As cyber criminals move away from brute-force attacks to siphoning data from the mobiles and laptops of key business personnel, endpoint security and protection has quickly become the main focus.
Cyber criminals are well aware of the fact that many business employees use their mobile phones and laptops to access business clouds, services and information whilst on the go. Most of the time this is done without any real kind of security or encryption.
Worse still, many of these business employees use public and/or unsecured WiFi networks to establish an internet connection to these business services in the first place, unwittingly exposing their activities to potential criminals on the network.
In this blog, we’ll provide a quick refresher and review the importance of endpoint security for small businesses and why security measures must be put in place at device level (such as a virtual private network) to protect employee devices and data from the prying eyes of cyber criminals.
What is endpoint security?
Endpoint security refers to the protection of end-user devices connected to a network. Mobile phones, desktops, laptops and other wireless devices can all be considered endpoints – and can be easily exploited by cyber criminals.
Protecting these endpoints is a top priority for businesses, especially with the rise in bring your own device (BYOD) policies to streamline data access and promote flexibility.
Why have cyber criminals moved away from brute-force attacks to targeting endpoints?
Most large businesses have robust cyber security software in place. This usually includes threat detection and analysis, vulnerability assessments, real-time threat intelligence, network intrusion and host intrusion detection and much, much more.
Given the sophistication of these systems, attacking a network head on just isn’t practical or efficient. Mobile phones, laptops, tablets and other wireless devices used by business employees on the other hand – endpoints – are typically less secure.
According to the 2018 State of Endpoint Security Risk report by Ponemon Institute, almost two-thirds (64%) of respondents experienced one or more endpoint attacks that successfully compromised data assets and/or IT infrastructure over the last 12 months.
The report states that 70% of companies were subject to new and unknown threats against their organisation – and only 40% actually had ample resources in place to minimise the compromise of endpoints.
For cyber criminals, attacking an endpoint is far more effective than trying to take a network offline through a brute-force attack. It also enables them to enter a network silently and (almost) undetected.
What can be done to protect endpoints and the devices of business employees?
For decades, the industry standard for endpoint protection has been an anti-virus solution and a firewall. The problem, however, is that these traditional solutions respond to threats after they enter a network and provide minimal protection against more complex threats.
To improve endpoint security, businesses need to not only be reactive, but also proactive.
Here are a few things to consider:
Instead of just responding to attacks or threats after they occur, businesses need to take advantage of behavioural and threat analytics software to respond to them in real time. These solutions should be installed to both the network and devices for business-wide security.
Patching is perhaps the single-most effective method to prevent cyber attacks. Attacks like WannaCry and Petya succeed because businesses neglect to run patches to fix known vulnerabilities in software or services. At the earliest opportunity, businesses should download and install all security patches to maximise protection.
BYOD can quickly spiral out of control if employees keep bringing in more and more devices. Make sure that all devices have the right security solutions installed – including a VPN – so when employees work remotely and use public WiFi, the connections are secure and encrypted.
Last but by no means least: password management. However good the security solutions, a cyber criminal with access to the end user’s password will have access to the entire system (and the wider network the user is connected to). As people have a tendency to use similar passwords and usernames (making them incredibly easy to crack), consider implementing two-factor authentication or PKI authentication, which is the Privatise preferred approach.
Endpoint protection is absolutely essential for any modern business. As BYOD grows in popularity and cyber criminals look to target end user devices, implementing the right security (including a VPN solution) to protect devices and keep information private and secure, will be of the utmost importance.
It’s time to take cyber security seriously. Find out how you can protect your small business from the growing cyber security threat by downloading our free eBook.
Appstractor Corporation is home to the next generation of simple, innovative technology securing online privacy for your employees & your automated data intelligence