Posts

Cybersecurity Tips

Cybersecurity TipsCybersecurity Awareness Month, now in its 18th year, aims to raise awareness about the importance of cybersecurity in both our professional and personal lives.

Held every October, Cyber Month is a collaborative effort between government and industry to ensure that individuals, organizations, and businesses have the cybersecurity tips and resources they need to be safe and secure online.

Every year, led by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cyber Security Alliance (NCSA), Cybersecurity Awareness Month sends a clear message about security and the importance of partnership between government and industry, from the White House to individuals.

Doing our part to help raise awareness, Coretelligent will be sharing information and resources to help keep your business safe from cybersecurity threats.

To kick things off, we have put together a list of cybersecurity tips as a quick introduction to persuade your team to assess your firm’s current security readiness from a cyber attack. Stay tuned throughout October for more cybersecurity tips and resources.

Cybersecurity Tips for Good Corporate Cyber Hygiene

  1. Double (or triple) up on login protection.

    Enable multi-factor authentication (MFA) across your organization for all accounts and devices to ensure that only authorized users gain access to your secure data. CISA’s Multi-Factor Authentication (MFA) How-to-Guide is a good resource for more information.

  2. Shake up your password protocol.

    According to the NIST guidance, users should consider using the longest password or passphrase permissible. Encourage end-users to switch up passwords across applications, accounts, and websites. Using unique, strong passwords can make it more difficult for cybercriminals to gain access and protect your organization in the event of a breach.

    A password manager and online password generator can be employed to generate and for remembering different, complex passwords. Another solution is to employ SSO to control passwords centrally and avoid user password sprawl across various platforms, which can lead to poor password choices, reuse, and insecure safekeeping.

  3. If you connect, you must protect.

    Whether it’s a laptop, smartphone, or another networked device, the best defense against viruses and malware attacks is to perform updates on a regular basis to verify that the latest software updates get applied to your software, browser, and operating systems.

    A plan that includes the automatic security update is a critical layer of security and part of a multi-layered defense strategy.

  4. Don’t get hooked.

    Cybercriminals use phishing tactics, hoping to fool their victims. So if you’re unsure who an email is from—even if the details appear accurate— or if the email looks phishy, do not respond and do not click on any attachments or suspicious links in emails.

    Instead, report the phishing attempt to help your IT team and email provider block other suspicious fake emails before they arrive in your inbox. In addition, the use of random phishing simulations are a valuable exercise to help end-users spot phishing attempts.

  5. Beware of social engineering traps.

    Many people don’t realize that much of the posts seen on social media asking for seemingly random details are created by criminal networks. They use these posts to gather data that can be mined for potential passwords and other secure information.

    For example, posts like, “What car do you wish you still had?” or “Tag your childhood best friend” can be used to help criminals work out the answers to your security questions.

    Not only can these tactics impact personal data, but are used to target employees in order to gain access to corporate networks. Read CISA’s Social Media Cybersecurity Tip Sheet for more information about good social media and cybersecurity practices.

  6. Don’t forget about mobile.

    Most connected Internet of Things devices are supported by mobile applications. Mobile devices are often filled with suspicious apps running in the background, or using default permissions users never realized they approved, that are gathering personal information and login credentials without user being aware.

    A robust cybersecurity posture should include a plan for protecting data from employees using compromised mobile devices to access to corporate networks.

  7. Stay protected while connected.

    Utilizing Virtual Private Network (VPN) for employees remotely connecting is the best way to protect networks. A VPN creates a secure connection that encrypts information so that it’s hidden as it travels. This connection makes it harder for attackers to see and access data.

    VPNs are essential when accessing sensitive data like personally identifiable information (like social security numbers) or protected health information, especially when using public wi-fi networks. In today’s hybrid workplace, VPNs are a must to protect against suspicious activity.

From a phishing attack to a ransomware attack, cyber threats are constantly evolving. If you are unsure whether your firm employs good cybersecurity hygiene practices or not, then it may be time for a security check-up.

Remember, cybercriminals will use any security vulnerabilities they can find to gain access and steal data. You can start with these cybersecurity tips and move on to using our free Cybersecurity Checklist to review your security measures.

