Don’t make hackers at home for the holidays

By Tim Boivin

While you’re home for the holidays this year, you may have some unwelcome guests…on your organization’s infrastructure. That’s because for hackers, any holiday is the gift that keeps on giving:

• Colonial Pipeline paid a ransom to the Darkside hacking group after it had to shut down operations during Mother’s Day weekend.
• JBS, the world’s largest meatpacking business, was hacked on the Friday of Memorial Day weekend.
• Kaseya, the IT management software company, was hacked on the Friday before the Fourth of July, with a ransomware attack that ultimately affected the operations of more than 1,000 of its business customers.
• Howard University was forced to cancel classes for more than a week following Labor Day after it was hit with ransomware.

If you protect your infrastructure with Total Access Control (TAC), the Zero Trust solution from PortSys, you’re already in good shape to mitigate and stop the spread of these holiday attacks cold. That’s because TAC’s reverse proxy sits between your users and the resources they wish to access – using robust security controls based on your organization’s own security policies to determine who should get access to what within your organization.

If you aren’t (yet) a TAC customer, CISA and the FBI outline the best practices to stay vigilant this holiday season. Their notice also details how to protect your users against phishing scams, fraudulent sites, and the dangers of unencrypted financial transactions. These best practices include:

• Identify IT security employees for weekends and holidays who would be available to surge during these times in the event of an incident or ransomware attack.
• Implement multi-factor authentication for remote access and administrative accounts – a critical defense mechanism already in place for all TAC customers. TAC seamlessly validates and verifies a user’s request for access, examining the user’s full context of access – including device validation, operating system being used, OS version and patch level, anti-virus and certificate status, registry entries, domain-joined status and checking to see whether the user has a jail-broken or rooted device.
• Mandate strong passwords and ensure they are not reused across multiple accounts. However, as mentioned above, TAC doesn’t rely solely on passwords, which are too easily hacked. The user’s entire context of access is examined before access is granted to your resources, local or cloud.
• Ensure remote desktop protocol (RDP), VPNs, or any other potentially risky services are secure and monitored. Since TAC proxies any connection requests, they are no longer made public, which means the automated scans hackers rely on won’t find any open ports.
• Remind employees not to click on suspicious links (and, we would add, attachments). Conduct exercises to raise awareness about those threats.

The holiday season already has enough stress built into it. Eliminate the added stress caused by unwelcome hackers who try to crash your holiday plans by following these best practices. And also, think about giving your organization the gift of TAC in 2022 to stop these attacks – not just over the holidays, but every day.

If you would like to explore how Total Access Control, the Zero Trust solution from PortSys, can help to simplify, strengthen, and unify your IT security, contact us at info@portsys.com