Zain

Information is power, as the famous saying goes. Information is the lifeblood of a business, as well as a tantalising target for an attacker. All businesses will find themselves dealing with different types of information, from things that they are happy to make public to things they would rather keep under wraps. How can you ensure that all such items are properly labelled, so that all employees (and anyone else who gets their hands on them) will know how to handle them? The answer is information classification.

One of the most fundamental tenets of information security is the Principle of Least Privilege. First formulated by Jerome Saltzer for a 1974 Communications of the ACM article, the Principle states that ‘every program and every privileged user of the system should operate using the least amount of privilege necessary to complete the job.’ What does this mean for a business and its employees?

It is a fact of business life that employees may, one day, cease to be a part of your organisation. There may be many reasons for this, and the separation may be more or less mutual; more or less amicable. The one thing that all separations have in common is the need for you to have policies and procedures to be in place that will ensure a smooth transition, without leaving yourself vulnerable.

The British Security Industry Association (BSIA), which claims to represent a membership ‘responsible for more than 70% of privately provided UK security products and services (by turnover)’, released in early January a document titled Cyber secure it – Best practice guidelines for connected security systems with the aim of ‘summaris[ing] current guidelines to minimise the exposure to digital sabotage of network connected equipment, software and systems used in electronic security systems.’ Here, we will give you a brief overview of the guidance.

You may be wondering what ‘DNS hijacking’ is, and how to secure your own company’s sites. Even if you are not in one of the industries currently being targeted, it is nonetheless important that you secure yourself regardless.

In the previous part of this series, which covers some of the weirder and wackier parts of your business that may nonetheless prove to be your Achilles’ heel when it comes to cyber attack, we discussed the threat posed by printers. This time, it’s the turn of something you probably even less likely to consider when assessing your level of vulnerability—your air con.

Today, we shall look at how something as innocuous as the office printer can be exploited. Yes, printers—those noisy, clunky, unreliable things that every office worker dreams of one day taking to a field and kicking to bits a la Office Space. How could an attacker possibly use your printer against you?

In the first part of this series, we decried the overreliance on passwords for authentication. In the second, we discussed the full range of means at one’s disposal. In the third, we described the advantages of using multiple means in conjunction with one another. In this fourth and final part, we detail how, when no other option is presented, one can use single-factor, password-based authentication (PBA) at its most securely.

In the first part of this series, we held an intervention over the widespread use of passwords, complete with the ever-widening list of arduous hoops to jump through that are imposed on users in the name of security. In the second, we revealed just how expansive the field of authentication methods really is, but with the caveat that no single method is without its flaws. In this third part, the gold standard of authentication—multi-factor authentication (MFA)—is presented.

In the previous part of this series, we discussed the many shortcoming of passwords as a means of authentication—the process of verifying that a given person is someone you want to be able to do something, such as use a piece of software, log in to an online account or access an area of a building. In this part, a range of authentication alternatives to passwords will be presented, along with their pros and cons.

Passwords are ubiquitous and have been for decades, despite repeated predications over the years of their impending death. They have remained popular for a range of reasons, primarily their simplicity and familiarity, backed up by how widespread technological support for them has traditionally been. As a result, the status quo is often not challenged, despite expert consensus that passwords are—well—a bit naff.

In the first part of this series, we covered the threat posed to your business by attacks on your supply chain. In the second, we detailed a number of ways of properly vetting potential suppliers, both obvious and non-obvious. In this third and final part of this series, we will detail a range of tactics you can use to protect yourself in the event of an upstream company being compromised.

In the first part of this series, we explained how you are ‘only as secure as the company you keep’ and detailed the threat posed by supply chain attacks such as the 2017 NotPetya attack and contemporary activities of Magecart cybercriminal groups. However, for most people, using a supply chain is not optional. Here, we will go through ways of vetting your supply chain.