As the year draws to a close, our cybersecurity team reflects on a period marked by escalating cyber threats, innovative attacks, and a heightened sense of vigilance. While 2023 brought its share of challenges, it also reinforced the importance of robust cybersecurity measures and the dedication of our frontline experts in safeguarding our customers’ critical data and systems.

In this blog post, we delve into these significant events, seeking to extract lessons learned, identify emerging trends, and assess the future of cybersecurity. Our frontline cybersecurity people share their insights, providing valuable perspectives on the evolving threat landscape and the measures we must implement to stay ahead of the curve.

Important note: There are an endless amount of cyber security measures that organisations can deploy to help strengthen their defences against breaches.  In this blog post, we asked our experts to rank the most common ones they recommend the most often. Some of these controls could be deemed more or less important depending on the maturity of the organisation deploying them. Now that side note is out of the way, let us discuss our top cyber security measures for 2024.

The Top Cybersecurity Measures to Consider

Problems with Passwords Again

It is not surprising that implementing a strong Password is the most important measure year after year. After all, passwords are the number one cause of incidents (Sophos).  It seems that people are still choosing weak passwords, using generic passwords (such as admin1), not using password managers, and using passwords across several websites and SaaS products. This in combination with inactive MFA and MFA-fatigue is like TNT and matches…a recipe for disaster.

Keeping software up to date

Updates should be your new obsession. Security patches are rolled out constantly and implementing a procedure to update your OS is vital in this day and age. The recent Citrix Bleed vulnerability (CVE-2023-4966) if unpatched allows hackers to obtain authentication tokens and access systems. One recent victim of this exploited vulnerability is Fidelity National Financial, one of the US’s largest underwriters.  BlackCat claims it is behind the ransomware attack as Fidelity was forced to shut down several key systems.

Cyber Security Awareness Training

As we mentioned in part 1, establishing a cybersecurity-first culture at your organisation requires a programmed approach to Security Awareness Training (SAT), reinforcement, and industry/job personalisation. Success organisations have created a “Human Firewall” as a result and are less likely to be caught by a phishing email and understand the importance of proper password management.

Limiting access to sensitive data

Number four on our list is Limit Access to Sensitive Data. The principle of least privilege (PoLP) is an information security concept which maintains that a user or entity should only have access to the specific data, resources and applications needed to complete a required task. Organisations that follow the principle of least privilege can improve their security posture by significantly reducing their attack surface and risk of malware spread (source). Least privilege is one of the cornerstones of the Zero Trust.

Incident Response

Number five on our list is to implement an Incident Response Plan (IRP). An IRP is a written document, formally approved by the senior leadership team, that helps your organisation before, during, and after a confirmed or suspected security incident. Your IRP will clarify roles and responsibilities and will guide key activities. It should also include a cybersecurity list of key people who may be needed during a crisis (Source). It is also useful to print off a hardcopy of the plan in case your systems are inaccessible (top tip!). Taking your cyber incident response plan seriously can help you bounce back from attacks faster and recalibrate your customer relationships in the process (Source).

Uncertain about your cyber security posture? Consult our experts today. We are here to provide clear, independent guidance and answer all your questions. Contact us here.