The The year 2021 is a big year for Cyber Security and it will not get any better. The entire perspective of work and other life have changed and we have to change the way we tackle cyber security, otherwise we will either be left behind or become a victim of Cyber attack. There are big misconceptions about cyber attacks and unfortunately the truth is, unless one goes through an attack or has a deep understanding of the implications, they will not see the full effect of it.

Here are 15 points I have put together which, I think an organisation or an individual can do to prevent such attacks.

1. Implement and check for any vulnerabilities in the remote access system such as VPN. There are chances you might be running legacy protocols such as IKEv1, such protocols are very much deprecated and MUST NOT be deployed.

2. It is imperative to patch all systems, since most attackers gain access to the system via known vulnerabilities. The patching does not stop at the systems level, but it also involves IoT devices. This is because an attacker could launch an offensive from a compromised IoT device within your perimeter.

3. Ransomware attacks are on the rise and it definitely not going to go away. Every employee of an organisation has the responsibility to protect their company and themselves from ransomware or any kind of cyber attacks.

4. Endpoint Security is paramount for defending against the new era of cyber attacks. I believe every company should invest in a strong endpoint security solution to tackle every single node connecting to their infrastructure.

5. A company should enable multi Factor authentication in their entire infrastructure. I would also recommend individuals to adapt such authentication method in their personal life.

6. Implement a company wide access control policy and tighten any gaps to tackle any insider attacks. This includes having inactive and leavers policy implemented on a timely manor.

7. Form a process and regularly perform cyber security assessment in the organisation. You could identify any gaps in the system and will enable you to avoid any future attacks.

8. It is imperative to perform backup on all types of environment including cloud. As a best practice, backup data should always be kept on a secluded environment away from the source. This is to make sure that in case of a ransomware attack, in an unfortunate circumstance, an attacker should not be able to gain access to both source and the backup data. This way, if the attacker encrypts the source files, you as a company should be able to restore the data from backup.

9. Educate the staff about the implications of a cyber attack and what each and every employee should do to protect the organisation and themselves. I would recommend to send monthly or even weekly newsletters and have quarterly presentations to educate the workforce. I also recommended involving training videos and mandatory quizzes to make sure the staff are up to date with the current issues.

10. There are several companies and not to mention a vast number of individuals are investing in Crypto assets. This is a domain where criminals are trying very hard to steal such assets. There are many ways criminals are stealing crypto assets, via malicious software or other means. I would highly recommend using a secure environment while accessing crypto assets.

11. Enable email authentication such as DKIM and DMARC and monitor company wide to to prevent malicious email practices.

12. Cloud Security is a domain where it should not be overlooked. The cloud provider will only provide the underlying security. However, it is your responsibility to make sure you design your cloud infrastructure and applications as secured as possible.

13. It is important to learn about the implications of social engineering. This is one of the avenue an attacker can gain access to your system.

14. Mobile and BYOD devices must be secured and monitored at all times. An unpatched or rooted mobile device could enable an attacker to launch an attack from that device into your infrastructure.

15. I would recommend to have drills to see how your company can withstand an attack. This will enable the workforce to have a deep understanding and will enable them to be prepared if a real attacks happen in the future.

And finally…

Information Security is a journey and not a destination. The points raised in this article are my personal views and this guide should be implemented with other aspects of things. If you need to discuss any ideas, you are more than welcome to contact me.