How Secure is Your Business?

As of 2020, cyber attacks were ranked as the fifth top rated risk in both public and private business sectors, according to The World Economic Forum. By 2025, IoT (Internet of Things) attacks are expected to double in frequency. The average cost a business incurs from a cyber attack is $1.85 million, as of 2022. Cybercrime, which encompasses corporate espionage, theft, embezzlement, and malware attacks, has risen 600% since the start of the COVID-19 pandemic in early 2020.

​

With that in mind, what is your company's security posture? Do you use multifactor authentication to validate your employees' identities within your organization? Are your employees required to verify themselves before they access business resources from a remote location? Do you have a system in place that allows you to restore data in the event of a ransomware attack?

​

To understand why security is so critical to your business's operation, let's examine two security concepts you may already be familiar with: the principles of zero trust and least privilege.

​

The National Institute of Standards and Technology defines zero trust, in part, as such: "Zero trust (ZT) is the term for an evolving set of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users, assets, and resources."

​

The zero trust model requires all users of a given resource (like your company's business applications and data) to be authenticated, validated, and continually authorized before being given access to those resources. Zero trust was a response to the edgeless nature of today's business networks; that is, zero trust functions the same whether your employees work remotely or in the office.

​

Zero trust rests on three main tenets:

• User/application authentication

• Device authentication

• Trust

​

​

​

​

​

​

​

​

​

 

 

 

 

Geeks for Business recognizes the NIST 800-207 standard for zero trust. NIST 800-207 is a comprehensive, vendor neutral set of standards for implementing zero trust security policies within any organization. NIST 800-207 provides for protection against modern cyber attacks in our current cloud-centric, remote work model.

​

Next is the principle of least privilege, which is conceptually related to zero trust, but with some key differences. PoLP (principle of least privilege) is used to limit users' privileges to those strictly required to perform a task. PoLP is a fundamental element to building a modern cybersecurity framework for your organization. PoLP restricts access to sensitive data and other valuable assets, ensuring that no single employee has broad access to business resources.

​

PoLP can be applied to systems, applications, and Internet-connected devices, which in turn limits user access to the resources strictly needed to do their job.

​

PoLP provides an effective means to centrally manage user credentials and access rights while giving your IT provider the flexibility to revoke or extend privileges as needed.

​

The main advantages of PoLP are:

• it reduces your company's attack surface (susceptibility to cyber attacks)

• it mitigates malware spread within your organization by limiting privileges on endpoints, thereby preventing malware from performing privilege escalation attacks

• it reduces IT help desk calls and can lower your ongoing IT costs by implementing a set of privilege policies that both minimize external threats and prevent users from invoking administrative-level privileges to modify system settings

• it makes security audits easier. PoLP demonstrates compliance with various security standards (such as those codified by NIST) and provides a clear log of all privileged activities on a network or device

​

With this primer in organizational security, consider the following five questions about your business's security practices:

1. Have you implemented zero trust policies within your company?

2. Have you implemented the principle of least trust?

3. Have you implemented multifactor authentication, either with a smartphone-based authenticator app (like Authy) or a hardware token-based authenticator, like YubiKey?

4. Do you have a disaster recovery and data restoration plan in place in the event of a ransomware or other cyber attack?

5. Are your employees' company laptops centrally managed and monitored to ensure security, compliance, and timely patch management?

​

If you answered "no" to any of these questions, Geeks for Business can build a security solution that works for your business. We take modern threats seriously because one attack can mean the end of your company. Get in touch today and let us design the right system for you.