Coretelligent is here to help with advice from our cybersecurity experts. Protect your business and learn more about our enhanced managed cybersecurity services designed specifically for small-to-mid-sized companies. Reduce your risk from security incidents – contact us today for help responding to your cybersecurity gaps.

Cybersecurity for RIAs

Cybersecurity for RIAsOn February 9th, the Securities and Exchange Commission (SEC) voted to create new and amend existing rules around cybersecurity risk management for registered investment advisers (RIAs) and funds.

“The proposed rules and amendments are designed to enhance cybersecurity preparedness and could improve investor confidence in the resiliency of advisers and funds against cybersecurity threats and attacks,” said SEC Chair Gary Gensler.

The rules would oblige RIA firms to develop and implement written policies and procedures to reduce cybersecurity risks that could harm clients and fund investors. The proposed regulations would also force advisers to report cybersecurity incidents like data breaches involving client information to the SEC.

Additionally, the proposed changes call for publicly disclosing cybersecurity risks and any significant incidents from the last two fiscal years in their marketing materials and registration statements. The SEC is also proposing new recordkeeping requirements to improve the availability of cybersecurity-related information and help streamline the SEC’s inspection and enforcement capacity.

Reach out if your firm needs assistance complying with and implementing these and other cybersecurity compliance standards. Coretelligent offers solutions, including CoreArmor and CoreBDR, to meet the compliance requirements and security needs of the RIAs, advisory firms, and other financial advisors. With over 16+ years of practice helping clients navigate a multitude of IT compliance regulations and strengthening their cybersecurity program, we can help your firm understand and meet its regulatory requirements.

 

How to Effectively Assess Enterprise Backup Solutions?Disasters and cyber-attacks happen, but data loss does not have to be inevitable. Data loss can be avoided or mitigated with a robust backup and disaster recovery solution (BDR). Surviving a catastrophic data loss event depends on choosing the right BDR solution. But you need to understand the critical components in order to successfully evaluate enterprise backup solutions.

What is BDR?

Comprehensive BDR solutions offer recovery options for various data loss scenarios. Determining the correct solution is a deliberate and tactical process that evaluates business data, applications, operations, and risk exposure.

Solutions often include a hybrid of daily backups and more frequent replication of virtual servers to a secondary storage site for rapid recovery. They may also include cloud-to-cloud (C2C) backup, especially for companies that use SaaS applications like Microsoft365. Daily backups provide long-term recovery capabilities. While backup replication allows for the rapid failover of business operations to a disaster recovery (DR) site.

At this point, it’s important to point out the pitfall of relying on a primary cloud provider as a backup source for your data. Several of the larger cloud services note that they are not responsible for maintaining the integrity of data stored on their systems. Instead, it is critical to choose a BDR partner with an appropriate backup and disaster recovery solution. A true BDR solution involves more than just having a second copy of your data. A BDR process ensures that your data is redundant, accessible, and viable.

What Does a Secure BDR Solution Encompass?

Every company has its own set of data recovery requirements. Therefore, recovery point objectives (RPOs) and recovery time objectives (RTOs) will vary. RPOs identify how often data should be backed up or replicated. In contrast, a RTO describes how quickly data can be recovered.

Furthermore, regulatory or compliance standards must be evaluated to see whether they have any consequences for data security. For example, financial services and life science companies are subject to stringent rules regarding the protection of digital assets.

Another necessary element in a data backup and disaster recovery strategy is developing and documenting a BDR plan. A BDR plan includes procedures for recovering data and systems, testing and validation methods, and identifying essential recovery personnel. This plan is crucial to ensure business continuity.

A final must-have component for any BDR plan is testing the recovery process regularly. Any difficulties or failures discovered throughout the testing process can be recorded and analyzed for modifications to the BDR strategy. In addition, test laboratories can be set up within a “sandbox” environment to minimize disruption to the manufacturing environment.


The ABCs of BDR WhitepaperWhite Paper Download

The ABCs of Backup and Disaster Recovery (BDR)

This white paper explains how data loss occurs, how backup and disaster recovery (BDR) works and helps you understand what to plan for and how to evaluate your BDR solution.

Three Core Principles

Whatever your BDR strategy entails, it should provide the core values of scalability, reliability, and resiliency.

  • Scalable BDR solutions expand as your business grows without exceptional effort by your team.
  • Whether on-premise or a cloud backup, a reliable solution is fully redundant and accessible from any physical location.
  • Resiliency requires protecting data from ransomware attacks and other threats.

