What did the National Cyber Director say?

3 days ago

2 min read

National Cyber Director Sean Cairncross recently spoke at the Billington Cybersecurity Summit about what the US is doing at the Federal level to defend our country against cyber attacks.

The shocking takeaway? To protect our country at a grand scale, each of us need to go back to basics, ensuring that we're doing fundamental cyber hygiene at our companies. Adversaries are winning by taking advantage of misconfigured, unpatched and unsecured technology that we depend on for our society to function.

For example, earlier this year the FBI urged us to fix basic security failures as part of its Operation Winter Shield campaign. It was in response to a vast wave of hacks that created outages at hospitals, power companies, logistics/transportations and manufacturing.

If that's not you, I promise that your company participates at some point along the supply chain to critical infrastructure. Attackers are successfully infiltrating top level organizations by first hacking into less-secure vendors, contractors, or third-party software programs.

The Takeaway

While you might not be able to harden our country's telecom networks to fight hackers trying to use our communications systems to spy on us, you can start with the basics. Here are my top pics from Operation Winter Shield:

Keep old technology from becoming an easy way in. Install security updates promptly and replace computers, servers, software and other equipment that is no longer supported by the manufacturer. Unsupported technology stops receiving security fixes and becomes an easier target for attackers.
Don’t give everyone administrator access. Employees should use regular accounts for everyday work. Administrator access should be limited to the people who truly need it and only used when necessary. This reduces how much damage an attacker can do if an employee’s account is compromised.
Write your Incident Response Plan before something goes wrong. Know who will make decisions, who to contact and what your company will do if there is a cyberattack. Practice the plan occasionally so you're not figuring everything out for the first time during an actual emergency.