IT Security in Layers

At the heart of our layered security approach lies the antivirus software. Designed to ward off a vast majority of both known and emerging threats, it's indispensable in today's digital landscape. The antivirus leaps into action, for instance:

• When malicious attachments sneak into your emails.
• When stumbling across deceptive phishing websites.
• In the event of malware attacks, including menacing ransomware that holds your data hostage.
• When plugging in an external device, be it a hard drive or USB stick, that might be harbouring viruses.

Indeed, antivirus is such a fundamental layer of our security strategy that it's inconceivable not to have it in place.

In the intricate layers of our security model, the firewall stands out as a sentinel, operating on two pivotal fronts.

• Network-based Firewall – This is embedded within network elements, governing the traffic that flows in and out. Whether it's external communication from the vast expanse of the internet or internal exchanges between a server network and user-connected domains, this firewall ensures that the entire network remains shielded.
• Endpoint Firewall – This software-based firewall is nestled within individual computers. While its default behaviour typically blocks inbound traffic from the internet, outbound communication enjoys more freedom.

Why are firewalls so essential? The software we rely on, be it server-side or localised on our machines, often has vulnerabilities - which we dub as "security holes." These gaps are prime targets for adversaries. A firewall acts as a deterrent, ensuring potential attackers can't even attempt to exploit these weak spots.

Though the basics of firewall protection might come at little to no cost, its value in the grand scheme of digital security is monumental.

These lapses can be exploited by nefarious actors, turning them into gateways to seize control of systems. This makes it paramount to routinely update programs and integrate security patches. Our vigilance is underpinned by tools that notify us whenever a security patch is absent on any computer or server.

Without these alerts, systems can go unpatched for prolonged durations, an oversight that attackers eagerly capitalize on.

It's not uncommon for a fresh patch to remedy one issue, only to introduce a couple more. In environments where any downtime is costly, patches must be meticulously tested before implementation. The same discernment applies when updating network components and other devices. We ensure that new versions don't inadvertently introduce bugs that could jeopardize your operations.

Using the same password across multiple platforms, writing them down on tangible notes, or just appending 123 to everyday words, paves an easy path for intruders into your digital realms. If this sounds familiar, it's time to delve into our comprehensive article on fortifying your password practices.

Article - Password and access security

What is MFA (Multi-Factor Authentication)?
MFA requires you to validate your identity using two distinct methods before accessing an account. Typically, this involves entering a password followed by a code sent via SMS or a mobile application.

Why is MFA vital?
While it might appear secure, even the most robust passwords can be vulnerable. Common scenarios include:

• Phishing attacks where you're tricked into providing credentials on a fake website.
• Someone observing as you type your password.
• Using a compromised computer at public places, which may have keyloggers capturing your keystrokes.
• Malware on your personal device that relays typed passwords to cybercriminals.

How does MFA enhance security?
In an event where a malicious actor acquires your password:

• Without MFA, they can gain access, often without your knowledge.
• With MFA, an additional verification step stymies their efforts. The secondary code sent to your phone is something the intruder won't have. Furthermore, receiving an unsolicited code alerts you to potential unauthorized access attempts, prompting immediate password changes.

Emails often serve as the front door for cyberattacks, necessitating robust protective measures. A foundational step is ensuring every email server is equipped with antispam and antivirus solutions, preemptively filtering out malicious content.

The evolving landscape of cyber threats demands diverse strategies to combat email-based attacks. The approach to implementing these depends on individual organizational needs. Below are some tactics we deploy to bolster email security:

• Anti-Spoofing/Impersonation Protection: Attackers often craft emails using familiar names, like a company executive. For instance, they might use a publicly accessible email like ‘ceoFirstName.ceoLastName@gmail.com'. Such emails generally bypass antispam filters, enabling attackers to, perhaps, solicit purchases of Amazon gift cards or request funds transfers. Anti-Spoofing mechanisms intercept emails mimicking internal organizational addresses, allowing our administrators to scrutinize and decide on their legitimacy.
• SPF and DKIM: These protocols ensure that emails sent from our domain (e.g., @itoperations.uk) are authentic. Without such measures, cybercriminals can easily masquerade as any email address, even those we don’t possess.
• File Type Restrictions: Certain cyberattacks exploit system features that conceal file extensions. Attackers might send a file named 'offer.pdf.exe'. If the system only displays 'offer.pdf', an unsuspecting user might execute it, inadvertently launching malware. It's prudent to block potentially dangerous file extensions to prevent such scenarios.
• Sandboxing: Some sophisticated tools facilitate the testing of email attachments in a controlled environment. An attachment is dispatched to this 'sandbox' and executed. The system then analyses the file's behaviour—its network connections, encryption activities, etc. Depending on this analysis, the email is either retained or forwarded to the recipient.

Is a strong Windows password enough to guarantee the security of your computer? Let's delve deeper.

