In today’s digital age, companies are increasingly reliant on technology and online systems to conduct their business. As a result, meeting the minimum standards for cyber hygiene is essential for protecting against cyber threats, minimizing risk, and ensuring the ongoing viability of the business.
Basic security hygiene still protects against 98% of attacks.1
Want to reduce attacks on your accounts? Turn on MFA. Multifactor authentication, as its name suggests, requires two or more factors of verification. Compromising more than one authentication factor presents a significant challenge for attackers because knowing (or cracking) a password won’t be enough to gain access to a system. With MFA enabled, you can prevent 99.9% of attacks on your accounts.2
Multifactor authentication—while extra steps are part of the name, you should try to choose an MFA option with the least amount of friction (like using biometrics in devices or FIDO2 compliant factors such as Feitan or Yubico security keys) for your employees.
Avoid making MFA onerous.
Choose MFA when extra authentication can help protect sensitive data and critical systems rather than applying it to every single interaction.
MFA does not have to be challenging for the end user. Use conditional access policies, which allow for triggering two-step verification based on risk detections, as well as pass-through authentication and single sign on (SSO). This way end users don’t have to endure multiple sign-on sequences to access non-critical file shares or calendars on the corporate network when their devices are current with the latest software updates. Users also won’t have 90-day password resets, either, which will significantly improve their experience.
In a phishing attack, criminals use social engineering tactics to trick users into providing access credentials or revealing sensitive information. Common phishing attacks include:
If you’d like to learn more about the topic of password and identity, please take a look at the Microsoft resources below.
Zero Trust is the cornerstone of any resilience plan limiting the impact on an organization. A Zero Trust model is a proactive, integrated approach to security across all layers of the digital estate that explicitly and continuously verifies every transaction; asserts least-privilege access; and relies on intelligence, advance detection, and real-time response to threats.
Too much security—that is, security that feels overly restrictive to the everyday user—can lead to the same outcome as not having enough security in the first place—more risk.
Strict security processes can make it hard for people to do their job. Worse, they can inspire people to find creative shadow-IT–style workarounds, motivating them to bypass security entirely—sometimes by using their own devices, email, and storage—and using systems that (ironically) are lower security and present a higher risk to the business.
If you’d like to learn more about the topic of Zero Trust, please take a look at the resources below.
Use extended detection and response anti-malware. Implement software to detect and automatically block attacks and provide insights to the security operations.
Monitoring insights from threat detection systems is essential to being able to respond to threats in a timely fashion.
Move as much of the work as possible to your detectors
Select and deploy sensors that automate, correlate, and interlink their findings prior to sending them to an analyst.
Automate alert collection
The security operations analyst should have everything they need to triage and respond to an alert without performing any additional information collection, such as querying systems that may or may not be offline or collecting information from additional sources such as asset management systems or network devices.
Automate alert prioritization
Real time analytics should be leveraged to prioritize events based on threat intelligence feeds, asset information, and attack indicators. Analysts and incident responders should be focused on the highest severity alerts.
Automate tasks and processes
Target common, repetitive, and time-consuming administrative processes first and standardize response procedures. Once the response is standardized, automate the security operations analyst workflow to remove any human intervention where possible so that they can focus on more critical tasks.
Continuous improvement
Monitor the key metrics and tune your sensors and workflows to drive incremental changes.
Maintain constant vigilance
Use integrated XDR and SIEM to provide high quality alerts and minimize friction and manual steps during response.
Batten down legacy systems
Older systems lacking security controls like antivirus and endpoint detection and response (EDR) solutions can allow attackers to perform the entire ransomware and exfiltration attack chain from a single system.
If it’s not possible to configure your security tools to the legacy system, then you must isolate the system either physically (through a firewall) or logically (by removing credential overlap with other systems).
Don’t ignore commodity malware
Classic automated ransomware may lack the sophistication of hands-on-keyboard attacks, but that doesn’t make it any less dangerous.
Watch out for adversary disabling security
Monitor your environment for adversary disabling security (often part of an attack chain) like event log clearing—especially the Security Event log and PowerShell Operational logs—and the disabling of security tools and controls (associated with some groups).
Unpatched and out of date systems are a key reason many organizations fall victim to an attack. Ensure all systems are kept up to date including firmware, the operating system, and applications.
Knowing your important data, where it is located and whether the right systems are implemented is crucial to implementing the appropriate protection.
Although threat actors continue to evolve and grow more sophisticated, a truism of cybersecurity bears repeating: Basic cyber security hygiene—enabling MFA, applying Zero Trust principles, keeping up to date, using modern anti-malware, and protecting data—prevents 98% of attacks.
For help protecting against cyber threats, minimizing risk, and ensuring the ongoing viability of your organization, meeting the minimum standards for cyber security hygiene is essential.
Follow Microsoft Security