Network security is a multi-faceted and extremely important issue in today’s world. Businesses build networks to connect employees to one another and create a productive shared work environment. Sometimes when networks are created, the appropriate time is not devoted to make sure all security measures are in place.
16 common network security vulnerabilities that should be avoided.
IT Staff/Administrator Issues
Failure to Consistently Enforce Network Security Policy
Policies help set expectations, roles, and responsibilities. An excellent security policy only loosely enforced will have little benefit to an organization. Defined consequences of not following the security policies need to be enforced.
Sharing Passwords Between IT Staff
Users, especially IT staff should have individual, auditable responsibility for their accounts. Having employees share passwords should not be done unless it is absolutely necessary.
Failure to Perform & Validate System Backups
Many organizations fail to consistently and adequately backup important system data. Of the few that perform backups, not many take the time to restore a file or otherwise validate the success of each backup operation. Having a data backup strategy is crucial for protecting your network. Create backups often, and do not immediately overwrite them with the next set of backups. In addition, make copies and keep them off-site in case of emergency.
Poor Firewall Configuration
A firewall monitors incoming and outgoing network traffic and access rules are set up to prevent unauthorized sources from entering your network. Firewalls are an essential part of protecting your network and has to be set up correctly in order to block threats.
Outdated or Unpatched Software Applications
Many organizations run software programs that are no longer supported by the software developer and patches/updates to fix vulnerabilities are no longer issued. Without the ability to fix software vulnerabilities these companies are leaving themselves open to hackers. Learn more ways outdated technology can affect your business.
Not Using Encryption
Encryption is especially important when dealing with banking and credit cards. Storing and transferring unencrypted data is the equivalent of posting that data for everyone to see. If your IT personnel are not comfortable implementing encryption technology, have an IT expert assists you.
Unsecure Email
Spam emails are one of the most common ways a hacker delivers malware. As soon as your employees open an email, they are opening up your network to a possible attack. When you enable email filtering, you allow the software to independently analyze incoming emails for red flags that signal spam/phishing content and automatically move those emails to a separate folder.
Wireless Access
Wi-Fi is a convenience that many businesses use, but it poses a severe vulnerability because it immediately gives users access beyond the firewalls. With wireless access points, network security is at risk because all devices with an internet connections can read traffic flowing in and out of the network. If a company provides a standard password for wireless access to everyone, it defeats the purpose of having a password.
Not Recognizing Internal Security Threats
A natural tendency is to focus security efforts and resources towards attacks from outside the organization. Don’t forget to keep your eyes open for people inside your organization.
Employee Issues
Insecure Passwords & single factor authentication
Passwords are the simplest form of security. By leaving passwords blank or simple (i.e. “password” or “admin”), unauthorized user are practically invited to view sensitive data. Users will also naturally tend to select easy to remember passwords. Passwords are more secure when they contain both letters and numbers in a combination of upper-case and lower-case characters, and they should be changed periodically.
Single-factor authentication is the simplest form of authentication methods. All a hacker needs is your password to gain access to your company network and data. Two-factor or multi-factor authentication adds a layer of security making accounts much harder for attackers to break into.
Failure To Store Vital Information Centrally
Storing information locally on client computers, rather than on managed serves, can make recovery of data after an attack virtually impossible.
Unknown network connected IOT Devices
Your employees smart speaker or other IOT device may introduce security risks to your network that they don’t understand. As IOT devices become mainstream, it’s important to educate employees and raise awareness about the risks. With the increase of work from home employees, many organizations have added Smart/IOT devices to their employee technology workplace policy as smart devices can create network security risks from home offices.
Open, Unattended Workstations
Do you have a policy in place that encourages user to lock their workstations when they leave them? If not, a passerby could easily set up means to access that workstation after hours.
Ignoring Updates
What good are all those virus and spyware scanners if they’re not updated? It is crucial to update what are called the “virus/spyware definitions” every week. This keeps the scanners up-to-date to detect the latest malicious software.
Ignoring Security Patches
All software and hardware has vulnerabilities and is in a continuous state of development. Because software is constantly changing, it is imperative that the IT staff stay current on patches, updates & fixes to their systems.
Lack of Education
Users need to be educated with regard to e-mail, attachments and downloads. Uneducated computer users are often those who fall victim to viruses, spyware and phishing attacks all of which are designed to corrupt systems.
Contact us for more information or assistance with network security!
