Two weeks ago, I woke up to my dad screaming “who is that, how did you get in”. It was 3am. How did this individual get into the compound, who left the gate open?.
Thankfully, there was no one in the compound. A strong wind blew the gate open.
Apparently, my younger cousin, who was in charge of locking the gate every night, forgot to do so.
However, she woke my dad up with the phrase “an intruder is in the compound” That sent him into a panic mode.
So, how did he get in, did you leave the gate open?. Yes, she did.
Just like my cousin, a lot of organizations have left their critical information infrastructure open to cyber attacks.
This has led to the loss of sensitive data, reputational damage, and loss of billions of dollars.
In this article, we will be showing you how to identify and protect your Infrastructure critical information infrastructure, from cyberattacks.
Let’s jump in!
Identify Your Organization’s Critical Asset
“You cannot secure what you don’t know you have”. In securing your organization’s asset, you have to first identify your asset.
What is an Asset?
An asset is something of either tangible or intangible value that is worth protecting.
More specifically, an asset is anything of value to the enterprise in the delivery of its mission or business strategy that can be affected by an event that can lead to business or mission impact.
Identifying your organization’s asset, threats to those assets and the vulnerabilities that the assets contain is the first and important step to take in protecting them from the risk of an intrusion
Examples of organization’s assets includes; People, Information,Infrastructure, Reputation and Finances. Find out more about these assets in the next section.
People
People are assets that include employees, contractors, staffing providers and third parties.
Many enterprises are vulnerable to the loss of a key employee who may be a single point of knowledge and the only person with knowledge in a certain area or specific expertise.
Failure by management to identify key employees and ensure that they are supported through cross-training and incentive programs are unfortunately common.
Whether a loss occurs as a result of retirement, illness or recruitment by another enterprise, it may leave the enterprise in a precarious and vulnerable position.
Information
Information assets are essential to an enterprise’s business and exist in many forms.
They can be printed or written on paper, stored electronically, transmitted by post or by using electronic means, shown on films, or spoken in conversation.
Information should be protected against disclosure to unauthorized users (confidentiality), improper modification (integrity), and non-access when required (availability).
Information may be sensitive, critical or both; sensitive information must be protected from disclosure or modification, while critical information must be protected from destruction or loss.
The systems that host, process or transmit information (data) must ensure that information is protected at all times, in all forms and in all locations.
Infrastructure
Infrastructure assets include the physical infrastructure (e.g., facilities, equipment) and IT infrastructure (e.g., computing hardware, network infrastructure, middleware).
IT architecture components include information and applications.
New and outdated technologies pose a risk to an enterprise.
With older technology, equipment that is no longer supported or past its mean time between failure (MTBF) may be particularly vulnerable.
Lack of patching and updating of systems and applications may leave them vulnerable to malware or misuse, and older systems may require expertise that is not readily available to maintain (potentially increasing key-person dependency).
When new technology emerges, your organization needs to consider the following
- Impact of adopting the technology (support, reliability, ease of integration)
- Risk associated with operating the new technology (e.g., security, reliability)
- Consequences of not adopting the new technology (e.g., obsolescence and lagging behind competitors)
- Business benefits of the new technology (e.g., support for new business initiatives, effectiveness and efficiency gains)
Business Processes
A business process is an interrelated set of cross-functional activities or events resulting in the delivery of a specific product or service to a customer and can be considered an intangible asset.
Business processes are controlled by policies, procedures, practices and structures that create value to the enterprise and provide reasonable assurance that a business process will achieve its objectives.
Inefficient or ineffective business processes may make an enterprise less competitive in the market and lead to financial, market share or reputational loss.
Reputation
Reputation is an Intangible asset that is difficult to quantify. It represents the value an enterprise has derived from its past actions, positive or negative in nature.
The impact of various events and decisions often have an impact on reputation.
A shared understanding of I&T-related failures, compromises, mistakes or events can impact enterprise objectives and result in the loss of direct costs (e.g. financial), or indirect (e.g. customer sensitive) information resulting in reputational damage.
Significant reputational damage or lowered expectations on the part of stakeholders can also result when senior management is thought to be accountable, but fails to take corrective action, or does not adequately represent the corrective action to constituents.
An enterprise’s compliance record can also significantly either positively or negatively affect its reputation in the community and marketplace.
Finance
Financial assets are those that typically show up on an enterprise’s balance sheet and include items such as cash, investments, or accounts receivable.
They receive their value from a contractual claim. Financial assets are subject to many types of risk including market (e.g., currency, interest rate or commodity), credit (e.g., cash flow, regulatory or callable loans) and operational (e.g., inadequate systems or controls, employee errors or system failures) risk.
Nearly every type of risk can have an impact on financial assets of the enterprise.
Having identified your asset, the next step is to protect them against cyberattacks. In this final section, we have highlighted some key steps you can take to protect your organization’s assets from hackers.
3 Steps To Take In Protecting Your Organization’s Asset From Cyberattacks
- Secure Your Infrastructure : These includes physical and IT infrastructure.
Physical infrastructure should be protected using fences, barriers, turnstiles, locks and other features.
IT infrastructure can be protected automatedly from unauthorized access or misuse.Ensure that your networks and database are protected using firewall and encryption.
Regular updating and patching of system software are also very important.
- Educate Your Employees: Regular training and simulation exercises should be carried out within your organization.
Talk to your employees about their role in securing and protecting the information of their colleagues, customers, and the company.
Set policies in place so they know what practices are acceptable and unacceptable.
Limit the number of users within the company who will have administrative access.
This will minimize the amount of programs they will be able to download, therefore, minimizing the risks of downloading viruses and malicious software
- Establish Security and Procedures: This will protect your company from cyber attacks and provide guidelines for resolving issues if they arise.
Outline how situations will be handled and the consequences if an employee violates the policies.
Control physical access to company devices and dispose of them properly. Prevent access to company computers and handheld devices from unauthorized users.
Laptops and cellphones are easy targets for cyber theft since they can be misplaced easily or stolen quickly.
Reset devices that are being disposed of back to factory setting. Never get rid of a cellphone or laptop without completing this step.
Failure to do so could result in company information winding up in the hands of the cyber criminal.
Conclusion
The number of cyber threats and attacks are increasing by the day. It is therefore important that organizations strengthen their efforts to combat cyberattacks.
There should be no loose ends, no door/ gate left open. Cyber criminals are always looking for the slightest opportunity to strike. It is the responsibility of the organizations to ensure that all organization assets are protected.