Your IT infrastructure should be like an unconquerable fortress. The more layers of protection, the less chance the consequences of a cyberattack will be devastating. But when it comes to crunch time, people tend to make mistakes – especially when they’re working remotely. If you want to avoid data breaches, use two-factor authentication and encryption on all devices.
Even before the huge jump in numbers of people moving to remote work in response to the COVID-19 pandemic, more than 7% of remote users or devices had been successfully phished. According to a 2019 IBM Security – Cost of Data Breach Report, 49 % of inadvertent breaches studied in this report happened due to human error.
This often occurs on devices that were lost in the work area or vehicle. To prevent cybersecurity issues linked to remote work, and to ensure the continuity of your business, you should extend the protection of your devices and sensitive data as much as possible. The right encryption solution and the implementation of two-factor authentication can help you with that.
Read more: Richard Brulík on insider threats
Encryption: A shield against computer viruses and fines
Encryption is the process of encoding information so that it cannot be accessed by unauthorized persons. If your company’s encrypted data is leaked, anyone who steals the data will not be able to read it without the proper decryption key. This process is designed to protect money and valuable information. And in the business environment, encryption should also be used to protect intellectual property, know-how, or personal data you process within your company.
All companies have customer lists, proprietary information, sales-related data, or staff and HR information that shouldn’t fall into the wrong hands. We can imagine a scenario in which an employee loses his or her smartphone, one with weak password security, which may ultimately lead to unintentional exposure of some sensitive data. Or another, in which an employee may bring a personal laptop to work, unfortunately one that contains malware that allows its operator to make changes to the administrative rights, security settings or other sensitive inputs.
Now, if your data is not encrypted, anyone can read it. And it might be released, publicized, or used for other malicious purposes.
If you want to avoid such a situation, think of implementing an encryption solution that makes it virtually impossible for hackers to read stolen data. An encryption solution allows you to terminate remote users immediately and render data on any device inaccessible, thus effectively mitigating the risk.
Also, many regulations and laws, including GDPR, PCI-DSS, HIPAA, SOX, and GLBA, require encryption. If personal data is properly encrypted, data breach incidents are much less likely to be regarded as compliance failures.
What does multi-factor authentication add to your business?
Multi-factor authentication (MFA, also referred to as two-factor authentication or 2FA) is a method used to verify a user's identity. It requires the user to provide another piece of information on top of the username and password, typically a one-time passcode. Due to an increasing number of malware attacks on mobile devices, good MFA solutions refrain from using SMS verification, and instead, opt for push notifications, which are more secure and user-friendly. Biometric verification like fingerprints or a face scan can also be used. Keep in mind that a good multi-factor authentication should be easy to use – it should not hinder your employees’ productivity or make their jobs more difficult.
Good password hygiene is crucial, but it’s difficult to maintain for many businesses. According to a NordPass study from 2020, an average person has around 100 passwords to remember, even though the sad fact is that the majority of people use the same password for multiple (if not all) logins. Although it may seem that the number of passwords each of us needs is growing and growing – 27% of UK citizens add more than four new password-protected accounts a year – the future lies in more secure forms of identification such as FIDO2. In the meantime, it is highly recommended to use MFA as an extra layer of protection to keep your business safe if credentials get lost or stolen. Unfortunately, it is still true that, by breaching passwords, hackers can bring your company down – just like they did in the case of Xander Koppelmans.
Companies that use cloud-based software or have employees sign in through a virtual desktop should require MFA for everyone because it lowers the probability of breached passwords and entry of uninvited guests into their network if a device is lost or stolen. It also protects you against phishing emails. If someone sends you a fraudulent email that tries to trick you into logging in with your username and a password to a fake site, MFA can still protect you, because only the legitimate site will send you a working MFA code.
Encryption and MFA will help you build a more secure IT infrastructure, both in-house and with remote workers.
