Security is an ongoing effort

If you want to secure a house…

It won’t help if you install an alarm, but don’t use it, because it’s a hassle to turn it off and on.

It won’t help to install steel doors if you don’t have windows.

It won’t help if you leave the key below the doormat.

It’s the same with digital security. You can’t focus on just one area, but neglect others.

A software system is only as strong as it’s weakest part. An attacker will look for weak spots to exploit.

That means that you should have security in mind as you design the system, not as an afterthought.

Apply some black hat thinking. “How would I exploit this?” is a question to ask yourself at every step.

Security as a team effort

Everyone on the team should have security in mind. It concerns people at all levels and departments.

Social engineering

One of the biggest weak points are your people. I don’t say that in a derogatory way.

If people have not been trained on digital security, they will fall victim to one of the many exploits that target their compliance, compassion or curiosity.

An actor with a malicious intent will be able to get them to click on a file attachment by sending a targeted email.

Have them reveal a piece of information they shouldn’t have through a phone call or leave infected USB keys around with curiosity inducing labels.

The value of experts

The best way to secure a software system is to have white hat experts try to hack it and then keep plugging the holes.

Adopting “best practices” and hoping for the best is not a valid strategy.

It’s better to be proactive and search for exploits.

Tools and automation

If people can get around a limitation they will. That’s why limitations are annoying, but also a critical part of a secure system.

It’s better to enforce rules that are annoying, but hard to get around.

Password policies, access restrictions, automated scanning tools are helpful in keeping the system safe.

Limit the attack vectors

If a part of your system gets compromised, that’s bad. But if by compromising a single part, the attacker gains access to everything, you’ve done a poor job.

One of your server gets hacked? What can the attacker do from there?

Is it free roaming once they are inside your network, or do you have a tiered approach where your most sensitive data is behind multiple security layers.

The silver lining

I’m not an expert on security, but I was fortunate enough to soak some knowledge from a few amazing people in the field.

If you take just one thing from this, it’s that security is built-in and not slapped on.

Yours,

Taj