What is cybersecurity

Cybersecurity protects your business against virtual theft the same way that a burglar alarm keeps thieves from stealing your company’s physical assets. 

Industries as varied as manufacturing and marketing rely on network-connected devices to get daily tasks done. These devices create potential channels through which unauthorized people can access your network and essential information. Data breaches can cost your company dearly: the average cost for one of these incidents is $4.24 million. Create a strong cybersecurity plan to close up any gaps in your system and reduce the chances of your company encountering security problems.

What is cyber security? Is the meaning different from cybersecurity?

Cyber security and cybersecurity are interchangeable terms. No matter which spelling you use, you need to keep your company's data safe from potential security breaches.

Why is cybersecurity important?

Cybersecurity protects your company from loss. The year 2021 saw a 17% higher average cost per security breach than the previous year and the highest of the last 17 years. This increase stemmed from more people working remotely. Breaches from remote workers averaged $1.07 million higher than those that did not originate from remote devices.

Your company’s financial wellbeing rests on a secure plan for data. No business today can operate without network connectivity. You need to create a robust cybersecurity plan for your business that allows your employees to securely log in to the network from their devices without risking an attack on your data.

You must also constantly review and update your security measures, because attackers learn from prior mistakes to create more sophisticated attacks. Insider threats show that even current or former employees can be sources of data breaches. Your company must have plans to prevent and respond to any type of security threat by keeping up-to-date on the latest threats and prevention methods.

Cybersecurity domains

Most people think only about their network when planning ways to secure their systems against hackers. But the network is only one aspect of your business’s operating system. You must also think about the other areas of your operations that require protection against an attack, including your applications, information, data storage system, and more.

Critical infrastructure security

Securing your business may not have an impact on critical infrastructures. Organizations that provide essential services such as utilities, public safety, or national security must elevate their internal security operations to protect their assets and the safety of the public. The U.S. Department of Homeland Security offers guidance in securing these critical components that keep the nation running.

Cloud security

Using the cloud is a modern option to allow for remote access to files, but the convenience of the cloud should not mean sacrificing data security. Choose a cloud content management (CCM) system that protects all content and allows only authorized individuals to access it. The best type of cloud security encrypts data during use, when uploading or downloading, and in storage. This encryption protects the data from hackers.

Network security

Your company’s network connects all the devices in your business to each other and any shared programs. Use strong passwords to protect your wireless and wired networks from unauthorized individuals getting into the network and accessing devices within it.

Information security

Information security focuses on keeping both hard copies of information and virtual data protected. Examples of information security include encrypting files stored with a CCM and keeping physical filing cabinets with customer information locked and in a secure room. Sensitive information to keep protected includes customer financial information, healthcare data, customer or client contact information, and proprietary information for your business.

Application security

Web-based applications can present entry points for attacks into your system. Even computer-based software can pose a threat. Look for apps that offer security at the design level through user authentication and encryption of sensitive data.

Disaster recovery

Disaster recovery often refers to recovering data after a natural disaster such as a hurricane. It can also refer to restoring company data following a security breach. You need a plan in place in case your network experiences a data breach that causes loss of company information. In many cases, this type of recovery depends upon remote storage of sensitive information on secure servers to help your company recover from a manmade cyberattack quickly with as little loss of productivity as possible.

User education

User education is vital to ensuring the rest of your system remains secure. Unless your employees know about the best practices to keep out threats, they could put your business at risk by opening suspicious email attachments or inadvertently sharing company data, such as network passwords.

Here’s an example.  A current employee uses their work email and password to create an account on another company’s website. This puts your business at risk, because if that website were to be breached, the hackers would have your employee’s login information for your company, too. For this reason, educating employees on choosing strong passwords, changing them regularly, and not using the same credentials for multiple websites could prevent security issues for your business.

Storage security

Data storage systems need to keep information secure through encryption. The storage method should allow only trusted individuals to access files. Individual files should also have credentialed access to ensure someone with access to one file does not have the ability to see every file. Most CCM options allow for remote storage of data, but look for more sophisticated security features that protect individual files and folders.

