In today’s digital age, cybersecurity threats are not just a concern for large corporations or government agencies—they affect individuals, small businesses, and enterprises alike. The increasing frequency and sophistication of cyberattacks underscore the need for us all to develop comprehensive strategies to mitigate potential incidents. Proactive measures, combined with robust incident response plans, are critical in minimising the impact of cyberattacks and safeguarding valuable assets.
Here are some effective strategies that can help mitigate cybersecurity incidents:
Australian Cybersecurity Centre Essential Eight
The Australian Cybersecurity Centre (ACSC) Essential Eight is well documented and I wont cover this in any detail as the ACSC have done a great job of doing this here.
Mitigating cybersecurity incidents effectively goes beyond just adhering to the Essential Eight. In this blog post, we’ll explore additional strategies you can implement alongside the Essential Eight to further strengthen your cybersecurity posture and reduce the risk of attacks.
Beyond the ACSC Essential Eight
1. Domain Security
In the digital age, securing your domain name is an essential aspect of safeguarding your online presence. A compromised domain can lead to malicious attacks such as phishing, website defacement, or even data theft. Implementing robust domain name security practices is crucial for ensuring your organisation’s trustworthiness and the protection of sensitive information.
Strategy:
- Enable Domain Locking
One of the first steps to securing your domain is domain locking. This feature prevents unauthorised transfers of your domain name. Without locking, cybercriminals could potentially transfer your domain to another registrar without your consent. Domain locking ensures that changes to the registrar and DNS settings are only made by authorized parties.
- Use Domain Name System Security Extensions (DNSSEC)
DNSSEC adds an extra layer of security to your domain by ensuring that DNS queries (requests to access websites) are verified and authentic. It protects against attacks like DNS spoofing and cache poisoning, where attackers redirect traffic to malicious sites. By signing your domain’s DNS records, DNSSEC ensures that users are directed to the correct websites
2. Email Security
Email remains one of the most common forms of communication, both in personal and business settings. However, its widespread use also makes it a prime target for cybercriminals who engage in fraudulent activities like phishing, spoofing, and spam. To mitigate these risks, implementing robust email security protocols like SPF, DKIM, and DMARC is essential.
These protocols work together to protect the integrity of your email communications and ensure that only authorised parties can send emails from your domain.
Strategy:
Sender Policy Framework (SPF)
SPF is an email authentication protocol that helps prevent email spoofing by verifying that incoming emails from a domain are sent from authorised IP addresses. When you implement SPF, you publish a list of approved IP addresses in your domain’s DNS (Domain Name System) records. When an email is received, the recipient mail server checks the SPF record to verify whether the email came from an authorised server.
DomainKeys Identified Mail (DKIM)
DKIM adds an extra layer of authentication to email messages by attaching a digital signature to each outgoing email. The signature is created using a private key and can be verified by the recipient’s mail server using the corresponding public key, which is published in your DNS records. DKIM ensures that the email content has not been altered during transit and that it was indeed sent by an authorised sender.
Domain-based Message Authentication, Reporting, and Conformance (DMARC)
DMARC builds on SPF and DKIM by adding a policy framework that helps prevent email spoofing and phishing. DMARC allows domain owners to define how they want email receivers to handle authentication failures, providing them with detailed reports about email activity and any authentication issues.
The Benefits of SPF, DKIM, and DMARC Integration
When used together, these protocols enhance your domain’s email security and deliver multiple benefits:
- Protection Against Spoofing and Phishing: SPF, DKIM, and DMARC prevent attackers from sending fraudulent emails that appear to come from your domain, reducing the risk of phishing attacks.
- Improved Email Deliverability: Emails that pass authentication checks are more likely to land in recipients’ inboxes rather than being flagged as spam.
- Visibility and Reporting: DMARC provides valuable insights into how your domain’s emails are being handled by other mail servers, allowing you to detect unauthorised email activity and take corrective action.
3. Network Segmentation and Micro-Segmentation
One of the best ways to contain the spread of a cyberattack is to limit an attacker’s ability to move laterally across the network. This is where network segmentation and micro-segmentation come into play. By dividing the network into smaller, isolated segments, you can restrict access between different parts of the network, making it harder for attackers to reach critical systems.
Strategy:
-
- Implement network segmentation to separate sensitive data or mission-critical systems from the rest of the network.
- Use micro-segmentation to apply more granular control over network traffic, ensuring that only authorised users and devices can access specific parts of the network.
4. Threat Intelligence and Continuous Monitoring.
Proactively identifying and responding to emerging threats can significantly reduce the chances of a successful cyberattack. By leveraging threat intelligence and continuously monitoring your network, you can detect suspicious activities in real time and take immediate action.
Strategy:
- Use Security Information and Event Management (SIEM) systems to collect and analyse logs from various devices and applications across your network for signs of unusual behavior or potential threats.
- Subscribe to threat intelligence feeds to stay updated on the latest attack techniques, vulnerabilities, and emerging threats that could target your industry.
- Implement continuous monitoring of your IT infrastructure to detect anomalies and vulnerabilities before they are exploited.
5. Third-Party Risk Management
Organisations often rely on third-party vendors and partners, which can introduce additional cybersecurity risks. A vendor or partner’s security breach can expose your organisation to cyber threats.
Strategy:
- Implement a third-party risk management program to assess and mitigate risks posed by external vendors, suppliers, and partners.
- Regularly evaluate the security posture of third parties and ensure they adhere to the same security standards you apply within your own organisation.
- Ensure that third parties have implemented MFA and other strong security controls to access your systems.
6. Backup and Disaster Recovery Planning
While the ACSC Essential Eight highlights the importance of backing up critical data daily, a more robust disaster recovery strategy should include not just backups, but also an overall recovery plan to ensure business continuity in the event of an attack.
Strategy:
- Regularly test backups to ensure they can be restored quickly and accurately during a disaster.
- Implement disaster recovery as a service (DRaaS) to automate recovery and minimize downtime during an incident.
- Create offsite and cloud backups to ensure that data remains accessible even if physical infrastructure is compromised
7. Employee Education and Awareness
Even with robust technical measures in place, human error remains a primary cause of cybersecurity incidents. Employees who are not trained to recognise cyber threats, such as phishing emails, social engineering attacks, or weak password practices, can inadvertently compromise an organization’s security.
Strategy:
- Implement regular cybersecurity training to help employees recognise and avoid common threats. Focus on practical, real-world examples like phishing simulations and social engineering tactics.
- Educate staff on safe password practices, including the use of password managers and the importance of creating unique, strong passwords.
- Promote a culture of security awareness, where employees feel comfortable reporting suspicious activity or potential vulnerabilities.
