Blog / What is a hackers worst nightmare?

Answer: businesses that actually update their applications.

There’s plenty of advice that gets thrown around for securing your organization; have good passwords, manage your mobile devices, keep an eye on your antimalware logs, etc. How do you tell what is actually good advice? Well, in my opinion, the best advice is what has proven to be effective.

So what’s effective and why?

• Changing passwords regularly and using Multi-Factor Authentication (MFA).

This advice has been proven again and again. The number of breaches caused by old or brute forced passwords prove it beyond any doubt. MFA is also a proven tool to help secure user logins. It’s not a silver bullet or replacement for strong passwords, but it’s a great addition to help secure things. Despite it’s proven track record, some organizations still don’t use MFA while many of those that do don’t use it enough.

Passwords are also a pain point. Nobody likes to have to come up with new one because they need to change them all the time. I’ve heard all sorts of excuses, but the truth is, if this is what you think you’re doing it wrong. An easy to remember phrase like “It’s time to change my password January 2022” updated to “It’s time to change my password March 2022” fits all the checkboxes.

• Use layered antimalware defenses.

Different antimalware software don’t play well with each other, so you can’t really install more then one on a single machine (I mean, I suppose you could but please trust me and just don’t).

The thing is, different solutions work in their own way, so each is better (or worse) at detecting certain things than others. That means taking a layered approach, and using antiviral scanning in different places for better protection. This is why antimalware scanning was added to firewalls long ago and indeed, most organizations I’ve done audits for have it included.

The problem is that antimalware scanning is a subscription service and not every organization stays on top of keeping their subscriptions active. Furthermore, most organizations don’t make the best use of it. For example, normally, encrypted traffic (like HTTPS) can’t be scanned. However, it just takes a bit of work and there are some limitations to get around that problem, and the capability to scan at least some encrypted traffic can truly improve your cyber security profile.

• Keep all your software and devices up to date.

This is among the best advice you can get and yet, unlike the other two points, most organizations completely ignore it. If things get updated at all, it’s the automatic windows updates on desktops. I rarely run into any semblance of an official policy even though patches fix known issues, correct vulnerabilities, and sometimes increase new features and functionality.

A recent report on hacker behaviour clearly shows that they don’t invent new methods of hacking; they exploit known and existing vulnerabilities almost exclusively. Why? Because it works, and it’s low effort. There’s little reason to go through the trouble of finding a brand-new vulnerability when nobody applies software patches.

Here’s the thing about these three items. They don’t take a lot of effort, they don’t cost a lot of money, and they don’t take a lot of time. Yet the impact they have on you overall cyber security stance is substantial. To be clear, these three items are pretty much the basics.

If you’d like help establishing a patch/update policy or require other antimalware services, please contact one of our cyber security experts today and we’ll be happy to help.

I’ll leave it to this Shakespearean quote comes from King Lear to sign off this week: “This cold night will turn us all to fools and madmen.”

Be kind,

Courtesy your friendly neighbourhood cyber-man.