Improving cybersecurity with an environmental scan

By Tyer W

November 21, 2023

Improving cybersecurity with an environmental scan

Cybersecurity. It is a topic many people, dread, but also one they know the importance of. The hard part is people generally don't know where to start, just know they need to improve. As a result of this, arguably the most common question I get is: what is my biggest threat? I get this question without actually getting any personal or organisational context, and this is probably a result of mainstream media. We have this implied vanilla definition of cybersecurity. I do believe most people want to have their 'issue' labelled and put in a nice neat silo, so it can be more easily quantified and action, which is reasonable. As a result, they invariably want to hear the familiar terms like, 'ransomware', 'business email compromise', 'social engineering attacks', but this is so rarely the case. As a result of the cybersecurity effort not easily being able to be put in a box the can gets kicked down the road, and eventually put in the too hard basket, until an attack rears its ugly head. Why spend money and resources on something that does not have a definitive and immediate output? Simple, don't...but, don't stop your cybersecurity journey.

Cybersecurity is complex, made up of so many components, but as a result of this does mean that some cybersecurity improvements can be easily introduced by yourself, to get the journey going. So, let's pick up that proverbial can up, and take a look at how you can improve your cybersecurity, and no, this is not a list video, just a simple environmental scan.

One of the first things you can do, and should do, is to take a mental inventory of all the computers you have in your organisation (or home), and by this, I basically mean anything that talks to the internet. This includes, laptops, workstations, mobile phones, printers, routers, cameras, doorbells - really, the list could go on and on. From here, stop and think, how old are these devices, do I control all of these, have they been updated. One of the first questions I ask clients is this. We need to get an understanding of the infrastructure environment, and you do too. Once you have this list, and I do encourage you to write it down, as it could get big quick, is to then think when were they last updated? Phones and computers, probably are pretty regularly, but what about that one laptop that is just used occassionally, or is now a media server, or the printer. These need updating too, and patching all these systems help bring your overall security a level up.

At the same time think about the logins to these devices. Is it just you that knows them, or does each user have a logon, and are the passwords long, complex and unique? Stopping to think about your password hygiene and user access to these devices can also help you understand your risk. If you are looking at multiple devices and you know they have the same password, or your passwords are weak, you now have another area you can look to improve!

Finally, while considering this list of devices and the passwords, how many devices and accounts are protected by multi-factor authentication? You need to be protecting as many accounts with something you know - password, something you have - an expiring TOTP code or a hardware key, and something you are - such as a biometric. In this instance, 2 out of 3 ain't bad!

These are really basic initiatives that we can all introduce, and generally, we get the 'yeah-yeah, we do all that', but do you, really, on every device and account? Probably not, because most people think the cybersecurity risks end at their fingertips, their workstations and their phones are the only areas of compromise. If only that were the case. So, next time you are looking at that old laptop that is plugged in and constantly turned on 'for a reason you cannot quite remember', maybe consider going over there and checking out the version, account security, and updating - it could save your cybersecurity skin.

There is no one cybersecurity defence that can be introduced to protect every organisation and individual, because everyone is different, and you need to understand this difference, because your environment is what you can control. Take ownership, understand all the areas of your home or organisation, and you will be on the right track to an improved cybersecurity posture.