Picking up from the previous post, Kevin Roose of Fusion experienced the effects of pentesting on his own network in order to pinpoint vulnerabilities. After going through the rigorous process of having two equally skilled cyber security professionals hack into his network and disrupt it as much as possible, Roose took it upon himself to learn from his mistakes so that interested readers don’t go through the same journey with actual devastating results.
Based on the pentesting results, Roose made the necessary changes to his network’s cyber security on an individual basis. However, it’s really easy to fit his tips to organizations of all shapes and sizes:
- “Most of it was basic stuff: turn on two-factor authentication, use a VPN, don’t click on suspicious links, change your passwords every few months.”
- “One I hadn’t heard of before was an app […] which monitors your outgoing network traffic and alerts you if a program you’re running is trying to contact a strange server.” Otherwise known as cyber security monitoring, having all endpoints secured and accounted for is great, but being able to view all interacting traffic is a vital point of protection for any company.
- “You can also take proactive steps to protect yourself against social engineering…I called my phone company, reset my password, and instructed them not to let anyone make changes to my account in the future unless they provided a 4-digit PIN.” This can be filed away under third party application threats. Remember the Target attack through their HVAC system? It was an easily preventable loophole that both parties could have closed; however, due to oversight and sheer negligence Home Depot’s standing took a hit and millions of customers were left with more questions than answers about their cyber security privacy.
This article is not advocating that every company should embrace pentesting and post a jobs ad saying, “Hacker Wanted, Apply Within!”. Rather, be alert and aware of exactly how vulnerable your organization’s data and networks become as malicious attacks continue to grow and evolve in order to sidestep even the strongest cyber security protections. Monitoring and protecting your network – whether with an outside company or inside your own – is the obvious choice.