Advanced recovery solutions take a multi-pronged approach in managing risk, including a dedicated team of professionals available for client support.

A Trusted BDR Partner

CoreBDR, Coretelligent’s fully managed backup and disaster recovery solution, meets the data protection requirements of the digital enterprise. CoreBDR offers secure, high-performance, cloud-based backup and restoration to deliver operational resiliency to your organization. CoreBDR is available for organizations with on-premise infrastructure and cloud environments and can be customized to fit your business operations. Our expert team has deep experience delivering to clients of all sizes in financial services, life sciences, and other industries.

Are You Getting the Most Out of Your Data Governance Program?

Last month we shared the first in our series about the importance of having a data governance program. With this post, we go more in-depth about why data governance is the key to unlocking the power of your data to drive growth and avoid risk.

Are You Getting the Most Out of Your Data Governance Program?

What is a Data Governance Program?

Data is the new currency in today’s business climate, and data governance ensures that your company has an organized system for managing this invaluable asset. A data governance program combines people, processes, and technology to guarantee reliable access to data so it can be effectively leveraged. To learn more about data governance basics, read The Future of Analytics is in Data Governance: Are You Prepared?.

How Does Data Governance Fit into Data Management?

Where data governance is a program for managing the roles, responsibilities, and processes of data assets, data management is the operation concerned with the quality and accessibility of data. Data management oversees all aspects of data— storing, maintaining, protecting—but data governance provides the raison d’être. If data management comprises the tactics, then data governance encompasses the strategy. One comes before the other.


Related Content → Best Practices for Good Enterprise Data Governance Guide


Why is a Good Data Governance Program Necessary?

There are two main forces behind establishing good data governance in an enterprise.

1. Improve Efficiencies, Reduce Costs, and Increase Revenue

A primary goal of data governance is to eliminate data silos that can occur in an organization. When data silos build up, they can inhibit the flow of information and make sharing knowledge difficult. Data governance is a collaborative process that recognizes the value of data and aims to break down barriers by harmonizing data within an organization through collaboration and coordination with the implementation of enterprise data architecture. Ideally, that will lead to competitive advantages and increased revenue and profits.

2. Increase Compliance and Reduce Risk

Another data governance goal is to ensure that data is compliance appropriate. That can be accomplished by creating uniform policies and procedures to monitor usage and include enforcement to eliminate risk from data loss and other issues. In addition, data governance can help to strike a balance between data collection practices and privacy mandates.

Data Solutions with Coretelligent

Coretelligent works with a variety of technology partners to provide next-generation cloud-based file sharing and collaboration. Building upon this foundation, Coretelligent adds its experience and support to offer powerful controls for data management. Our approach combines an effortless solution with maximum usability, so your enterprise can focus on what’s important—growing revenue.

Providing guidance and support is just part of what we at Coretelligent offer our clients. Our solutions include IT planning, 24/7/365 support, cloud computing, cybersecurity, disaster recovery readiness, and more. Reach out to learn about any of our technology solutions.

Coretelligent logo & three professionals using a computer.

Data Loss PreventionsWe all know how stressful it is to lose something. If you’ve ever lost your wallet, you know the consequences can drag on for some time. You need to contact your credit card companies and bank, request a new license, and update accounts with new card information. Even if everything works out, the fear of what happened to your lost information may last a while. Now imagine if you were an organization that lost hundreds of thousands of records containing personally identifiable information (PII) or personal health information (PHI). This year alone, several major companies like Marriott, Nintendo, and Intel experienced data breaches. Intel had 20 GB of proprietary data leaked, which included information on products that haven’t been released yet.

Data loss can result from many factors, including internal and external threats, system errors, or even human behavior. Regardless of the cause, there are steps that your business can take to prevent data loss and reduce the length and overall cost of damages. The SEC’s Office of Compliance Inspections and Examinations (OCIE) notes data loss prevention as a critical area in their report on Cybersecurity and Resilience Observations.

What is Data Loss Prevention?

Data loss prevention involves having systems, tools, policies, and training to prevent data from being misused, lost, or accessed by unauthorized users. Preventing data loss is especially crucial for businesses that handle sensitive information like personally identifiable information (PII), intellectual property (IP), and personal health information (PHI). IBM’s 2020 Cost of a Data Breach Report found that PII was compromised more than any other data type. PII also cost businesses more, up to $175 per record.

