It doesn’t matter if you have a degree in computer science or if you don’t know the difference between a PC and a Mac, understanding the complexities of cybersecurity and learning how to protect your company is daunting.
COVID taught us a lot of things but one huge takeaway is that our dependence on technology is growing and not slowing down anytime soon. Just last year alone, ecommerce sales increased 44% in the US. And while this uptick in technology usage has afforded us a world of benefits, it also comes with increased risk. It has never been more important for you to take cybersecurity seriously. Protecting your business assets as well as your customer and employee’s personal information is absolutely critical.
In today’s online world, protecting your business assets as well as your customer and employee’s personal information is absolutely critical. Recent studies show that computers are hacked every 39 seconds. Recycling passwords, clicking on irrelevant pop-up advertisements and mis-trusting spam mail are common ways that a virus can compromise your computer system.
The number of victims rises every day. Understanding how to prevent cybersecurity attacks can help mitigate any possible bugs as well as protect company assets and clientele relationships. Data breaches affect everyone involved in the company.
In June, Microsoft displayed a series of vulnerabilities in the Windows Print Spooler Service. Known as the Print Spooler Bug to some, and “PrintNightmare” to others, this breach allows attackers to gain full user rights to a system and all its data. This Windows bug has been known to open up a deadly EoP (elevation of privilege) hole.
Though Microsoft eventually released a patch for the Print Nightmare it wasn’t long before the bug’s just-as-nightmarish younger brother made an entrance. To make matters worse, it wasn’t until July that Microsoft realized the bug could be used for RCE (remote code execution) as well. In other words, cybercriminals could now make their way into user systems without passwords. Even if users applied a patch to protect them from the first bug.
As inconvenient as it was, Microsoft recommended that users turn off their printers entirely to prevent the new bug, CVE-2021-34527, from being triggered. IBM reports that the average cost of a data breach is almost $4 million. Which isn’t even accounting for your company’s discredited reputation.
The vulnerabilities uncovered in the Windows OS are quite serious. Having control of a system is much more than having the ability to log in. Attackers can have access to bank statements, health information, employee records and any vulnerable data that may be stored on a computer. They may also use their privilege to install or uninstall software, threatening your network and of greater interest to us the Milestone installation. Vulnerabilities within Microsoft’s OS, the ever-present IoT threats, and social engineering are of increasing importance.
Regardless if you’re a large business or a local franchise, system surveillance should be at the top of your priority list. The reality is that anyone can get hit.
But, what are you going to minimize risk?
To start protecting your company from attacks, the first and most important step is to stay informed on the health and security of your system. Stay up to date on health updates from Microsoft and don’t shy away from researching what other security researchers are saying online.
Continue to perform patch updates on your servers and print spoolers, such as the following patch updates released by Microsoft:
There are unfortunately no updates to ensure your company’s safety from PetitPotam.
We’re left with only being able to mitigate a potential attack by disabling NTLM in your domain or looking over Microsoft’s mitigation techniques if disabling isn’t an option.
What we have seen is that oftentimes vendors will release a product with firmware good enough to run, but little to no consideration for cybersecurity and security hardening. The best way to secure your system from IOT attacks is to find vendors and manufacturers that take cybersecurity seriously.
Those in the physical security and surveillance industry, like us, should look to vendors like Axis, Hanwha and Bosch that feature built-in cybersecurity measures and update your firmware and passwords regularly to stay ahead of potential threats.
P.S. consistently changing your camera passwords will help you to keep your VMS secure but without the right tools, that may be a tedious task that is easier said than done. With The Boring Toolbox's password manager, you can perform bulk operations to update your all of your XProtect camera passwords at the same time.
While it’s straightforward and simple to run updates and health checks throughout your system, things get a lot more complicated when you get humans involved.
People are without a doubt the weakest link in cybersecurity. With complex emotions, decision-making, and so much room for human error, the risk level for security breaches skyrocket.
To protect your company from social engineering, train your staff to think critically about their interactions, both on and offline. The internet is a dangerous place. And being naive about the possibility of hacking puts your company, clients, staff, and system in further danger.
Start with training courses. For example, Wizer offers a curriculum to teach your staff how to be safe on the internet.
An essential layer of protection is endpoint security. Forget the antivirus of old.
There are new versions of endpoint security out there using a technology called EDR/XDR. The new technology employs machine learning to look beyond the signatures and find anomalous behaviors within a file system or communication stack. More importantly, record and allow for the rollback of files or registry keys in the event of an attack.
For a more hands-off approach, MDR (Managed Detection and Response) allows you to offload the “threat hunting” to a professional organization. Said organization will constantly monitor your systems and remediate them without having to employ your own security team.
As harsh and cliche as it sounds, trust no one.
Zero Trust Network Access (ZTNA) provides access to networking resources internally and externally based on your identity, as opposed to just making implicit assumptions of trust.
Read more about ZTNA in this article from CloudFlare.
Your go-to XProtect eXPerts. We learn the technical stuff that will save you time and make it less boring.
Your go-to XProtect eXPerts. We learn the technical stuff that will save you time and make it less boring.
The Boring Lab's Official Dad Joke Generator — Perfect for those who love to delight their friends, families, and colleagues…
Standardizing camera brands in your security system simplifies management, enhances reliability, and prepares your system for seamless future growth—discover five…
From camera and storage health monitoring to multi-site visibility, these are 6 features you should look for in a VMS…
Subscribe to get a monthly dose of security & surveillance industry news and insights, Milestone VMS time-saving tricks, tips for hacking your way out of boring work sent directly to your inbox!
