bounty highly result oriented and efficient for companies as well as researchers.
The reason that bug bounty programs being result driven is good for researchers is that it helps them stand out of the crowd based on their skills.
8. Employee training:
An employee is the weakest link in the security of your system, why? because you may have the world-class security to your online assets but if one of your employees can be socially engineered into sharing something confidential then all of it will prove to be of no use. This is why training employees to make them aware of potential security problems related to their work and how to avoid them is important.
A crucial part of this training should be to teach employees, how to spot social engineering attempts and do not share confidential information over the phone and other insecure channels.
9. Securing the WiFi:
Securing the WiFi is important considering the fact that a host connected to your network can sniff all the traffic originating from or destined to any other host on the network. There are few things which should be done to make sure that wireless LANs are secure enough.
- Use WPA2+(WPA2, WPA3) encryption while configuring your wifi AP. Though these are not very secure after the discovery of vulnerabilities like Krack and Dragonblood, these are still much better than other older standards.
- Do not leave any AP as unencrypted(open) and instruct the employees to not connect to any open or untrusted WiFi
network. - Disable SSID broadcast and enable MAC filtering to further harden the security fence of the AP.
10. Implying other best Security Practices:
Apart from the things mentioned earlier, there are many more things apart from these that can be implemented to provide enhanced security. These are relatively new techniques that have emerged recently. Some of them are:
- 2FA(2 Factor Authentication)
- Location Based login.
- Strict password complexity policy.
- Implementing rate limiting on login forms to prevent brute-force attacks.
- Using Captcha to prevent scripts/bots from creating rogue requests.
