The 5 Cs of Cybersecurity for 2022

The Federal Bureau of Investigation (FBI) is extremely entrenched in the field of cybersecurity and in combatting internet crime. And for good reason – in their 2020 Internet Crime Report they reported losses of over $4 billion in the previous year. As a leading affordable Phoenix IT services provider, itSynergy was recently honored to be a presenting sponsor of an important and time-sensitive webinar, featuring FBI agent Elvis Chan, in which he outlined key cybersecurity considerations for 2022. Chan is a 16-year veteran of the FBI and a decorated agent who is widely recognized within the intelligence community as a cybersecurity and cyberterrorism expert.

Here, we share some of these key webinar takeaways including actionable items (the five Cs) that will help to keep you, and your organization, cybersecure this year.

The First C: Connectivity

Connectivity refers to how an employee is connected to the internet. In the pre-pandemic, and pre-remote work times, employees typically didn’t need to think too much about connectivity. Corporate firewalls and in-house IT departments took care of connectivity considerations for them.

Fast-forward to today and many employees are connecting to the internet from their home routers. And many of these employees are still using the default password for their home wireless routers. Unfortunately, these default passwords have been widely published, and you can bet that cybercriminals have these passwords committed to memory and are constantly looking for opportunities to use them to access home networks.

The first webinar takeaway? Change that default password on your home router if you haven’t already done so. Instant increased security, just like that!

The Second C: Collection

The second C that Chan elaborated on is collection – specifically collection of back-up logs and data. Given that most breaches aren’t uncovered for at least three months, these logs (including email logs, firewall logs, and anti-virus logs) are critical. While three months’ worth of logs is the bare minimum, Webinar takeaway No. 2 is to keep at least one years’ worth of back-up logs. It will cost more to do so, but it will pay off significantly in the event of an attack. These back-ups are an investigators’ dream and make all the difference between loss of productivity due to downtime and are also the optimal way to recover from a ransomware attack.

The Third C: Culture

Culture is C No. 3 and refers to the organizational willingness to adopt risk mitigation strategies and finding that right balance between meeting business and customer requirements and doing so in a safe and secure manner. Organizations that are successful at mitigating technological risks tend to have strong top-down support driving these cybersecurity best practices.

Your third takeaway is to consider your organizational culture and assess whether it is where it needs to be to support optimal risk mitigation practices. If it’s not, there needs to be a conversation with your leadership team about how to best get it to that place. Our recent blog, How to Balance Efficiency and Security With Your Managed Services Provider is a great resource to review prior to having this conversation.

The Fourth C: Configuration

The fourth C that Chan speaks to is configuration. Security patches are software and hardware updates that are provided on an as-needed basis from vendors. They take time to install which is why many users will delay implementing them, but they are critical, as they fix vulnerabilities and correct bugs and errors.

As far as home routers go, firmware is the functional equivalent of a security patch for a hardware device instead of for software. It’s easy to find this latest firmware, simply go to the router manufacturers website, enter your model number, and download the latest version.

The configuration-focused takeaway? Chan recommends setting up critical patches to install in the middle of the night while you are sleeping, this way it gets done with minimal downtime impact. The second part to this takeaway is as part of this exercise, ensure to install firmware updates on all of your hardware devices. If you can’t find a firmware update for your device, this could signal that your hardware is no longer being supported in which case it’s time to start thinking about updating to a more current device.

The Fifth C: Compliance

And, finally, compliance rounds out the list. In the same manner that organizations prepare for fire drills, with rally points and evacuation procedures, they need to apply this same level of attention and foresight to developing an incident response plan for cyber incidents. Whichever standards your organization aligns with, whether it is Center for Internet Security (CIS), HIPAA, or National Institute of Standards and Technology (NIST), ensure your plan is in compliance with their direction. Components of an incident response plan may include:

• Key stakeholders and their clearly defined roles and responsibilities in the event of an incident;
• Agreement on what constitutes an incident and who is authorized to act on the plan;
• Identification of any assumptions or limitations used in developing the plan;
• Detection and analysis protocols;
• Containment and eradication strategies; and
• Notification and communication procedures.

If your organization does not currently have an incident response plan for cyber incidents, the final takeaway is to make 2022 the year you develop one. If your organization does have one, the takeaway is to review the plan, test it, and adjust it as needed. Affordable Phoenix IT services provider itSynergy can assist in this regard.

There you have it, the highlights from FBI Cybercrime Briefing – Cybersecurity Best Practices for Businesses. If you are interested in a copy of the FBI presentation in its entirety, please request a copy, and we are happy to pass it along.

The single best action that your organization can take to ensure that 2022 is its most cybersecure year yet is to book a Rapid Security Assessment. The cyberthreat landscape is continually evolving and this assessment uses certified ethical hackers to expose vulnerabilities and identify cybersecurity gaps. Is your organization ready to lower its risk profile like so many other Arizona and Colorado based organizations have done? This can be easily accomplished by connecting with the leading affordable Phoenix IT services provider – itSynergy – today.