Manage Pressing Risks with EPL-Risk.com

A one-stop hub for practical, timely and actionable insights, tools and training that may save thousands of dollars by minimizing potential loss exposures, human resources expenses, training costs, and attorney fees.

Stay on top of current workplace issues, legislation, and employment trends with:
  • Articles, News Briefs, and Checklists
  • Interactive Training Modules
  • Model Handbook with 100+ Template HR Policies, Procedures, and forms

Today's Workplace

How AI Will Determine The Future Of Malware

AI may soon be an organization's best and only defense against increasingly dangerous malware. Learn why.

Continue Reading

Network Attacks Hit A Three-Year High: How Should Employers Respond?

As workers return to the office, the rate of malware detection has increased. We examine the risks facing employers.

Continue Reading

Beyond Passwords: Three Big Ideas To Improve Cyber Defenses

New ways of thinking about increasingly sophisticated cyber threats are needed to meet those challenges. Learn more.

Continue Reading

Beyond Passwords: Three Big Ideas To Improve Cyber Defenses

According to HP's Chief Information Security Officer, three approaches are needed to better manage the cybersecurity threats facing employers today.

Those approaches are to:

·      develop overall resilience against multiple threats

·      share useful information with other cyberattack victims to better protect the business community as a whole, and

·      seek workers with nontraditional skill sets to fill open cyber defense jobs.

The first approach is to recognize the need for resilience to counter the shift from the traditional paradigm of a one-on-one attacker-and-victim relationship to address the current trend of "one-to-many" attacks. Cybercriminals are realizing that they no longer need to expend resources on a single victim if they can find a common nexus between many victims, such as a supply chain vendor that services hundreds or even thousands of potential victims. For the same effort, cybercriminals could break into dozens or scores of systems. Thus, the need arises for employers to shift their cyber defense mindset from data protection to overall resilience from multiple sources of infection.

Next, collaboration among public and private sector organizations to understand how attackers are operating will be crucial. Thinking about what is and is not helpful to disclose around breaches is required. Indicators of compromise are often out of date as soon as they are published. The current conversation can be too centered around whether an organization was breached or not.

If, as many believe, breaches are close to inevitable, businesses should focus more on sharing breach findings and post-mortem results that will help others. After all, as HP's global head of security for personal systems explained, cybercriminal organizations are run like businesses now. They have become masters at sharing intelligence, information, and tools to further their objectives. Legitimate businesses should be doing the same.

Finally, the IT industry is short of more than two million cybersecurity professionals globally. Looking beyond the degreed applicants to seeking nontraditionally educated people could bring in workers mid-to-late in their careers who have a rich set of skills in areas such as risk management or communication. "3 Ways We Can Improve Cybersecurity" www.darkreading.com (Apr. 22, 2022).

Commentary

One proactive measure an entity could take is to identify those areas, software, or users that, if successfully targeted by cybercriminals, would have the biggest impact on your network or business operations.

For instance, a weakness in part of the Citrix virtual desktop or server software provided a way for ransomware to be introduced into the system of one Canadian company, while an attack on a third-party timekeeping service brought down the payroll and scheduling system of a major U.S. healthcare system.

Once identified, efforts should be made to keep that service or application up to date and secure. This, coupled with a complete, virus-free backup to take the infected data offline and replace it quickly with a backup set of data, can allow the business to operate and return to normal quickly.

Of course, ensuring that any third-party vendor, supplier, partner, or entity with access to your system has a strong cyber defense mechanism in place is important. Any weakness in your supply chain partners’ system is a weakness in your system.

Finally, your opinion is important to us. Please complete the opinion survey: