4 Common Data Security Breaches and How to Avoid Them

As more devices become interconnected, security breaches are becoming increasingly common and enterprises are doing everything in their power to stop them. Fortunately for them, most of these security breaches are the result of poor practices and can be controlled by applying a few simple steps. In this article, we’re going to look at four common data security breaches and how you can avoid them.

Accidental Malicious Software Installation

Accidentally installing malicious software is one of the most common types of data security breaches. Clicking on a PDF to view it and installing malware is all too common, as is downloading a file that looks like a Microsoft Office file type but isn’t is another way you can accidently get malicious software into your computer. Training users to review files types and not open attachments from unfamiliar people are the first steps to improving your network security.

Accidentally installing malware that masquerades as a security warning from a website is another way malicious software can get into your network, and it can be reduced by blocking popups. Setting up automatic scanning of all attachments by your email application is a good solution. Prohibiting employees from installing software for personal use should be company policy, while restricting their ability to install software except for an approved list from a company controlled app store may be necessary.

Compromised Operating System Settings

Hackers are often able to compromise computers by altering the operating system settings. One way to prevent this problem is to require users to have separate user accounts from their administrative accounts and requiring the user level account to be used most of the time. This has several benefits. First, if the user level account is hacked or compromised, the administrative account is still protected. Second, if someone walks over to an unattended computer, it probably doesn’t give them administrative level access. Third, it reduces the risk of someone making an error while logged in as an administrator such as permanently deleting a file or installing malicious software.

This creates inconveniences for the users, such as having to log in with an administrator account to change critical settings and install software. Your IT department can reduce the hassle by pushing updates to the users’ computers so they don’t have to log in with an admin account to update applications like Java and Adobe. If users know that common software updates happen without action on their part, they are also less likely to fall for malicious software pretending to be an update of legitimate software applications.

Someone Physically Accesses the Computer and Misuses It

Despite the fear of hackers gaining remote access to a computer and then abusing it, insider threats remain a threat to your organization. It could be as innocent as one employee using another’s system to view information they should not see like the personnel files of their coworkers. A subcontractor could walk over and view sensitive company files out of curiosity or deliberately to collect information for their employer. Then there are malicious parties that may visit the site and install a USB drive with malware into the computer so that they can steal as much information as possible. This scenario is prevented by disabling USB connections and CD drives if they are not used.

The first step to preventing security risks is making employees log off of their computers when they step away. IT can set up scripts that automatically log users off of their computers after a period of inactivity.

Training employees to protect their passwords so that others cannot log in as them is essential. Requiring people to log into their computers with one set of credentials and the network as another adds another layer of security, as long as the computer and network passwords are separate. Another essential step to IT security is requiring people to change their passwords regularly and not use a variation of a recent password.

Controlling Insider Threats

Insider threats are internal parties with accounts that misuse and abuse them. You could have an inadvertent data spill when someone emails company files to their personal account to work on at home or intentionally sends sensitive data to an external source to share good news about the company. You can limit this risk by preventing most employees from accessing social media sites from work and prohibiting access to external email servers like Hotmail, Outlook and Yahoo.

You may not be able to prevent someone with access to files from deleting them maliciously, but built-in backups of all data and the logging of all user activity lets you identify who is abusing their privileges and let you reverse the damage. Limiting the access of those suspected of being upset or notified of their upcoming layoff is wise. Using virtual data room providers to give IT contractors and third parties access to your data also limits the damage they could do.

---

Conclusion

Employee training to understand threats to IT security like fake software update notices and suspicious attachments are the start to improving your company’s security. Requiring them to use secure passwords and changing them often are good practices. Separating administrative level access from day to day user activities should be done, while you should investigate ways to eliminate the need for administrative access for your general employees. You cannot eliminate all insider threats, but close monitoring and tight access controls can minimize the risk.