When your drive's data isn't encrypted, your computer is vulnerable in at least two straightforward ways:

• Direct Drive Access: Someone could easily remove the hard drive from your computer, connect it to another system, and duplicate the data. Windows permissions aren't much of a deterrent here. An attacker's computer administrator can take ownership of any NTFS system folder, enabling unbridled access.
• Bypassing Passwords: By booting the computer from installation media, an attacker can manipulate a few files, restart the computer, and then alter your administrator password - all without even logging into Windows.

However, when your drive's data is encrypted, your digital assets remain secure. Neither of the aforementioned methods, nor any other known techniques, can penetrate a correctly encrypted drive.

For encryption, you can rely on built-in tools from your operating system. Windows offers Bitlocker, while macOS provides FileVault. The best part? Both are available for free.

A proxy gateway stands as a frontline defense mechanism, vetting sites in real-time before granting your company's users access. If the gateway detects any red flags, it bars entry, ensuring optimal cybersecurity.

How does it function?

• Traffic Direction: We channel all internet traffic through the proxy gateway.
• Regular Browsing: Users continue browsing as usual, without any noticeable change in their web navigation experience.
• Real-Time Assessment: The proxy gateway perpetually scrutinizes the website's reputation and safety profile.
• Seamless Access: Websites with a clean bill of health are presented to the user unhindered.
• Safety Barriers: For any site flagged as potentially hazardous, the user receives a prompt warning, and the gateway restricts access.
• Swift and Efficient: This real-time vetting process ensures that browsing speed remains largely unaffected.

Custom Features: On request, the proxy gateway can be enhanced to serve specific needs. It can be programmed to block sites based on certain criteria or categories, ranging from gambling and adult content to non-work-related distractions.

Active network monitoring is an indispensable tool in bolstering security defenses. By incorporating a specialized device into your network setup, you gain an eagle-eye view of all network communications. This device cross-references every communication with a database of known malicious patterns. Any suspicious or prohibited activity is instantly halted and brought to the network administrator's attention.

Here are examples of how it benefits you:

• Ransomware Prevention: Consider a scenario where a computer is infected by ransomware that encrypts data and demands a monetary ransom. For the ransomware to execute its malicious activity, it needs to connect with its controlling server. Our monitoring tool identifies this rogue communication, blocks it, and sends out an alert. This proactive measure not only prevents potential harm but also keeps us informed about the intrusion.
• Protocol Regulation: At times, a computer might engage in non-malicious, yet unwanted, communication protocols. For instance, if someone initiates a BitTorrent download, the system flags this activity. While the communication isn't inherently harmful, we would want to verify its purpose.

During regular office tasks, there's no need for users to possess administrator privileges on their computers. Such elevated access is reserved for specific actions, like software installations or significant system adjustments.

However, the entities frequently craving these elevated privileges are viruses and malware. When a user inadvertently triggers a malicious entity, the absence of administrative privileges can impede its malicious intent.

For optimal security, we advise using accounts with basic permissions for day-to-day activities. When tasks demand heightened access, a temporary switch to an admin account can be made. Once the specific task is accomplished, users can easily switch back to their standard account, ensuring the system remains fortified against potential threats.

Removing administrative privileges is an effective method to counteract viruses. However, this approach can sometimes be overly restrictive, limiting users from performing necessary tasks.

The solution lies in deploying a system allowing for more nuanced rules about user permissions. Such a system would enable you to:

• Specify which applications users are permitted to install on their own. These applications would be installed with administrative rights, even if the user doesn't inherently possess them.
• Decide which system sections necessitating administrative rights can be accessed by the user. For instance, modifications to network adapter settings.
• Restrict the installation of undesired programs within your environment, or set up alerts for the IT helpdesk when an installation attempt is made. The IT team can then review and approve the installation as appropriate.

Despite implementing comprehensive security layers, vulnerabilities can arise due to unintentional user errors. In many instances, attackers specifically target unsuspecting users.

To counteract this, we emphasize cultivating security awareness amongst users. We enlighten them about prevalent threats and common tactics deployed by attackers. Our training instils a sense of caution, prompting users to remain alert and inherently skeptical. Encountering anything out of the ordinary? We encourage a three-step approach: stop, reflect, and report. Attackers often bank on the element of urgency, knowing well that a thoughtful user is more likely to act judiciously.

For instance:
Imagine receiving a message from your boss urgently requesting you to purchase Amazon gift cards as client giveaways during a meeting. It feels odd, doesn't it? It's this very instinct of "something's off" that we train users to heed and respond to.

With the rise of advanced technology, including artificial intelligence, the stakes are even higher. Consider a scenario where, instead of a text, you receive a phone call. Your boss's voice sounds impeccable, yet the request remains bizarre. Welcome to the world of deep fakes, a potent and increasingly prevalent threat.