Pub. 10 2020-2021 Issue 6

O V E R A C E N T U R Y : B U I L D I N G B E T T E R B A N K S — H E L P I N G C O L O R A D A N S R E A L I Z E D R E A M S March • April 2021 15 Six-degree Hacker Assessment: Is Your Information at Risk? BY JOE OLEKSAK, PLANTE MORAN There are six key layers of control separating your data from unauthorized access or hackers. Leaders need to understand how effective each layer is in protecting your organization. O rganization leaders and stakeholders are ask- ing: “Are we vulnerable to hackers?” A six-de - gree hacker assessment will provide answers by testing each layer based on current hacking trends and real-world threat scenarios. 1. Internet: Internet-accessible information and systems are the public face for every organization. Unfortunately, this information and these systems can be used by hackers to gain unauthorized access to your internal network, or worse, your most critical data. 2. Social: Users are an organization’s critical line of defense in securing and protecting information and assets. They can intentionally or unintentionally pose a risk to an organization by not exercising due care. Social attacks target staff who do not properly understand their role and respon - sibilities regarding information security. Not to be outdone (but often overlooked), physical building and network controls are just as important for thwarting many common social attack organizers responsible for several recent well- known breaches. 3. Peripherals: Today’s decentralized physical and logical security models give staff responsibility for critical physical devices and data 24/7 through firewalls and VPNs. Our mobile workforces are armed with laptops, mobile phones and tablets, which could result in a significant data breach if left uncontrolled. If configured improperly, our firewalls and VPNs create potential tunnels into the core of an organization. 4. Passwords: Currently, passwords are the single most important line of defense when controlling access to data and systems. Passwords grant access to remote access VPNs, networks, applications, databases and sensitive file shares. Practices of password sharing, password reuse and poorly chosen word combinations have resulted in many of the breaches we hear about in the daily news. Password construction, use, and protection practices are, without question, one of the most important security control layers for organizations today. 5. Systems & databases: Applications, databases, and networks share house critical organizational data, including security controls critical to protecting an organization’s vital data assets. Improper access controls, system configurations, older versions, or missed patches often result in unwant- ed holes, which, if left unaddressed, can lead to a system compromise, or worse, a breach of critical company data or confidential customer information. 6. Network: Networks allow users, customers, and ven- dors to communicate effectively and operate efficiently. When designed with security in mind, networks can limit hackers, viruses, ransomware, and malware to move freely between systems. Also, hackers compromise networks an average of 90 days before being discovered. Often, this is the direct result of weak or nonexistent detective controls. In today’s world, a proper network, one designed with security in mind, is essential for any company, regardless of industry. Cybersecurity includes applying administrative, techni- cal, and physical controls to protect against threats to the confidentiality, use, and integration of technology throughout organizations. Today, those threats affect more than just IT — they affect the entire organization. With that in mind, an organization-wide security strategy is essential for success- fully protecting confidential data throughout the organiza - tion. A six-degree hacker assessment can help you focus on developing solutions for the areas that present the most risk to your organization. n