Monthly Archives: November 2022

Defense in Depth Provides Robust Cybersecurity

Many companies, while they have defenses against cyberattack, still fight to keep ahead of cyberattacks. What if your company is one of these, and could find a better way to protect your technological assets–data, applications, your network itself–from attack? Read on to learn more about “defense-in-depth” and how your company can use it to build a robust defense in all parts of your network.


Definition of Defense in Depth


Simply defined, defense-in-depth is a cybersecurity approach in which independent layers of controls are employed to build redundancy. If one control fails, another will take over. If an intrusion occurs, the bad actor can go only so far and will be dealt with before they cause serious harm. All the way from your perimeter to the most sensitive data at the core of operations, controls will keep your data and applications safe from loss and compromise. A first layer is detection, which catches anomalies and reports them to cybersecurity personnel, stopping them from intruding further into your network.


Evaluating Your Current Cybersecurity Posture


How do you know what an anomaly looks like, and whether it is a cyberattack in the making? Before making the transition to a multi-layered cybersecurity structure, knowing your current cybersecurity posture is important. One thing to consider is what a possible attack might look like. Viewing intelligence from past activity logs, especially when an intrusion occurred, should show you what unusual activity looks like. A next step is identifying your mission-critical data and applications, not to mention your most sensitive data, to determine which assets need the greatest protection and should be at the innermost layer of protection. Finally, what intrusion detection systems can you put in place to detect anomalies in usage?


Multiple Modes of Protection


A defense-in-depth system contains multiple defenses dedicated to controlling access to physical and data resources, as well as the resources themselves. Physical controls include security (say, at cloud data centers) and technical controls (firewalls and antivirus protection) defend the contents of physical systems. Administrative controls refer to policies and procedures for network security–for example, data-handling procedures and digital codes of conduct. Cybersecurity controls help maintain data integrity within a company’s network; examples of these protections include encryption at rest and encrypted backups offsite. Network monitoring of processes and of possible intrusion, along with endpoint protection, are yet more layers. 


Ideally, with defense-in-depth, you can protect your systems by using multiple tools that work better than any one tool by itself. For assistance with this approach, contact your technology advisor today.

Disaster Recovery Plans Help Keep Your Business Going

Any time of year, a disaster can happen, disrupting business operations and even threatening your company itself. Statistics show that some small to medium-size businesses close after a disaster; even some of those that reopen may be out of business in a year. Having a plan for disaster recovery can help your business defy the statistics. Read on to learn more about preserving your company’s data, reputation and bottom line by having a disaster recovery plan in place.


Why You Need a Disaster Recovery Plan


A Disaster Recovery (DR) plan outlines how to protect your data and other technological assets during and after a disaster. Since data is the lifeblood of your business, a DR plan can make a difference between staying in business and having to close. In the shorter term, it can save you money that you might lose from an unacceptable amount of downtime. Costs can escalate to $100,000 per hour from an infrastructure failure, and a critical application failure can cost up to $1 million. Aside from financial damage, a data breach resulting from a disaster can cost a business its reputation. Apart from cyber threats that affect any organization, your location may be subject to natural hazards like fires, floods or earthquakes. Even equipment failures resulting in unacceptable downtime can be costly. 


Disaster Recovery is Part of an Overall Business Continuity Plan


While a Business Continuity (BC) is an overall plan for keeping your business going during and after a disaster, a Disaster Recovery plan deals with protecting your company’s data from loss and compromise. It’s a part of your overall BC plan, following from and supporting it, yet is distinct. A Business Impact Analysis is a good first step, helping you assess how much data you keep, which of it is mission-critical, and what data protection regulations apply. What is the least amount of downtime you can risk before experiencing unacceptable consequences (recovery point objective) and how long will it take to recover (recovery time objective)?


Risk analysis is just like it sounds, assessing which natural hazards can affect your area and what cyber threats exist both internally and externally. What if people have to work remotely, and how does that impact data protection? A big part of disaster recovery involves backup and failover, where you keep original data and how quickly your company can access it. The 3-2-1 rule applies–keep three copies of your data in two places, one of which is offsite. 


How Disaster Recovery as a Service Can Help


One key advantage to contracting with a cloud service provider is that they provide the infrastructure allowing you to back up data for failover, with reduced cost to you. Even with these benefits, you also need to ask about the provider’s reliability in meeting metrics like RPOs, RTOs, and others. Is their network robust enough to handle the needs of other clients dealing with a disaster at the same time? What’s more, your provider should be following the same data protection regulations that require your compliance.


As a subset of your Business Continuity plan, a disaster recovery plan helps protect your data from loss, theft or compromise. For help developing or fine-tuning your plan, contact your trusted technology advisor today.