How to strengthen your company’s security against cyberattacks

The White House is sounding the alarm on the risk that private companies face of Kremlin-backed cyberattacks. “Warnings based on evolving intelligence that the Russian Government is exploring options for potential cyberattacks,” President Biden said in a statement on Monday. “It’s part of Russia’s playbook.” 

Anne Neuberger, Biden’s deputy national security adviser for cyber and emerging technology, added that the administration is witnessing “preparatory activity” targeting critical infrastructure.”There’s so much more we need to do to have the confidence that we’ve locked our digital doors, particularly for the critical services Americans rely on,” she told reporters, noting that most of America’s digital infrastructure is managed by the private sector. “Those owners and operators have the ability and responsibility to harden the systems and networks we all rely on.”

Indeed, state-sponsored threat actors like Russia as well as organized ransomware gangs have launched increased cyberattacks recently, including against Ukrainian banks, telecom, critical infrastructure, and government systems. 

The reality is that the very same technology that allows us freedom, convenience, and accessibility to business and IT necessities such as email and the cloud also make us vulnerable to crippling cyber threats, including through the majority of websites or mobile applications. Traditionally, most wide-ranging global attacks do not discriminate between governments and companies.Therefore, now is the time to enhance your situational awareness, better manage your assets, and mitigate the risks to your technology security needs. 

It’s not hard to understand why Russia might launch cyberattacks against governments, companies, and individuals, effectively opening up another front in this war. With their war effort struggling, and global sanctions getting worse all the time, Russia has less and less to lose. Unleashing cyber mayhem as a way to raise the cost of resistance to Ukrainians and the world in general could become their next go-to tactic. 

Although we expected a lot worse from Russia than we’ve seen to date, that doesn’t mean the threat has passed. It’s worth noting, however, that Russian state actors breached several LNG operators just prior to the Russian invasion of Ukraine. Little surprise, then, that the Department of Homeland Security (DHS) and the Cybersecurity & Infrastructure Security Agency (CISA) are putting increased focus on cyber protection for the oil and gas industry since disruptions in that sector would be especially damaging given the current global shortage. 

In addition, we’re seeing a lot of opportunistic attacks, including numerous phishing and fake donation scams targeting people trying to send aid to Ukraine. And earlier this month, Moscow officially lifted restrictions on stealing intellectual property and trade secrets from organizations based in countries that have imposed sanctions on Russia. We should expect an increase in non-state-sponsored corporate espionage and piracy out of Russia due to this edict.

This is a great time to get serious about cybersecurity, but where to start? 

As a first step towards cyber hygiene, you must thoroughly understand your organization’s strengths and challenges by assessing its foundational capabilities, operational capacities, and infrastructure. Then, based on your learnings, you have to secure the integrity of your systems, networks, data storage, and accessibility. And whether you are running your cyber security internally or work with an outside expert (or both), it’s imperative to establish a 24/7 Security Operations Center that continuously monitors threats, receives real time updates and intelligence for signs of compromise, and responds with solutions in real time. 

In addition, any cybersecurity team must be prepared to support Disaster Recovery and Business Continuity activities. This includes password administration, access authority, support for all devices, (including personal devices being used in a professional environment), and much more. 

You need to ask yourself and your team some serious questions, and only be reassured when you have implemented real, practical solutions. Those questions include:

• Are you protecting all of your account credentials, usernames, and passwords? A password manager is the most efficient and reliable way to create and store strong credentials. 
• Do you have the latest updates to ensure your cybersecurity infrastructure can thwart intrusion attacks? If not, you have a serious potential problem brewing.
• Are you receiving automatic updates of all your antivirus and malware software, applications, and operating systems on all devices? Don’t forget, that includes web browsers.
• Do your employees “click before they think?” Cyberattacks often start with a phishing email, which can infect your systems with malicious software, or “malware.” Just ask the 2016 Hillary Clinton campaign how that can turn out. Such an email can also be used to steal credit card and social security numbers, passwords, and other valuable information.
• Do you have the extra layer of protection that can be derived by a Virtual Private Network (VPN)? This can provide an additional layer of protection between your devices and the internet by hiding your IP address as well as your location. It also encrypts your data.
• Is your Wi-Fi password strong, protected, and secure? If not, it can be tough to keep people from stealing your personal information and attacking your devices.
• Do you have several cloud options that can secure your precious data? Remember putting all your eggs in one basket is never a smart strategy.
• Do you have multifactor authentication security measures in place to ensure there is more than one step to access your data, including intellectual property? That crucial step could take the form of a text message, an email, a code, a fingerprint, or facial identification.
• Are your employees constantly trained on the latest cyberattacks and intrusion software? If not, then effectively your weakest link is who you are counting on for all your cyber security needs–truly a scary thought for many organizations.

Past breaches on the Colonial Pipeline, the Democratic National Committee, and SolarWinds have all demonstrated the grave extent to which cyberattacks can have global reverberations. The only way to protect against such an outcome is by thinking ahead.

Shemon Bartal is President of Global Services at AMSYS Innovative Solutions, a division of AMSYS Group, a leading global investment firm.