Gaps and cyber attacks, how can we defend ourselves?
Every day new security flaws are discovered, often in newly released products. The pertinent question is: how are professionals and managers dealing with this reality? Are they preparing properly? Is the team properly trained?
The need to create a compliant and secure environment has grown. Therefore, it is extremely important that professionals, managers, and employees are constantly updating their knowledge regarding information security concepts and tools. Companies, in turn, have invested in awareness-raising lectures on the use of corporate resources such as e-mails, notebooks, desktop, smartphones, flash drives and so on.
In a survey conducted by Tech Republic https://goo.gl/mzz7jS we can realize that one of the biggest threats used in 2018 was the phishing attack, which is a dishonest way cybercriminals use to trick the user into revealing personal information, such as passwords, bank information, and personal data. They do this by sending false e-mails or redirecting you to fake websites, for the purpose of attempting to exfiltrate data or carry out an intrusion into the corporate environment, allowing theft or hijacking of data.
The New York Times reports an attack on the American Pentagon: https://nyti.ms/2qBZBoW
What has been identified in most of these attacks are what some professionals “play” by calling layer 8, or other words, human errors or mismanagement of resources or people. A very found scenario is that companies have an excellent team of professionals, but with little budget for investment in information security or excellent equipment available, however, misconfigured. Some principals and entrepreneurs only realize the importance of a qualified IT department with excellent resources at their disposal when the security incident happens. It is believed that with the new General Data Protection Act, a culture change is initiated in how to manage and protect customer data.
More details on the law at the link: https://goo.gl/trUSpH
Let’s look at some techniques and their explanations below to keep the environment safer.
Hardening: is a process of mapping threats, mitigating risks, and executing corrective activities, with a focus on infrastructure and the primary purpose of making it ready to face attack attempts. Typically, the process includes removing or disabling user names or logins that are no longer in use, as well as unnecessary services.
Fuzzing: is a software testing technique, often automated or semi-automated, that involves providing invalid, unexpected, and random data as inputs to computer programs. The program is then monitored, analyzing exceptions such as run-time errors. Fuzzing is a technique commonly used to test security issues in software or computer systems.
Vulnerability analysis: Systematically identify and eliminate system vulnerabilities, where we have several stages for detection, removal, and control. These three steps must be followed by qualified professionals in native security tools, thus facilitating the recognition of vulnerabilities.
Pentest: Also known as penetration testing has a more comprehensive scope than the vulnerability test. The vulnerability test can simply be running software that lists open ports. While the penetration test seeks to simulate an attempted invasion into the environment. Usually, the penetration test is conducted through an Internet host to access an internal device. There are several methods of performing a vulnerability test, all depending on which area you want to exploit possible vulnerabilities. Tests generally vary within the following categories:
- Port scanning.
- Vulnerability Scan
- Protocol analyzer
- Password break
- Network mapping
- Site Survey
- Tests using the OVAL (Open Vulnerability and Assessment Language) standard.
It is always recommended to follow the best practices proposed by the manufacturers of the equipment used in their environment, this reduces the vulnerability gaps, making the environment more prepared than attempting attacks and intrusions.
Contact Us
1800-843-7890 (India) 