Types of cybersecurity threats

Cybersecurity threats to your business refer to the myriad of ways that hackers can access your system. Examples include phishing, malware, and ransomware. The most insidious of these threats can stop your work operations or lock valuable data until you respond to the hackers. Learn about the potential threats your company faces and how to avoid them to prevent lost time, data breaches, and financial losses.

Phishing

Phishing schemes come from attackers sending emails that look like they come from legitimate companies or known individuals. The attackers send a message that looks like a common email sent from a company, for instance regarding an order or a problem with login credentials. A link within the email is designed to look like a convenience feature to get the recipient to quickly address the issue. Once at the bogus linked site, the attacker may request login credentials, credit card information, or other sensitive data.

Social engineering is a similar cybersecurity threat that uses social media accounts to reach out to people in an attempt to collect login information or other sensitive data. Hackers could use the information collected to gain access to the victim’s online accounts, including their business network, or sell it to other entities.

Malware

Malware, also known as malicious code, has many forms, including viruses, malicious data files, trojan horses, and worms. These forms of malware can cause damage to a computer or network, disrupt operations, or allow a bad actor unauthorized access to files. To keep malware off your business computers and network,train employees to avoid downloading unauthorized files on work computers and not to open questionable email attachments 

Ransomware

Ransomware takes malware to the next level. This type of attack locks users out of information or data until the victim pays the attacker. For instance, in 2021, criminals attacked the billing and internal network of Colonial Pipeline. The results of the attack caused severe gasoline shortages for several states. The company ended the attack by paying the attackers $4.4 million in bitcoin.

This incident impacted millions of people beyond just those who worked at Colonial Pipeline. Ransomware incidents that affect critical infrastructure operations have far-reaching consequences. Businesses within sectors that are infrastructure-critical must take extra precautions to prevent ransomware and other cyberattacks, in order to protect themselves and their customers.

Man-in-the-middle attacks

Man-in-the-middle attacks are not as well known, but they can still cause significant damage. These types of attacks occur when a bad actor accesses an unsecured network and intercepts information passed between devices and that network. This type of attack quietly collects sensitive data sent over the network, such as passwords, financial information, or user names. Securing your network with a strong password that you change regularly can prevent this type of attack.

Advanced persistent threats

Advanced persistent threats (APTs) are similar to man-in-the-middle attacks. Both types of threats require patience from the attackers, who access the network but leave the system intact. APT attackers silently collect data via spying on the network. These types of attacks often don’t trigger defensive counter attacks because they don’t actively disable network components. Protecting your network from unauthorized access can help to reduce the chances of APTs.

Insider threats  

Insider threats are some of the most difficult instances of cyberthreat to come to terms with because no employer wants to think that one of their employees could steal company data. Anyone who has ever had access to your business’s network, including current and former employees and contractors, could present a threat. These threats happen when the attacker misuses their credentials to access sensitive information. Some cybersecurity packages plan for these types of threats, such as the Content Cloud with its zero-trust infrastructure, but many countermeasures only prevent external attacks. Look for security options that protect your data from internal and external threats.

Distributed denial-of-service attacks

Distributed denial-of-service (DDoS) attacks use excessive traffic to overwhelm a server or network. These types of attacks often use coordinated attacks from several sources.

Related to this type of attack is a denial-of-service (DoS) attack, which floods a server or network and locks out legitimate users. Both DDoS and DoS attacks cost businesses lost time and productivity until the network allows for users to access it again.

Key cybersecurity technologies and best practices

Your cybersecurity plans should include a blend of technologies to protect your computers, network, and data and to educate your employees in best practices. Both people and technological tools are essential to keeping your system secure and safe from attacks.

Train employees to be suspicious of all incoming emails

Your employees serve as the frontline against attacks. Training your employees should include supplying information on network security etiquette. Employees must know to never open attachments from suspicious emails or share their credentials with anyone outside the company. They must also understand how to create a secure password and change it regularly to keep their access secure.

Use multifactor authentication for logging in

Multifactor authentication (MFA) uses two or more ways to identify the authenticity of someone logging into a system. An example of this type of authentication is sending a code to a user’s email or phone when they try to log in. The user must then put the code into the system as a second form of identification.

