Top 10 key cybersecurity recommendations for 2019

By Jacqueline B. Lee
BridgeTower Media Newswires

Cyberattacks are increasing in sophistication and magnitude of impact across all industries globally. According to a recent report issued by the U.S. Securities and Exchange Commission, the average cost of a cyber data breach is $7.5 million and is continually increasing in value year over year.

While all organizations are potential targets of cyberattacks, the industries which possess the most valuable data are the biggest targets including: financial services, healthcare (including non-profit organizations), government, automotive, manufacturing and retail.

Law firms are also a known target for cybercrooks.

All organizations possess valuable information assets, which may include: intellectual property, financial payment information, client information, supply chain partners’ information, personally identifiable information, protected health information and/or payment card information.

Cybersecurity attacks are becoming more common every day, and yet many organizations think these attacks won’t happen to them. The increase in attacks show that any organization can be a target — and having proper IT security in place is only one of many preventive measures that should be taken. Here are some of the cybersecurity best practices you should consider for 2019:

Conduct email threat assessments

Given the increasing number of cyberattacks via email systems, companies are increasingly looking to conduct periodic email threat assessments, especially to detect malware that made it through their anti-virus software and firewalls which have previously gone undetected.

Perform network and endpoint threat assessments

With the expansion of information systems, software applications, bring-your-own-devices practices and the Internet of Things, organizations are increasingly testing their network and endpoints via threat assessments using sophisticated Intrusion Detection Systems to reduce potential vulnerabilities to cyberattacks.

Conduct spear-phishing campaigns

Due to the significant increase in spear-phishing attacks (where fraudulent emails appearing to be from a supervisor are sent to employees to cause them to reveal confidential information or provide bank account information), organizations should periodically test the cyber-awareness and susceptibility of their employees to cyberattacks via engaging certified ethical hackers who can conduct social engineering-based spear-phishing exercises. IT security firms can provide additional training to employees on what to look out for when receiving this type of email.

Perform vulnerability assessments and penetration testing

Most organizations either internally conduct or hire an independent firm to perform some form of vulnerability assessments, via computer malware scanning software, and penetration testing to discover potential external vulnerabilities to cyber-attacks. It is important to conduct these tests at least once a year but, twice or quarterly is better given the constant evolution of cyberattacks.

Implement an effective and timely software patch management program

The most significant cyber data breaches in the past two years all resulted from organizations’ not implementing an effective and timely software patch management program of Microsoft and Cisco software.

Establish a cybersecurity awareness/education program

The cost effective means to improve cybersecurity is to create a human firewall by providing quality cybersecurity educational programs for all of your employees from the top of the company to the bottom. This education should be mandatory for all employees with any access to electronic data, including email.

Conduct cybersecurity risk assessments

It is important to independently verify that an organization’s cybersecurity policies, plans and procedures are sufficient to adequately protect the organization’s digital assets and to ensure regulatory compliance with the appropriate industry cybersecurity standards.

Implement an incident response program

It is critical that every organization has a well thought through and periodically tested incident response program, including: policies, plan, process, procedures, standard forms and periodic exercises and/or simulations.

Ensure continuous monitoring, detection and response.

Every organization should invest in an appropriate level of monitoring, detection and response services based upon the cyber threats their organization encounters or anticipates. The key is to rapidly detect intrusions to quickly contain and eradicate the malware to reduce negative impacts upon the information system and data assets.

Invest in business continuity planning/disaster recovery to ensure resilience.

Given the high probability of a cyber data breach, it is essential to have a reliable and secure off-line data back-up system to ensure minimal impact to the organization’s operational performance, and protection of the most valuable digital assets from loss or damage.

**

Jacqueline B. Lee, CPA, is a partner with Mengel, Metzger, Barr & Co. LLP in Rochester, New York.