For those in highly regulated industries, like financial services and life sciences, data loss prevention is required. Data management and security are crucial elements in FDA Title 21, CFR Part 11, HIPAA, Sarbanes-Oxley Act (SOX), FINRA, and SEC rule 17a-4. Keep in mind that many of these regulations require preventative measures, specific actions, and documentation in the event of a data breach.

The Cost of Data Loss

Whether you experience data leakage from an inside user or permanent data loss from a malicious attack, there are long term consequences. Decreased productivity, tarnished reputation, legal fees, and remediation expenses are only a few of the costs. For many organizations, it can take years to recover from the damage. Unfortunately, some businesses don’t survive and are forced to close.

Even if you experience a breach, having a data loss prevention strategy can reduce the costs. The average cost of a breach is $3.86 million. Data loss prevention can reduce the overall cost of a breach by $164,386, according to IBM’s 2020 Cost of a Data Breach Report.

Developing a Strategy

To meet compliance standards and secure your data, your organization needs to have a comprehensive security plan that includes preventative and responsive actions.

Develop Comprehensive Policies

When we think about cybersecurity and data protection, we often think of technology. Although technology is a significant factor in security, policies set the tone for the organization and provide guidance on which technology solutions are needed. A lack of policies and procedures can undermine even the best technologies.

Create an Asset Inventory

You can’t protect your data if you don’t know where it is. Develop an asset inventory that lists all of your data, where it lives, and how it’s being protected. Be sure to note your critical assets and systems that would affect your business operations.

Assess and Treat Vulnerabilities

To understand how your organization could experience data loss, you need to be aware of what vulnerabilities exist in your environment. Run regular vulnerability assessments and penetration tests to stay on top of your current weaknesses.

Create and implement treatment plans for discovered vulnerabilities, e.g., patch management schedule, awareness training, and comprehensive policies.

Implement Access Control

Determine paths of ingress and egress for sensitive information. Determine who has access to sensitive data and implement the principal of least privilege to ensure that access is restricted to only those that should have it. Ensure access and usage are audited. Implement appropriate restrictions and logging at all points of egress. This may include digital rights management to protect sensitive documents even if they are distributed.

Conduct Security Awareness Training

Since risky human behaviors are among the top causes of data breaches, it’s essential to conduct quarterly or semi-annual security awareness training. Training raises awareness and provides users with the skills to identify malicious emails and phishing tactics. It also teaches them what steps to take if they have received this type of content.

Implement Perimeter and Endpoint Security

Remote work isn’t going away anytime soon. The perimeter of your network is no longer limited to the boundaries your office or datacenter. You need to ensure that you have total visibility into all incoming and outgoing network traffic, including your endpoints. Implement firewalls, endpoint protection platforms, and email security. These tools will give your IT team or MSP the visibility they need and the ability to respond to threats quickly.

Having a dedicated security team to actively monitor your environment around the clock allows them to respond quickly to suspicious activities occurring on your network.

Properly Dispose of Legacy Systems

Remove software that is no longer receiving security patching from the vendor. Ensure that all sensitive data is removed when disposing of outdated software and hardware. Use disposal or recycling vendors that provide a certificate of destruction.

Create a Backup and Disaster Recovery Plan

Unfortunately, even with the best security measures in place, data loss can be inevitable. That’s why you need to have regular and tested backups along with a comprehensive disaster recovery plan. A plan will help your organization maintain business continuity and compliance while addressing a disaster or breach.

Staying Compliant and Protecting Your Data

Data loss can have a significant and irreversible impact on your business. Data loss prevention is an essential component of your overall security posture. To be compliant, you must secure and monitor your data continuously. New threats and vulnerabilities exist every day. It can be challenging to balance security, compliance, and day-to-day support. Coretelligent can help you whether you need a strategic partner to co-manage IT, fully managed IT support or comprehensive security solutions. We understand the unique needs of organizations in highly regulated industries like financial services and life sciences. Do you need help strengthening your security or have questions around IT compliance? We are here to help. Call us at 855-841-5888 or contact us.

Read our white paper to learn how you can maintain IT compliance in a digital enterprise.