MFA reduces the chances that someone with only a username and password could access the network. The individual must have access to the user’s phone or email and have the correct login credentials. Networks or apps that require MFA should still require strong passwords that the user changes regularly to reduce unauthorized access.

Install a firewall

A firewall prevents malicious traffic, such as viruses that send out user information, by restricting how much information goes outside the network. Many operating systems come packaged with firewalls. But these firewalls are only useful if you set them up and use them.

Change defaults for both passwords and usernames

Never leave default passwords or user names in place for devices or networks. A survey of CIOs and IT managers found 47% left the default password on devices connected to their business’s networks. These default passwords are weak and some of the first that hackers try when attempting to access a network. Changing the passwords immediately to unique, alphanumeric words or phrases that are difficult to guess can protect your system from hackers.

Choose strong passwords

Strong passwords are long and include letters, numbers, and symbols. A strong password is also unique to each login. Encourage employees to create strong passwords for their work emails and never to use the same password for multiple logins. The extra effort required by your employees to create strong passwords can reward your company with better protection against unauthorized access.

Install antimalware software and keep it updated

Hackers constantly change their tactics and introduce new threats. Your IT department needs to ensure that all devices have updated antimalware software to keep out the latest threats.

Keep the software on your computers updated

Operating systems and software on computers and other devices also have security features to protect the devices from malware and other intrusions. Keep these systems updated to ensure that every part of your system will stay secure from the cybersecurity threats.

What are the risks of having poor cybersecurity?

Poor security measures can allow unauthorized access to sensitive data. Your business could face fines for failing to protect customer data. Equifax credit agency agreed to a settlement in 2019 of $575 million for failing to protect databases with sensitive information for 150 million customers. Your company may not encounter such severe penalties, but could still face fines — along with the costs of lost time and fixing a security breach.

Data breaches of your company are costly. You can save money by building a secure system for your network and devices to avoid the losses caused by security failures.

What can you do to improve your cybersecurity?

You have an obligation to your business and customers to protect your company from attacks and security breaches. These tasks start by creating a team dedicated to keeping your network, software, and devices updated with the latest antiviral and operating system software. They will also train employees to learn to identify suspicious emails and avoid opening the messages or attachments within them. Your security team should also conduct exercises to ensure employee retention of the information acquired through security training.

Examine the areas where your company has the greatest risk of attack and focus on mitigating those risks. A company that has factory devices connected together through the Internet of Things (IoT) runs the risk of attackers accessing the machinery through the network. Securing the network and devices against unauthorized access can protect productivity at the facility. A business that uses CCM for saving and sharing files needs to choose a CCM service that keeps all data secure and encrypted.

Use technological tools, such as firewalls and encrypted CCMs, to protect your network and the information within it. Keep aware of changing threats to your business, and adapt your security measures to meet these changes.

The Box approach to cybersecurity

We take security seriously at Box. Our Content Cloud does more than just hope that attackers won’t notice your company. We create a zero-trust infrastructure. This system protects against both external and internal threats. Our system has a centralized layer that allows for simplified management of compliance and security for your company’s data.

The Content Cloud uses AES 256-bit encryption to protect files in transit, in storage, and in use. Additional features to protect your data include two-factor authentication and multi-layer watermarks. We also make it simple to comply with your industry’s specific requirements for protecting data.

Other security features we provide include Box KeySafe and Box Shield. You can manage your encryption keys as needed through Box KeySafe. Your business can also cut threats by using Box Shield to detect and classify potential threats. Our partnerships with trusted companies for our integrated apps bring another layer of security to the apps and the data that you create or share with them.

Learn more about the options we have to offer at Box

The Content Cloud provides your business with secure productivity tools you can use from anywhere. Contact us today at Box to find out the best pricing plan for your business and to request a demo that shows Box in action. We help you keep your data secure. Use our Content Cloud with your other cybersecurity practices in your company to ensure your network and data remain protected from cyberattacks.

**While we maintain our steadfast commitment to offering products and services with best-in-class privacy, security, and compliance, the information provided in this blogpost is not intended to constitute legal advice. We strongly encourage prospective and current customers to perform their own due diligence when assessing compliance with applicable laws.