To safeguard data, executives and employees must first know what is most precious. Then, learn good general security habits as well as the specific measures for protecting each type of data in so far as using those measures lies within duties and responsibilities you will face in your position.
Seats of power
"Cybercrime is a multifaceted, decentralized, global phenomenon," says McKinty. Still, there are stealthy leaders behind the attacks that criminal hackers carry out.
The nefarious heads of these hacker groups include Russians in seats of power and Chinese communists inside the People's Liberation Army. Members of various criminal syndicates globally work with little or no outside guidance or prompting.
People who want to avoid muggings don't walk dark alleys alone at night in the wrong part of town. People who want to stay safe travel in groups, take extra measures (carrying pepper spray), and have a game plan, such as run, dial 911, or scream, "fire!" to attract attention and help. Enterprises must be aware of how the information highway as the world itself has changed, and not for the better. They must do the 'must dos' of cybersafety: offer the least amount of privileges necessary to any one person or entity; trust no one; and segregate networks.
"Requiring the use of a reference model that includes governance, such as the NIST Cyber Security Framework ISO 27000, is a good starting point for comprehensively protecting critical infrastructure and the data it carries," says West.
Perimeter defenses alone are insufficient. Use methods instead that locate attacks in progress based on anomalous behavior that you measure against a baseline. "Companies such as Cyveillance, FireEye, and CrowdStrike offer useful technologies," says Fleming.
Methods and tools that remove incentives are very important. "The enterprise needs to attack the economics that drive and sustain cybercrime by making it too costly in terms of resources and time for cybercrime to be profitable," says McKinty. Use risk assessments tailored and targeted to cybercrimes. Make cybercrime too expensive a proposition for attackers by using two- and three- factor authentication, long, strong passwords, and stronger (higher-bit) encryption than your competitors (so you're no longer the lowest hanging fruit). "The enterprise should also find and fix its weakest links in the security chain," says McKinty.
"The CEO must be an information security change agent," says Fleming. Reward people who discover and help to close your vulnerabilities. "Stage annual assessments by unbiased, experienced, intelligence-based outside firms," says Fleming.
Non-technical options for pushing back against cybercrime are largely limited to trade sanctions against nation-states and prosecution of bad actors within the U.S. "The FBI will prosecute any U.S. firm acting in retaliation. The answer is for companies to redefine their information security strategy from perimeter security to data-centric security," says Fleming.
Sign up for Computerworld eNewsletters.