Five Steps To Keep North Korean Hackers Out Of Your Network

“I’ve done a demo for years using an infected mobile phone to attack other systems in the network and exfiltrating the connection via text messages (mobile modem) so it never crosses the perimeter. Every way devices communicate that isn’t being monitored is a big threat for data loss,” Weidman said. This means that you must lock down your mobile phones and other external devices.

Taking steps

4. Keep patching religiously. “That doesn’t mean just the OS,” Sjouwerman said. He said that it’s critical to also make sure that all applications are patched, because hackers can easily penetrate a system via a compromised application.

Sjouwerman recommends using a tool to verify application update status such as Flexera Personal Software Inspector for personal use. There’s also an enterprise version called the Flexera Software Vulnerability Manager. You must also patch your network infrastructure equipment, including switches, firewalls and network appliances.

The Flexera products ease the burden for applications by scanning every application on your computer or on the network and comparing them to a massive database. Then Flexera updates or patches as required. But you must still have someone with the specific task of patch management for network devices and infrastructure.

5 Really train your staff to detect and respond appropriately to cyber-threats. This means repeatedly training your staff in detecting a phishing email and in what to do when they find one. Nearly all of the recent major breaches affecting enterprises have begun with a phishing attack. While there are security appliances that can find some of those phishing emails, attackers are getting very sophisticated in how they create their attacks.

So it takes a sharp eye, but it’s worth the effort. Weidman said that the one thing that makes her penetration testing difficult and which would make an attacker’s attempts difficult is a prepared victim. She described the people who don’t become victims.

“People who don’t fall victim to phishing attacks at all,” she said. “I know I’m dreaming but if a target really had it together about phishing and not just email—but SMS, social media like Twitter, messaging apps like WhatsApp, etc. that would be a big deterrent.”

Originally published on eWeek