Hacks do not happen in a vacuum; if one computer on a network is compromised, all machines on that network are at risk. For this reason, both enterprises and individuals have a responsibility to implement cyber security best practices – and this does not mean installing anti-virus software and a firewall and calling it a day. While it’s important to run anti-virus software and properly configure firewalls, viruses aren’t the only threat to your system; what if your email login credentials are stolen, or someone hacks your router or your smart TV?
What else should you be doing? Here are six proactive cyber security best practices for individuals and enterprises.
Use Strong Passwords, and Don’t Reuse Them
The most basic best practice is to use a different, strong password for each site. While remembering all of these passwords can be a challenge, it is for your protection. If a hacker manages to get hold of, for example, your Facebook login credentials, the first thing they’ll do is attempt to use them to get into your online bank account, your email, and other highly sensitive sites.
Businesses should not allow employees to pick their own passwords; employees should be assigned randomly generated strong passwords. This prevents employees from reusing personal passwords – and hackers being able to get into your enterprise systems if an employee’s personal accounts are hacked.
What constitutes a strong password? It should be at least six characters long, not contain your name, user name, or any dictionary words, and be a mixture of upper case letters, lower case letters, and numerals. An easy way to generate a strong password is to base it on the first letter of each word of a sentence. For example, “I graduated from Roosevelt High School in 1998” would generate the strong password IgfRHSi1998.
Use Two-Factor Authentication Whenever Possible
Passwords alone are not considered secure so in addition to strong passwords, use two-factor authentication whenever possible. Two-factor authentication requires an additional device or “secret,” such as a mobile phone or a PIN, to confirm the identity of the person trying to log in. Many websites use two-factor authentication to retrieve forgotten passwords; the site may text a code to your mobile phone.
Never Send Sensitive Data Through Unsecured Email
Email hacks can be both embarrassing and damaging. Just ask Sony Pictures and the Democratic National Committee, both of whom had C-suite shakeups after hackers breached their email servers and handed evidence of executives and their staffers behaving badly to WikiLeaks. Even worse, some of the stolen DNC emails contained full, unredacted images of checks from high-value donors, putting those people’s bank information at risk. Simple cyber security best practices could have prevented these hacks!
Sensitive data – including Social Security Numbers, completed tax forms, bank account information, or even login credentials – should never be sent through unsecured email. Even if your email account isn’t breached, your recipient’s may be, or the email could be intercepted somewhere along
the way.
Additionally, you should never write anything in an email that you would not want to see show up on WikiLeaks – because it very well may.
Keep Your Operating System & Software Up to Date
The global WannaCry and NotPetya ransomware attacks that made headlines this summer are notable in that they impacted only older, unpatched versions of Microsoft Windows. This underscores this utmost importance of keeping both your operating system and all of your software up-to-date. Install any manufacturer updates as soon as possible after they are released; often, these updates include important patches addressing new cyber security vulnerabilities.
Back Up Your Data
The easiest way to recover from a ransomware attack is to restore your files from a backup. Be sure to back up your files daily, either to a cloud, an external hard drive, or both. If you use an external hard drive as a backup, keep it unplugged from your machine except when it’s actually performing the daily backup; this way, if your machine is compromised, the hackers won’t be able to access your backup disk, too.
Backups also protect your data in the event your machines are damaged or destroyed in a natural disaster, a burglary, or an accident.
Change the Default Passwords on Your Smart Devices
Last fall, numerous high-profile websites, including Netflix and Airbnb, were knocked offline by the Mirai botnet. Mirai worked by scanning the internet for smart devices – everything from routers to printers to DVRs – logging into them using default manufacturer credentials, and turning them into “zombies” that sent tens of thousands of junk requests to a company called Dyn, which provides domain name services to the impacted enterprise websites.
Before hooking up anything to your home or enterprise network, even if it’s just a smart thermostat, change the manufacturer default login credentials. These credentials are widely available online, and hackers can use them to breach your smart devices.
The best way to deal with a cyber attack is to prevent it from ever happening in the first place. By adopting proactive cyber security best practices, you can secure your home and business from cyber criminals.
Michael Peters is the CEO of Lazarus Alliance, Inc., the Proactive Cyber Security™ firm, and Continuum GRC. He has served as an independent information security consultant, executive, researcher, and author. He is an internationally recognized and awarded security expert with years of IT and business leadership experience and many previous executive leadership positions.
He has contributed significantly to curriculum development for graduate degree programs in information security, advanced technology, cyberspace law, and privacy, and to industry standard professional certifications. He has been featured in many publications and broadcast media outlets as the “Go-to Guy” for executive leadership, information security, cyberspace law, and governance.