The topics, which businesses should consider so as to ensure cyber security.

Don't be a victim of Social Engineering

The concept of social engineering was a cyber threat long before today, when everything matches with the virtual world. Users who are deceived by this method, which Kevin Mitnick, one of the most famous hackers in the world, frequently uses and have generalized, can voluntarily transmit a lot of information, including their system login information, to the other party. This situation proves that corporate cyber security is not only about system administrators but also includes all company employees. In this scope, besides the mindfulness and awareness trainings for employees, such applications as two-factor authentication techniques and secure identity verification solutions are of critical importance so as to protect your organization's data safe.

Phishing attacks appears in front of us as one of the social engineering tools. In this method, users can become victims by clicking on the link or file having come with an e-mail they receive. These messages, which are prepared with attractive suggestions to guarantee the click (a considerable order offer, an intriguing message, a credit card refund contribution return that looks as if it came from your bank, etc.) can sometimes direct people to copied pages of homepages of banks ’internet branch, and thus access to your account as well as obtaining all your personal information. Security software manufacturers offer a variety of tools to prevent this. While this is a sub-solution embedded in antivirus software for individual users, corporate users can avoid being a victim by blocking this message on the server. Nevertheless, users need to think twice before clicking on any message, especially with such attractive content. Otherwise, there may be risks of losing both financial and information.

Keep Ransomware Out of the Door

Ransomware, which was once confronted as the biggest cyberattack problem of institutions all over the world, can be, in words of one syllable, expressed as locking your system and demanding money and ransom. Although it varies according to different researches, it is predicted that the damage to be incurred by businesses on account of ransomware in 2021 will exceed 20 billion US Dollars.

Attackers who install the ransomware on your computer via an e-mail request a payment to undo the changes they have made. Since these changes are methods such as encrypting data and blocking access to information, there are not many alternatives, other than making the payment, users who are attacked. The higher the criticality level of the information rendered inaccessible by attackers is, the higher the ransom amount becomes. Furthermore, if the payment is not made, the amount of ransom also increases. Malicious ransomware exploits various vulnerabilities in systems, as well as e-mail. The way to prevent this is through the scanning and vulnerability detection that comes with the use of up-to-date software and vulnerability management, as well as conscious use.

 Take Control of Mobile Device Access

Mobile devices have been integrated into corporate systems for a long time. Both smartphones and tablets have become an integral part of business processes. Therefore, it has become an obligation to restrict the access of these devices to the systems with certain authorizations. Access restrictions to be imposed on devices against the risks of loss and theft can preclude various cyber risks brought by these devices, especially data theft.

Don't Be Exposed to PPD Penalties

LPPD, that is to say, the Law on Protection of Personal Data, has brought many legal obligations to businesses. This law, which includes various obligations, especially obtaining the consent of customers for use, also includes serious financial sanctions in the event that the data is used outside of the permitted subjects. In this scope, LPPD requests a data supervisor for transactions regarding data protection. “Data supervisor refers to the natural or legal entities who determines the purposes and means of processing personal data, and is also responsible for the establishment and management of the data recording system. Legal entities, themselves, become “data supervisors” within the scope of their activities made by them regarding the processing of personal data, and the legal responsibility specified in the relevant regulations will be in under the responsibility of, in the person, the legal entity. In this regard, “There is no difference in terms of public law legal entities and private law legal entities. " The data supervisor, defined by the aforementioned expressions, not only confronts criminal sanctions after data theft, but corporate reputation is also damaged.

For all these reasons, it is essential that enterprises need to protect their systems against information theft with high security measures. In these transactions, which are also defined as LPPD compliance, a cyber security policy must be implemented in line with the criteria set by the law.

Protect Your Passwords

Password security, which can be enabled with in-house information security awareness, concerns not only the IT department, but also all employees. This method, which has been encountered many times in the past, is among the primary methods applied by data thieves. This situation, which can be defined with many risks ranging from the password of an e-mail account being stolen to losing a memory stick, can seriously harm the information security of the institutions.

Make sure your software is up to date

Another issue that should be considered is that the in-house software are up-to-date versions. Even if an update comes, and if it is not applied, the security gaps that come with that update cannot be removed.

Increase Your Network Security Standards

In the new order operating in the cloud environment, appropriate solutions are necessary. For example, such solutions as Next-generation Network Access Control (NAC) control and record all accesses happening across the network. While access to the content kept in the cloud is under control, devices with outdated applications, or missing or non-existing security certificates and unauthorized persons cannot access the network with an Ethernet cable or Wi-Fi password.

Reduce Risks with Vulnerability Management

Vulnerability Management applications that reveal the security risks of your system ensure that the risks, which might be encountered, are prevented at the start of them. Vulnerability Management applications, which include stages such as analysis of the existing system architecture, leaking tests, risk modeling, determination of priorities and creation of an action plan, not only reveal the current situation, but also indicate what cyber security measures should be taken for the future.

 Do Not Ignore To Back Up Your Data

Data backup is, of course, not just a matter of natural disasters. Data backup have a critical importance in terms of a malfunction to happen in the general system, of theft of data, and of all issues that require data to be recovered. For a more comprehensive solution, of course, this backup should be done with professional backup software rather than physical external disks. These types of solutions allow fast recovery in emergency situations, while eliminating the risks such as the loss or theft of physical external disks.

Paying attention to certain points while backing up can increase the benefit to be achieved. For example, making the backup in a place isolated from the existing system, helps, in attacks such as ransomware, to return to the normal process without the obligation to pay ransom, or to minimize the effect of these attacks. Therefore, the relevant institution does not suffer any financial loss and paves the way for the uninterrupted continuation of business processes.

Benefit from 24/7 Solutions of Monitoring and Protection

Cyber security-related events can occur at any time of the day. For this reason, it is essential that the solutions, which provide 24/7 monitoring of systems, be preferred. Such solutions provide high-level information and data security by automatically intervening in cyber security violations to be made out of working hours.

Get Prepared against Natural Disasters

Natural disasters such as Earthquake etc. are phenomena that directly affect the workflow of businesses and sometimes stop them completely. In such a case, backing up the data automatically is of critical importance in terms of the continuation of the workflow and the prevention of information loss. This solution, where data backup solutions are at the forefront, enables, with fast and uninterrupted backup, your business to continue its activity at any time.

Make Sure You Take Necessary Safety Precautions While Working Remotely

After COVID-19, many businesses provided for their employees with the opportunity to work remotely. While this method eliminates health risks, it also increases the number of people accessing your systems, therefore creating various cyber risks. In order to eliminate these risks, the first method that comes to mind and should be applied is to establish a remote access connection via a VPN.

On the other hand, only limited access permissions, in accordance with their duties, should be given to users who will connect to your system with remote access, and critical data such as, especially, CRM and ERP should be banned to access, other than authorized persons.