Magazine menu Close Magazine menu

Author

Yana Shevchenko

Yana Shevchenko is a Senior Product Marketing Manager at Kaspersky, responsible for promoting enterprise-level solutions addressing advanced threats and targeted attacks, working with industry analysts and business partners worldwide. She’s written many reviews and articles on IT security and actively participates in industry exhibitions and conferences.

Latest stories by Yana

cyberthreats as a physical stronghold

Whether protecting the physical or the cyber world, savvy security works the same way

  • Cybersecurity
  • min read
    • There's not much difference between an advanced cyberattack and a thief breaking into your company's premises. A corporate building has a fence, entrances, corridors, offices and server rooms. IT infrastructure is similar, only here we have a network, workstations, servers, virtual machines and so on. If someone wants to steal from, spy on or disrupt a business, they must sneak into its territory or its network. Judging by the massive security breaches that have dominated the headlines in the past year, attackers favor the latter these days. Fighting targeted cyberattacks has a lot in common with physical protection. Let's consider the three fundamental principles for dealing with a physical breach, and see how these can improve a company's cyber defenses. 1.    Realize you're under attack Before dealing with any attack, you need to know you're under attack. That means noticing suspicious activity and linking it to a plot. Let's say you're at the office late in the evening, and the alarm system goes off on the second floor. A security officer goes to find out what's wrong. At the same time, a pizza delivery person arrives and hands a pizza over to someone from accounting, gets their money and leaves. That's all perfectly normal, but if you look closer, you may notice a string of coincidences. The alarm went off at about the same time a few days ago, accountants (unlike IT staff) don't typically order pizza, and this one usually complains about gluten intolerance. Putting these clues together, a perceptive security officer might ask some questions. The same principle applies to detect cyberattacks. Separate activities inside the network might not, on face value, show an organization is under attack. But look at the bigger picture, and it might suddenly seem critical to investigate. Threat management and defense do just that: automatically detects and flags malicious patterns behind separate, simpler, seemingly unrelated activities in the network. 2.     Start investigating Coming back to our mystery pizza scenario, to begin investigations, the security officer could go to the camera room and look through the recordings. She would know there are smart cameras all around, letting her see any corner of the office at any time, and the records can't be erased. On the footage, the security officer sees the pizza delivery person jumped out of a black minivan… not the usual vehicle for pizza delivery, right? The gluten-intolerant accountant didn't order a pizza; he ordered spy equipment that he's planning to plant under the CEO's desk. Like smart cameras, anti-targeted attack software reviews network traffic for security purposes. Endpoint Detection and Response (EDR) software watches for cyber-threats too. It sees what's going on at end-user devices (desktops, laptops, mobile devices) and gives the retrospective data needed for an investigation, even when devices are compromised, or when cybercriminals have destroyed or encrypted data to cover their tracks. 3.     Know where to look To spot the right things at the right time, you need to know where to look. That's why it's so crucial that security teams in large corporations get the right training and experience. There's also information. Access to police reports and databases is helpful in physical corporate security. In the scenario I've described, the security guard could run the minivan license plate numbers through the police system to see if it's been stolen or used in similar operations. And once again, the same applies to investigate cybersecurity incidents. You can use threat intelligence data tailored to your industry or location, and you can get specialized training for your IT security team; you can even outsource cyberthreat protection to an experienced third party. Build your cyber fortress We've seen that in many respects, you can use the basics of protecting your premises when building your cyber fortress. With these solutions and services combined, your teams will get ahead of the cybersecurity agenda. You will always have the answer to even the most advanced attacks.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries