Cybersecurity 101: Protecting Yourself When an Attack Comes Part 2 February 9, 2024 – Posted in: Cyber Security, IT Support – Tags: cybersecurity, cybersecurity 101, it support, ITSupport

Limiting What an Attacker Can Do Once They Get In

There is a principle in cybersecurity called the Principle of Least Privilege it means that everyone has access to only what they need in order to do their job. Even the CEO.

It’s not about trusting your staff, it’s about minimising what a malicious actor can do if they manage to steal someone’s logins.

If you think about it like securing a building, you build your perimeter fence, you have your big door at the front and it all looks safe. But your staff need to get into the building, so you give them a key to the door. Each key represents a potential risk that a malicious actor might steal it and get in. So rather than just having a big front door, you put a door on each office. If every key opens every door in the building, the risk hasn’t been reduced by much.

Each staff member will have to access certain offices to do their job, so we accept the risk of giving them a key that gets them into those offices. But there’s no need to accept the risk that their key could get a malicious actor into offices that staff member would have no reason to go to. So we create a set of rules for keys. For example Admin staff might need regular access to the Admin office and the Sales office, but have no reason to go into the Marketing office. So we design them a key (user account) with that access.

Getting Your Data Back After an Attack

Backups. Backups. Backups.

Whether you face a physical disaster or a cyberattack the only way to be sure of being able to get your data back is by having a secure copy held in the cloud or offsite. The important thing is to make sure that your backups are physically and digitally separate from your originals. This minimises the risk that whatever happens to your live site does not also affect your backups.

As well as making sure you regularly back up your data, we would advise that you ask your IT Company to provide a quarterly to annual restore test, to make sure that they can restore from your backups.

In our next Cybersecurity 101 article we will summarise the key takeaways for cybersecurity on a budget. If you have any concerns about cybersecurity, or would like to discuss any other IT Support needs you might have please give us a call on 01245 265100.