14 Aug 60 Percent of Small Companies Close Within 6 Months of Being Hacked
Small to mid-sized companies should be monitoring networks for suspicious activity
– Robert Johnson, III, President & CEO at Cimcor, Inc
Chicago, Ill. – Jan. 2, 2019
Data breaches are one of the top concerns for today’s organizations. The costs of these breaches continue to increase, with the average global cost of a single breach hovering at $3.62 million. Beyond the financial consequences of a breach, network security is also hugely important for any business because an attack can compromise the trust of your customers.
In fact, 60 percent of small companies go out of business within six months of falling victim to a data breach or cyber attack. With both the financial security and future of your business on the line, it’s crucial for organizations of all sizes to have measures in place to monitor suspicious network activity.
What Constitutes Suspicious Activity?
Suspicious network activity can refer to a number of different behaviors that involve abnormal access patterns, database activities, file changes, and other out-of-the-ordinary actions that can indicate an attack or data breach. Being able to recognize these activities is important as it can help pinpoint the source and nature of the breach, allowing you to act quickly to correct the security threat and minimize damage. Here are some of the most common examples of suspicious activity:
Database activity: Abnormal database activity can be caused by either internal or external attacks, and the crucial signs to watch for include changes in your users, changes in permissions, and unusual data content growth.
Account abuse: The abuse of privileged accounts is one of the most common signs of an insider attack, and symptoms to watch for are modified audit trails, sharing of account access, and the accessing of sensitive information without need.
User access: Strange changes in user access are generally a sign that an external party, such as a hacker, is trying to gain access to your network using a user’s credentials, and behaviors you’ll notice include users accessing accounts at odd hours, accessing remotely, having multiple failed attempts to log in, and discrepancies between a user and a particular device.
File changes: Configuration changes to files—including replacement, modifications, file additions, and deletion—is a classic sign of a data breach, because it indicates somebody has infiltrated your network and is trying to prevent being discovered.
Unexpected network behavior: This is another sign of an attempted infiltration from outside sources, and you should be on the lookout for traffic with odd origins or targets, protocol violations, inexplicable changes in network performance, and unauthorized scans.
Unauthorized port access: Although this may be a result of an insider accident, unsanctioned port access can also indicate a malware attack or that files have already been stolen.
Changes detected by end users: For small organizations with fewer detection and security measures in place, it’s possible that end users will be the first to notice the effects of suspicious activity, which can include excessive pop-ups, odd anti-virus notifications, slow devices or networks, and unauthorized toolbars.
Is Suspicious Activity the Same for All Organizations?
It’s possible that suspicious activity will vary within industries and organizations of different sizes as the reasons for hacking differ as well.
A small business may notice user abuse or abnormal database activities as hackers try to gain access to personal or cardholder information, whereas a financial institution may be more prone to account abuse, unauthorized port access, and malware attacks designed to steal social security and financial data.
Private organizations may be susceptible to advanced persistent threats (APTs), which are defined as multi-phase attacks on an organization’s network. Though often aimed at governmental organizations, APTs can affect small and medium-sized businesses as well.
Combatting Suspicious Network Activity
As with many problems, the key to combating suspicious network activity is prevention, and this involves having a solid organization-wide security strategy. Here are a few items that should be included in any comprehensive data security approach:
- Malware protection
- Strong password policies
- Regular review of network alerts, error reports, performance, and traffic
- Installing firewalls
- Instructing end users to report suspicious activity
- File integrity monitoring
- Regular risk assessments
- Incident and failure response strategies
Compliance and Data Security with FIM
One of the fastest growing security trends for data protection is file integrity monitoring (FIM), as you can automate the monitoring of your important files, systems, networks, and more. With the right FIM software, you can constantly monitor for and detect suspicious changes in real-time. As mentioned in Creating a File Integrity Monitoring Strategy, common themes with a FIM strategy can include clearly defined roles, proper documentation, and thought-out planning.
A solid FIM tool and strategy will not only enhance your data security, but it will also help you achieve compliance with security standards like PCI DSS, which explicitly states the need for file integrity monitoring.
Any organization entrusted with customer data must take security seriously because it’s not just information that’s on the line: data breaches aren’t just expensive, but they can also tarnish an organization’s reputation. Unfortunately, hackers and malicious parties are always upping the ante in terms of new techniques and tactics to breach networks, but file integrity monitoring and having a great data protection policy in place can protect your organization, your data, your reputation, and your customers.
To learn more about File Integrity Monitoring, download the Definitive Guide to File Integrity Monitoring today.
– Jacqueline von Ogden is the Director of Marketing and Communications at Cimcor, Inc., and she authored this original blog post.
Cimcor provides solutions for Real-time, File Integrity Monitoring, Network Configuration, and Compliance.
Sponsored by Cimcor
Founded in 1997, Cimcor is an industry leader in developing innovative security, integrity and compliance software solutions. The firm is on the front lines of global corporate, government and military initiatives to protect critical IT infrastructure and has consistently brought IT integrity innovations to market.
Cimcor’s flagship software product, CimTrak, helps organizations to monitor and protect a wide range of physical, network and virtual IT assets in real-time. Built around leading-edge file integrity monitoring capabilities, CimTrak gives organizations deep situational awareness including who is making changes, what is being changed, when changes are occurring, and how changes are being made. This, coupled with the ability to take instant action upon detection of change, gives organizations assurance that their IT assets are always in a secure and compliant state.
Cimcor is headquartered right outside of the Chicago, IL market with business operations worldwide.
