5 Ways Companies Can Secure Their Networks Against Cyberattacks

Recent events in Eastern Europe have the private and public sectors scrambling to shore up their cybersecurity defenses. U.S. Intelligence and national security agencies have sounded the alarm. They are concerned that Russia may retaliate against foreign nations via cyberattacks. 

Ukraine reportedly has been under constant denial of service attacks since the beginning of the Russian invasion. While there hasn't been a larger-scale cyberattack yet, U.S. officials are still concerned about the threat — especially given the number of notable Russian-led hacks that have occurred in recent years.

Though cyberattacks primarily target energy and financial industries, like the 2021 Colonial Pipeline ransomware attack, experts say that digital adversaries will not stop there. 

Subsequent waves of attacks are expected against other businesses, both big and small. Ransomware attacks could be especially problematic. 

"Many organizations simply aren’t prepared to deal with a ransomware attack," says CBT Nuggets trainer and cybersecurity expert Bob Salmans. "The lack of a timely response greatly increases the scope of impact."

Companies must be extra diligent in preparing for cyberattacks, starting now. Here are five things companies can start doing to better secure their networks.

1. Update, Update, and Update!

It's surprisingly easy to find businesses that may be easily exploited. There are search companies that scan the internet for vulnerable computers.

Once an attacker finds a vulnerable system, it's easy to find proof-of-concept pieces of software that exploit discovered vulnerabilities. That's almost everything they need to break into your network.

It's easy to mitigate this, though. Update your software. 

If you don't have a system or routine to patch software and hardware, create one. There are tons of different services available to help businesses with the update management process. It's that easy.

2. Patch Up any Security Flaws

Patching security flaws could fall under updating your software and hardware, but patching security flaws requires extra emphasis. Sometimes software and hardware aren't patched automatically. Also, some vendors may not release automatic patches for various reasons. 

Either way, you need to ensure that you patch security flaws. Here's how to make sure you stay on top of what might need to be patched. Create or update a patch plan for your organization. After you have a patch plan in place, make a list of all the hardware and software you use in your organization. 

Then you'll want to subscribe to newsletters from any hardware/software vendors your organization uses. This will help ensure that you're notified when patches are available for those products. Not every patch update is automatic. For good measure, you also should subscribe to the NIST newsletter. 

There are other resources that can help you stay up to date on recent vulnerabilities — almost in real-time. Bookmark these sites for easier access:

• U.S. Cybersecurity and Infrastructure Security Agency (CISA)

• National Vulnerability Database

Staying on top of security trends has never been more crucial, so don't put off patching up any security flaws any longer.

3. Create Plenty of Backups

You can mitigate ransomware attacks until you are blue in the face, but the only way to ensure ransomware doesn't tank your business is by making multiple, immutable backups. 

Normal backups are great, but ransomware attackers have gotten wise enough to encrypt or delete those. That's where immutable backups come into play. Immutable backups cannot be edited or changed. That means ransomware attacks cannot encrypt immutable backups. 

There are a variety of services and methods for creating immutable backups. For example, you can use a service like Carbonite — or a combination of AWS S3 and Duplicati. Both will create immutable backups.

If possible, keep your backups off your networks. By keeping them offline and secure, the only attack vector remaining against those backups will be a physical attack. 

Ransomware attacks are becoming more sophisticated. There is a constant cat and mouse game going on between security researchers and cybercriminals. Unfortunately, there will always be new methods of implementing ransomware attacks. But immutable backups make it much harder for ransomware attacks to be successful.

4. Require Multiple Passwords

Much like attackers can use Shodan to find vulnerable PCs, other tools exist to help search for leaked passwords online. It's human nature (though not secure) to use the same password for all our online activities. Even IT pros are guilty of using the same password.

But this risk can be mitigated by using multiple passwords. One of the best ways to ensure that employees use multiple passwords is by implementing two-factor authentication, also known as 2FA.

2FA comes in many forms. Google and Microsoft, for example, use their apps for authentication. If someone tries to log in to their respective accounts, these apps send a notification to the user's device that they must interact with before signing in. 

Another option is a one-time password. These are rotating passwords, typically 6-8 digits long, that change every 30 seconds. How's that for ensuring there's a different log-in password every time?

5. Train Your End Users

Your network is only as strong as its weakest link. Let's face it. We, humans, are typically the weakest link. Even the most advanced cyberattacks typically start with social engineering and phishing. 

Train your end users to recognize these types of attacks. Most cyberattacks can be thwarted before they begin if your end-users know how to respond. Make sure they understand how to use passwords, how to recognize phishing attacks, and how to say "no" to strangers. Salmans stresses that it's especially important for smaller businesses to make sure their workforce is properly trained and prepared. 

"Small businesses are susceptible to cyberattacks because many of them come through email-based attacks," Salmans says. "I believe they should focus on end-user security training and email security mechanisms to get the most for their security budget."

With the right training and awareness, your end users can go from being a weak line to a line of defense against cyberattacks. 

Is Your Organization Prepared?

There's never been a better time than now to get your business ready to defend against cyberattacks. That means training both your team and yourself. Your IT team will always need to stay up-to-date on the latest security trends. And just as importantly, practice those skills

"Organizations hire skilled individuals but we all lose skills if we don’t use them," says Salmans. "That’s why security incident exercises are a critical part of any security team. Practice makes perfect. We don’t have to be perfect but we need to be pretty darn close."

We've known that the digital landscape has become more volatile over the last decade. Russia has stated that it will retaliate, and cyber security professionals are sounding the alarm. It's not a matter of if your organization will be attacked, but when. So, start reviewing your security policies — and begin training right now.