Information security and the risk of consumer data breaches are all over the news as details about the Target breach continues to be published. The story highlights the potential business impacts of a data breach in our increasingly interconnected world. Companies need to take steps to mitigate the risk of a breach within their organizations and with their outsourced vendors.
Udi Mokady, the president and CEO of CyberArk Software, recently published an article. Here are five steps he recommends to improve information security. Focusing on the following areas can help organizations create an effective and robust cybersecurity strategy in line with growing threats that will also increase compliance levels:
- Assume that attackers are already on the inside – In the same way that locked doors within your house will restrict a burglar once inside your property; enterprises must consider a similar situation within their corporate network. Perimeter-based defenses are infiltrated with relative ease by today’s attackers. With this in mind, the focus should be on making life as difficult as possible for hackers or malicious employees by putting in place robust controls around internal privileges.
- All privileged/administrator activity must be monitored – Organizations should have a system in place capable of logging and recording all session activity in real-time, flagging any suspicious activity with the option to immediately terminate a session if necessary.
- Limit privileged access only to those whose roles require it – While this may seem an obvious point, you may be surprised to learn who has access to information or applications that simply aren’t appropriate to their role.
- Sensitive information should be stored in a secure repository – Employees operating via these privileges should not be able to view and withdraw the most sensitive information existing in the corporate network without challenge. Instead, this access should be monitored and restricted according to stringent protocols.
- Allow users to connect without disclosing the password – This is an important security measure for businesses, particularly those that outsource to third parties, as the ability to control and monitor activity may not be as stringent. For instance, a proxy server will ensure that all privileged credentials are isolated from the target server or device, providing a single control point and preventing attackers from bypassing the privileged account protection and audit system.
You can find the complete article at InfoSecurity.
Udi Mokady is the president and CEO of CyberArk Software, and a pioneer in establishing the privileged account security software market. Since co-founding the company in 1999, Mokady has also served as CyberArk’s chief strategist and visionary, overseeing global expansion, management, execution and corporate development. Prior to CyberArk, Mokady specialized in legal management and business development for international high-tech companies. He previously served as the general counsel at Tadiran Spectralink, a highly specialized producer of secure wireless communications systems. A veteran of a military intelligence unit, Mokady holds a law degree (L.L.B.) from Hebrew University in Jerusalem and a Master of Science Management degree (MSM) from Boston University.