If you want to deliver excellent IT support to your customers, you must be able to protect them as well as keep their infrastructure up and running. One key aspect of that is knowing your enemy. That means assessing threats from the outside and getting to know how and why a hacker will penetrate a network.
One great way to do that is by reading The Black Report from Nuix. You have to log in to get a copy but if you’re tasked with network security, it is a download well worth getting.
The Black Report provides an insight into the mind of a hacker and is partly filled with surveys completed by hackers themselves. It is a great resource for anyone who provides security or IT support for business customers as it shows you how a hacker thinks and just how vulnerable networks are.
The Black Report
So what does The Black Report tell us? Here are some highlights.
- 88% of hackers can breach any network within 12 hours.
- 81% of hackers were able to steal data from any network within 24 hours.
- In almost 33% of cases, the business owner or security team never notices a hack.
- 69% of hackers are never caught when penetration testing.
- 50% of hackers change their methods for every attack to avoid detection.
If you are providing IT support for your organization or those of customers, it makes for sobering reading. So what can we do about these threats?
Humans are better than machines
Industries of all shapes and sizes are all about automation and using AI or machine learning to take care of many tasks. This report proves that network security is not one of those tasks. Many automated security devices don’t even notice many hacks and are simply unable to cope with many of them. If 88 percent of hackers can breach a network within 12 hours, hardware alone is not up to the task.
Skilled, experienced and well trained humans are the only real defense against hack attacks. While using automation as part of a defense in depth is well worth the investment, devices alone are not enough.
Education is key to preventing data loss
Phishing and social engineering is a primary way to breach a network. Whether that’s through email, chat, social networking or something else, the human element is also the weakest element. A single hacker can generate millions of phishing emails or messages. It only takes one to be opened for the attack to be successful.
A robust staff education program can go a long way to protecting networks from data loss or breaches. Teaching users not to click links, open attachments or interact on social media during work time can avoid the huge majority of these threats. Explaining why staff cannot use social media at work also increases the buy-in rate. If staff know there is a good reason for sites being blocked, they won’t mind quite so much.
Know the tools of the trade
Hacking tools are often free and open source and will be utilized in the majority of hacks. Not many hackers will write their own exploits, so it pays to know the hackers’ weapons of choice and learn from them. Such tools include Metasploit, Cobalt Strike, Core Impact, BeEF and the Burp Suite. Many are free and easily accessible online. Some cost a lot of money. Start with the free ones and learn how they work. You can move on to the paid ones if you need to.
While it won’t turn you into a hacker overnight, it will give you an idea of what to look for and how to defend against them. This is core tenet of excellent IT support. Know what weapons your enemy uses.
Ransomware is taking over from viruses
Ransomware is becoming more popular than destructive attacks for obvious reasons. Hacks were once methods of revenge or protest against the government or big business. Now hacking is a business in itself. The rise of ransomware has been huge and is rapidly overtaking virus attacks as the number one cybersecurity threat.
This evolution is also showing signs of interbreeding. Viruses such as Conficker are now being reconfigured with ransomware payloads. So rather than deleting files and wiping systems they are penetrating networks and delivering ransomware directly to user machines.
As the Internet of Things (IoT) develops, this vulnerability will also develop. Learn more about developing cyber security threats at Techrepublic.
Penetration testing is your best defense
As the theme of this article is know thy enemy, employing or using penetration testing to probe your own defenses is a great idea. It is the only true way to test your network and see exactly what a determined hacker can access and how much damage they can do. Once you know your weaknesses, you can do something about them.
Backups could save your life
A determined hacker will find a way into your system regardless of any defenses you might have. In this case, a robust backup system is going to pay dividends. Our IT support teams will always suggest instigating a reliable backup system that utilizes a local and remote copy of all your important data. Running daily backups of key data will offset any difficulties a hack might deliver.
While a backup won’t protect you from ransomware, it will at least give you options.
Treat cyber security like insurance
Insurance is often seen as a resource drain and an unnecessary expense. That is until you need it, then it is the best thing ever. Cyber security is exactly the same. It is a drain on resources but pays dividends when it saves the day. It is an investment, not a cost. While there is an inevitable CAPEX involved, the cost of defenses is usually far less than the cost of reputational damage or fines should your defenses be found wanting.
We have all heard of the big brands who have been hacked. Nobody in their right mind would ever want to be in the same situation if they could avoid it.
The Black Report should be mandatory reading for every IT support team that provides cyber security. Read it today and begin to know your enemy.
