Cybersecurity in detail

Today, we talk a lot about cybersecurity and the importance of browsing online safely. However, do you know exactly what cybersecurity is? You're about to discover its definition and the environment conducive to its proliferation.

What is cybersecurity?

In a straightforward way, cybersecurity is the protection of your confidential data, information, desktop and laptop computers, mobile devices and networks.

In your business, you have a wealth of digital data that is relevant to your daily operations. It is absolutely essential to protect it from cyber threats and those who create them. What are your locations likely to host cyber threats?

Cyber ​​threats can lurk in many places. The cyber threat environment can be as simple as a network-connected element. The moment you're on the network, you're likely to encounter cyber threats.

Here is a non-exhaustive list of elements of your network likely to be attacked by cyber threats:

• Company website
• Cloud storage and computing
• The Intranet
• Your Voice over Internet Protocol ( VoIP ) software
• Your social media accounts
• Web applications you use
• Smart devices connected to the Internet
• E-commerce platforms and solutions

and several others

What types of cyberattacks most commonly affect Canadian companies?

There are several types of cyberattacks that originate from all corners of the globe. Here is a list of eight common ones that can affect both private businesses and your personal computer.

The virus

A computer virus is a program coded by a third party. Once infected, it replicates itself, causing disruption to the computer and damaging stored information.

An adware

It's a software that installs itself on your computer and pollutes your browsing with continuous advertising. You're likely to get this type of application when you download free tools from questionable sources. 

The spyware

Simple software for tracking your actions on your computer. This way, your actions will be tracked and you can, for example, receive targeted advertising.

Password cracking

When someone accesses your files using your password without giving prior authorization. 

The feat

Program that takes advantage of vulnerabilities in software in circulation.

Browser hijacking software

It occurs when unwanted programs impair the activity of the browser in question to redirect your actions, spy on what you do, steal your information and display advertisements to you.

The ransom

Popular a few years ago, this program locks the computer and its data. An affected person usually had to pay a sum of money or cryptocurrency to obtain an unlock key.

The Interceptor Attack

The attacker intercepts the targeted person's connections and communications. You can learn more in our article. What is a man-in-the-middle attack and how to protect yourself from it?

The Trojan Horses

At first glance, the program appears legitimate, but it contains malicious functionality. The person who sent you this software aims to steal your financial and personal data. The Trojan can also take control of your computer and launch attacks against other people. 

Phishing: the most common entry point

Many of the threats above reach a business through a single channel: email. Phishing messages impersonate a trusted sender, such as a bank, a supplier or a colleague, to convince the recipient to click a link, open an attachment or enter a password. One successful phishing email can lead to a ransomware infection, a stolen account or a fraudulent payment.

How to protect your business: the essentials

No single tool stops every threat. Effective cybersecurity combines several layers:

1. Multi-factor authentication (MFA) on email, cloud applications and remote access, so a stolen password is not enough to get in.
2. Regular updates for operating systems, browsers and business applications, which close the vulnerabilities that exploits rely on.
3. Endpoint protection on every computer and mobile device, centrally monitored rather than left to each user.
4. Backups that are automated, stored separately from your main systems and tested regularly, so you can recover from ransomware without paying.
5. A properly configured firewall and secure Wi-Fi, with guest devices kept on a separate network.
6. Least-privilege access, so each employee can only reach the data and systems their role requires.
7. Employee awareness training, because many attacks depend on someone clicking, downloading or sharing something they shouldn't.

Common mistakes businesses make

• Thinking you are too small to be targeted. Many attacks are automated and look for any vulnerable system, whatever the size of the company.
• Sharing accounts and passwords between employees, which makes it impossible to know who did what or to remove access cleanly.
• Postponing updates because they are inconvenient, leaving known vulnerabilities open.
• Never testing backups, only to discover during an incident that they are incomplete or cannot be restored.
• Having no plan for what to do, and who to call, if an attack happens.

A simple starting checklist

If you are unsure where your business stands, start with these questions:

• Is MFA enabled on every email account?
• Do you know which devices access company data, and are they all up to date?
• When did you last restore a file from backup to check that it works?
• Do former employees still have active accounts?
• Does everyone know who to contact if they notice something suspicious?

Any "no" or "I don't know" points to a priority.

Cybersecurity and Québec's Law 25

For Québec businesses, cybersecurity is also a legal matter. Law 25 requires organizations to protect the personal information they hold, keep a register of confidentiality incidents and report those that present a risk of serious injury. Sound security practices are the foundation for meeting these obligations.

To put these protections in place without building an in-house team, explore our cybersecurity services.

Nexxo can help protect you against cyber threats!

Are you a business and has this article raised questions about your IT security? Contact us now. The initial consultation is free, and we'll be happy to assess how we can help you.