WHY DOES A COMPANY NEED COMPUTER SECURITY?

 

WHY DOES A COMPANY NEED COMPUTER SECURITY?

 

If a company asks this question it is highly possible that it is already being attacked, security in companies at the level of computer and technological assets is not a game that we must leave time. If we consider which the most valuable asset of any company is, we can say that it is without doubt:

"The information it handles ..."

So several questions arise to ask ourselves:

1.    Are we completely sure who accesses what information within my company and can I give testimonies to my clients that their information is not seen by people or employees who should not have access to it?

2.    Are the procedures clear enough that define where confidential information is stored and how it could be accessed by third parties?

3.    Do I have a trained technical staff (consultative or permanent) who has mastered computer security issues and who supports me in the most relevant aspects of how to keep information safe?

4.    Are my company's operations secured by resilient processes?

5.    Is anyone responsible for the data and how is it handled within my company?

6.    In the event of a data leak, do I have alternate mechanisms that would protect data from being read by unauthorized third parties?

7.    Are all my employees trained in basic security and how to treat data due to its level of confidentiality?

If you have answered "Yes" to all these questions, we congratulate you, you are part of a company with a very clear vision of how to manage your IT security. But if on the contrary you have answered "No" to at least one of these questions, do not be alarmed, you are in the right place to know what to do, and take immediate action.

What are hackers looking for when attacking our company?

There is only such a valuable asset within a company for any hacker who decides to tie us up as the information we handle about our clients, our operations or the brand as such. Computers can be reset to their default state after an attack, employees can continue working in another location or on other computers after an attack, and even operating machinery can be restarted to continue working normally after an attack; But the only thing that is completely lost is the credibility of a company when information on products or services, client folders, business strategies, confidential files are completely erased or encrypted by a hacker after an attack and even worse if they are published in the internet by way of informational leak .

Attacks can be more powerful for several of the following reasons:

1.    Deleted or encrypted information is irrecoverable unless a ransom is paid or is backed up, this could imply the total loss of information for the business, and therefore a collapse of the credibility of the same, cases such as that of Facebook in In 2018 , Uber in 2016, or iCloud photo leaks in 2014 , these may not be the most recent cases of leakage, but they are cases of companies that you would think are not going to have the luxury of being vulnerable. However, the reality is that there is no such thing as a non-vulnerable company.

2.    When there is no contingency or resilience plan that supports this situation: In security, it is customary to say that nothing is secure enough so that it is not compromised, therefore, in computer security there are two branches that contribute after an attack: forensic part of an episode and the resilience that is how we react to that episode. It is of high importance to be prepared and never consider anything like a "RMS Titanic" of safety, since as experience gives us even the most resistant ship in the world was sent to the bottom of the sea by a piece of ice.

3.    For not contacting an adequate technical staff that idealizes the protection of data and technologies, or simply having a technical staff that is not prepared for these situations. Information gaps are the most macabre type of situations in which any company could be involved. How these issues are handled is crucial to the future sustainability of the company's reputation.

4.    Operative or administrative personnel poorly trained in how to react to an IT breach could be a catastrophe for the company, since as we could observe in recent events in the country about fires and explosions in companies, the way in which employees handled the information and It was processed abroad through social networks, negatively affecting the companies affected in these incidents. Therefore, there must be a clear evacuation plan, protection of human life, safeguarding of information and continuity of well-documented company assets and that staff receive constant training on these documents.

What steps should I take?

Let's start from the basics to the advanced:

1.    Get a Total Security antivirus or its equivalent for the whole company, you will be surprised that many companies rely on free antivirus to protect their company. Without knowing that free antivirus are marketed by antivirus companies for the sole purpose of obtaining statistics and intelligence with as many users as possible, at no time do free antivirus offer the protection of their paid counterpart. Therefore, if you do not have a Total Security antivirus, get one right now. Some recommendations Bitdefender Total Security, Kaspersky Total Security, Avast Total Care.

2.    Now you can take a break knowing that all your machines have at least one antivirus installed. Well, not really, for an antivirus to be completely effective it must be monitored by an expert who identifies the threats that have entered and criticizes them, classifies them and can give advice to users on how to avoid getting infected. This is very simple, there is what Zero Day Exploit threats are These threats have a common objective to detect vulnerabilities in systems that have arisen before the manufacturer could have time to apply a patch or solution to it, in the time elapsed between the developer being able to write the necessary code to resolve that vulnerability and the distribution to all users, hackers take advantage of this vulnerability; in this period we are all vulnerable, even we have an antivirus. For this and many other reasons, it is important to have an expert staff that can support us by identifying and trying to solve these vulnerabilities. It is important to note that, depending on the situation of your company and the evaluation carried out by the security expert, you may require additional protection devices and solutions such with firewalls,VPN , among others.

3.    Excellent, now we already have antivirus and an expert (consultant or permanent) who supports us with all security issues, we already believe that we can rest a little and forget about the security issue. Of course not, impossible. Now is that the work begins, this expert must make a survey of each of the systems used by the company, identify the update levels, which risks imply for the operations of the company a failure in systems that support the operations of the company . At the same time that an information backup plan is developed in alternate locations (outside the company or in the cloud), an effective data risk and resilience plan.

4.    One of the most important points in the equation and one that has produced excellent results in practice is training users on how to protect themselves from intentional hacker attacks. For example:

a.    Identify identity theft emails.

b.    Safety when browsing the Internet.

c.    Avoid downloading personal or unknown files on corporate computers.

d.    Including creating a communication work plan with customers and suppliers that make it impossible for another person to impersonate them, or vice versa.

e.    Among other high impact aspects.

5.    Create and effectively implement a backup and restore plan for your tested data.

Will security ever be unnecessary?

As systems and hardware become more powerful, to the same extent systems become more vulnerable, the reality is that security is more related to the resources available to people who want to enter your system or obtain your data, and in a general sense, accessibility to powerful resources today is very simple and is at hand for anyone.

Just 10 years ago, thinking about having access to high-performance computers was an almost absurd idea, today, you can hire it simply with a few clicks on the Internet at providers that for an extra price hide your identity from you.

So, to the question of will computer security be unnecessary in a few years? It is clearly not, since the same people who work actively in the development of the systems are commonly the ones who share their vulnerabilities and exploit them. Governments are an active part of the attack gear in the world due to the well-known digital war , followed by security companies that, in order to develop more secure platforms, pay hackers to carry out attacks around the world and report vulnerabilities to them.