The October 3rd Telarus Tuesday call brought TPx VP of ITx Managed Services, Jared Martin and Manager of Security Operations Center, Adam Weber to talk about Cyber Security and its importance. The entire recording can be found here.
Cybersecurity is a Big Deal
Why is cybersecurity such a big deal? That is a question that gets asked a lot, and sometimes it might be hard for people to formulate an answer around that. There’s a general lack of knowledge and awareness about the importance of cybersecurity. Think about all of the connected devices that we have today, all of these devices have potential vulnerabilities. It’s not if, but when you will be breached. It’s a misconception that people think that they are safe. A lot of this stems from companies that are in transition. We have a lot of old technology that customers are having a hard time getting rid of, while at the same time introducing new technology. It is always the weakest link that breaks the chain, so if you have one old technology sitting in your environment that is not secure, it doesn’t matter how good the rest of your secure technology is. So who’s really out there taking advantage of these cybersecurity problems?
Cyber criminals – Attack and steal information for profit (example: Equifax breach)
Hackers – Some are pros that do it for research, others are malicious
Hacktivists – Politically or socially motivated
Cyber terrorists – Not common today but could become soon
Nation States – Launching cyberattacks against other countries
A lot of the things we see today in the current environment can be boiled down into a few major problems. Distributed denial of service attacks is one of the major issues. They are continuing to grow in sophistication and the solution to this is a managed DDoS platform. We’ve all heard about Ransomware as well. It is now becoming harder to catch and more prevalent and causing more financial harm. There are actually several solutions to this:
Endpoint protection
Email security
Patch management.
Another problem is traditional malware which is the same stuff we’ve been hearing about for decades now. Endpoint security solutions are what’s responding quickly to that. Lastly, there are routes to malware sites from redirects in ads, the fix for this is a managed secure DNS solution. Below you can view TPx’s security roadmap, which addresses these problems and solutions.
Questions to Ask
There are some questions you should be asking when you’re assessing opportunities. Security audits help identify vulnerabilities in the system, so asking a client when the last security security audit or assessment was done is pertinent. If the client has gone through an audit you will want to find out if they’ve developed a plan to treat the security risks. A cybersecurity report needs to be understood by the client in order for them to begin mitigating the risks. Knowing the difference between a threat, vulnerability and a risk is very important. A threat is from an attacker that will use a vulnerability that’s not mitigated because someone forgot to identify it as a risk. As you look at limits of perimeter oriented security posture, you may tell your client you have a multi-layered security approach. We don’t live in a world where perimeter-based security is effective, anymore although it is one part of an effective security strategy. Firewalls are definitely important, but today you have to have a multi-layered approach. Let’s discuss some common misconceptions:
Compliance equals security – Many executives believe that a compliant organization equals a secure organization. They may think, “If I’m aligned with the ISO framework and compliant with regulations like PCI, SOX and GLBA, I must be secure, right?” Unfortunately, it’s not that easy. Companies that have been breached are often seen as negligent, and the government steps in with more calls to regulate. The pressure to comply with policy-based frameworks increases, and companies use those frameworks to help fund and drive improvements in security. While this is good, it teaches executives to aspire to a low bar. Just as passing a health inspection doesn’t guarantee that a restaurant will serve good food, compliance doesn’t guarantee security. It is a minimum requirement, and is not enough to protect an organization from the strategies and tactics being used by hackers today.
Only a sophisticated hacker can breach your IT – High-profile cyber attacks are often thought to be sophisticated, but many are caused by attackers taking advantage of basic, often unnoticed security vulnerabilities or failures in IT operations. Additionally, the “bad guys,” whether they are nation states, cybercrime rings, or malicious insiders, are professionalizing and building success in attacking companies. They have developed an entire ecosystem, organizing around the steps they go through to break in and steal data, and buying and selling services to one another. If the malicious actor that has targeted your organization doesn’t have the skills they need to breach your network, they can easily go out and buy them.
Cyber Security Operations Center
TPx launched their Cybersecurity Operation Center (SOC) earlier this year in St. Louis, Missouri. They will also be launching a secondary site in Portland in early 2018. TPx made a heavy investment and spent many hours researching and discussing the state of the art technologies they wanted to implement, their highly trained and experienced staff is involved with their heavy investment. With over forty years of combined cybersecurity experience, TPx is concentrating in using the most modern detection techniques and threat intelligence. TPx is the nation’s premier Managed Services Carrier, delivering unified communications, managed IT, and network connectivity to 80,000 customer locations across the country. Nearly two decades of proven, industry-leading customer service focus embedded deep in our corporate DNA has powered more than 15 years of uninterrupted growth for TPx – all driven by earned referral, not advertising. To learn more about them visit www.tpx.com.
