The digital “defense-in-depth” terminology includes all actions and activities to effectively protect information systems from cyberattacks and demonstrates practical actions to limit and counter the most common types of attacks on systems, applications, and the internet.
In our current analysis we will present this guide of how to protect your enterprise or organization against cyber-attacks which is called digital “defense-in-depth” that using it in conjunction with our analysis entitled “How is the Digital Shielding of a Country and a Company achieved” one can guarantee the digital security of your business or organization.
by T.C.
©The law of intellectual property is prohibited in any way unlawful use/appropriation of this article, with heavy civil and criminal penalties for the infringer.
The basis of any action should be the methodology applied each time to approach the risk with aim this risk to be successfully addressed. This methodology will develop the required and highly effective information security management system to optimally achieve the protection of confidentiality, integrity, availability, and privacy. In more detail:
1. Security policies, guidelines and procedures should be developed to protect the good of information and the related systems. These actions should be extended to suppliers of services and goods, as well as to service providers (digital cloud).
2. You should use the appropriate, personalized, and up-to-date, centrally managed anti-malware software. At the same time, a patch management plan should be applied to the scheduled installation of security updates on operating systems and applications.
3. Proper IT accounts management and access control means that:
– Access to information and systems should be based on roles and tasks and always applying the “need-to-know-basis” and ‘least privilege’ approach.
– IT (Information technology) accounts should be used exclusively for administrative tasks. Additional measures could be implemented where necessary e.g. the use of one computer only for management of the system as well as the authentication of two factors approach (two factor authentication).
– It is recommended to use strong passwords at least ten characters long with a combination of capital and small letters, special characters, and numbers.
– Our advice is to keep log files on the network, servers, operating systems, and applications, which will be regularly checked for attacks and attempts to breach systems.
4. A multi-level digital defence should be applied. More specifically:
– On the outer perimeter this is achieved using firewalls, IDS (Intrusion Detection Systems), IPS (Intrusion Prevention Systems), access control lists etc.
– In the internal digital environment this multi-layered digital defense is achieved by segmenting the network (either virtually or physically) and applying access rules (both to users and devices) and restricting permissions, as well as creating DMZ.
5. Regularly conduct staff awareness programs and security awareness training. The largest proportion of cyberattacks are carried out through social machine attacks (i.e. phishing email, spam).
6. Remote access to the system of the enterprise or organization should be done using VPN with strong encryption, as well as using two-factor authentication.
7. Implement an incident response plan that includes clear roles and actions and is tested on a periodic basis.
8. You should regularly keep a back-up files of your data so that you are always able to recover them in any loss situation. In addition, backups of critical and sensitive data should be stored and kept in a secure manner and access restricted.
9. You apply encryption mechanisms to critical and personal data held in the business or organization. In this way you guarantee that the confidentiality and privacy of this data will be valid at all stages of their lives.
10. Implement measures to protect and recover from natural and environmental threats (electricity disruption, all types of natural disasters, etc.).
By applying the above cyber-attack protection guide you will have achieved the best performance of your digital security systems in any type of malicious attack that your business or organization can receive.
