By Chris Johnson, Head Business Development Digital Services at MASS
The security needs of businesses vary greatly dependent on the sector they are in. For example, the financial sector is generally more developed than others due to the potential risks associated with a security breach. Despite the varying requirements, each business’ broader approach to security should follow a similar format where vital assets – those that needs to be protected – are surrounded by several security layers.
This approach helps ensure that if the first or even second layer is breached, the asset is not compromised or put at risk. But too often security measures are not thought about holistically, with physical, cyber and personnel risks all considered individually when in fact they are intrinsically linked. Often, there are hidden risks that may not even have been considered.
Here, we’ll explore the rounded approach that MASS takes with both public sector and defence organisations, and how this can be applied to improving security within all facets of the private sector.
Physical security
The first and most obvious security consideration should always be physical access to the organisation’s building or site. Even in sectors where physical security is well established such as finance or data centres, it remains vital.
Identifying the perimeter is fundamental, due to the potential of distributed site facilities, linked remote assets and supply chains, the perimeter may not be as clear as initially thought. To achieve this, the use of scenario-based analysis actor personas, motivations and objectives can be invaluable for exposing how a business could be targeted and exploited.
This should include a review of the physical barriers that prevent access to the site and their role as a deterrent and detection method for hostile activity.
But security measures are only as secure as the people applying and adhering to them. Factors including staff making simple mistakes (such as wearing security badges in the street) or poor motivation of roving security staff or those monitoring CCTV can cause warning signs to be missed – and allow for future security breaches to slip through the gap.
Cyber security and the aging risk
The risk of cyber exploitation has grown considerably in recent years due to the financial and technical barriers to advanced cyber-attacks being reduced. For this reason, levels of cyber security must be taken to a new level and any existing measures continually scrutinised.
The COVID-19 pandemic has brought this issue to the fore, with homeworking and remote access highlighting the importance of cyber security, and also shining light on the risks posed by aging equipment and systems.
Throughout 2020 the challenges associated with using legacy data systems have been highlighted, and with increased traffic and offsite access the user experience has become slow and often with intermittent access. Legacy systems are also more challenging and expensive to protect.
The efficient transfer of business data from legacy systems onto a modern platform and data warehouse can not only help protect information more effectively from cyber threats but is also often a more effective use of resource when compared to protecting legacy systems.
To help mitigate network cyber risks, penetration testing regimes can be vital but tools like ‘CBEST’ only offer a snapshot in time and therefore have limitations. Frequent, lighter touch assessments enhanced by modern threat intelligence techniques are recommended in line with these tools as they offer a more dynamic view of vulnerabilities.
Consider insiders
Those who might misuse legitimate access to an organisation’s assets are known as insiders and are often overlooked. Many security controls are now so effective that exploiting those with legitimate access is one of the only ways to circumvent them. The right insider or team of insiders can overcome almost all security measures, while insider breaches have a disproportionately high business impact.
Insider cases are typically individuals who have had a personal vulnerability exploited or have become disgruntled with an employer, and it is a challenging area to address. That being said, security culture, employee wellbeing and employee sentiment are just some aspects that a business committed to its security should consider.
It’s also prudent to examine the wider supply chain. Many businesses rely on an interconnected network of suppliers which makes it difficult to pinpoint risk, so identifying ‘hot-spot’ areas allows them to filter complex information and establish risk effectively.
Changing times
If these layers of security are not considered collectively, some areas can fall through the cracks. The COVID-19 pandemic has had an unforeseen impact on security, with some companies experiencing a change in working practices or accelerated growth. Yet their data is stored on legacy systems which unless addressed, are cyber-attacks just waiting to happen.
At MASS, our security experts consist of professionals with extensive experience in preventing security breaches and managing data from mission critical systems. We ensure our security analysis meets and exceeds industry best practice.
MASS has recently launched its Virtual Learning Environment allowing us to conduct Cyber Security Training remotely for whole organisations, individuals or management teams. For more information, please visit: https://www.mass.co.uk/what-we-do/mass-online-training/online-training-courses/