General security

Customer data protection: A comprehensive cybersecurity guide for companies

Data is the new currency, and ignoring data security is no longer an option. Unfortunately, hackers have been getting quite efficient in deceiving companies through different malicious practices.

According to ISACA’s State of Cybersecurity Report 2021, there have been 35% more incidents this year than the previous year. Topping the list of cyber threats was social engineering, which accounted for 14% of the incidents. Social engineering is where malicious actors try to influence employees to take a specific action, such as providing login details or granting unauthorized access, which may expose vital information.

Preventing social engineering attacks requires reliable data protection measures for your organization. However, there are no one-size-fits-all solutions for companies so that cybersecurity measures will vary for each organization. This article will discuss a few different cybersecurity best practices to achieve better protection against data theft and malicious actors.

Let’s first start with the customer data protection policies and regulations that you need to comply with for your business.

 

1. Compliance for data protection

 

2020 was the year major data security regulations came to parts of the U.S., mainly due to the California Consumer Privacy Act (CCPA). It is a law passed by California that provides power to consumers around the personal information companies collect.

CCPA also gives customers the ability to ask for a complete list of third-party service providers sharing data. Another critical aspect of the law is its legal clause, where a customer may file a lawsuit against a company caught violating the privacy guidelines.

However, the most significant change in the data regulations came when the Court of Justice for the European Union ruled out the adequacy of the EU-US shield. Also, in June 2021, the European Commission adopted two sets of standard contractual clauses (SCCs) required for GDPR. One SCC is for use between controllers and processors. The other SCC is for the transfer of personal data to third countries.

Apart from European Union and U.S. data protection laws, your business needs to comply with several other key regulations and guidelines. Some of them include:

• PIPL or Personal Information Protection Law in China
• Data Protection Act (DPA) in the United Kingdom
• Lei Geral de Proteção de Dados (LGPD) in Brazil
• Australian Competition and Consumer Commission’s (ACCC)

Now that you know some of the major data regulations your company needs to comply with let’s discuss how to comply with different cybersecurity best practices. The first step will be to harden your networks and systems to help prevent data breaches through the platforms and portals of your business.

 

2. Securing platforms

 

There are several ways to secure your platforms, like data encryption, installing firewalls and enabling virtual private networks. Encryption is one of the best ways to ensure that data remains anonymous to hackers.

For securing websites, you can leverage SSL certifications. An SSL (Secure Socket Layer) employs encryption algorithms to encrypt data exchanged between a browser and a user’s device. The shared data is hidden from hackers and prevents some man-in-the-middle attacks (MiTM). By installing an SSL certificate, your website will also achieve a secure badge of HTTPS, which helps in better search engine rankings.

If you want to secure multiple domains for your business, SSL certification may not be the best choice due to installing individual certificates for each domain. In this case, you can use a wildcard SSL certificate to secure the primary domain and several sub-domains.

Securing your platforms is a great way to protect customers’ data, but you also need to identify legitimate users before allowing access to your systems. Without proper authentication, hackers may be able to access your systems and vital information.

 

3. User authentication and up-to-date software

 

User authentication is essential to protect critical data and systems against malicious attackers. This is especially important if you are an e-commerce platform that saves financial data.

Take an example of the Equifax data breach in 2017, which affected the personal data of 150 million individuals, including the credit card details of more than 200,000 users. Improper authentication and outdated software can leave holes for attackers to exploit and gain access, which is exactly what they did to Equifax.

One of the best ways to ensure cybersecurity for your platforms is a robust user authentication system and clear policies and procedures about implementing updates to protect against known vulnerabilities.

Several types of authentication can be used to protect against unauthorized access to your systems.

 

Basic authentication system

 

A basic authentication system allows users to access data or content on your platforms through unique I.D. and password generated on the signup. For example, one of the most common passwords is the very simple “123456.” these are basic systems with a single layer of protection. The biggest problem here is the susceptibility to phishing attacks.

Cracking such a simple password is not that hard, and with only basic authentication, hackers can easily access any data available to that compromised account. Additional layers of authentication can help.

 

Multi-factor authentication

 

Basic authentication is not enough for enterprises that have third-party services accessing data across platforms. Such enterprises can leverage a second (or third) layer of protection through multi-factor authentication. The most common is for an additional layer of security to be added via a one-time password or an authenticator app on the user’s device.

Apart from the one-time password or authenticator application, you can also allow your users to use a physical smart card for data access. By layering these different authentication factors, access to systems and networks becomes more difficult for malicious actors to compromise.

For example, organizations can use sensor-based technology for user identification, and most modern smartphones have fingerprint sensors that can be leveraged for user authentication. This is another type of authentication factor that can be implemented.

 

4. IoT security system

 

Internet-of-Things (IoT) devices have seen a surge in usage across multiple industries. One classic example of embedded IoT systems is fleet management systems that leverage IoT devices to track packages. As more of these devices and systems can be accessed remotely, it also opens them up to potential cyberattacks.

According to an IoT survey by Statista, 33% of respondents have concerns that attacks on IoT devices may impact critical operations. However, on the whole, this survey also suggests that 99% of respondents are concerned with overall IoT security due to a lack of skills or protection of sensitive information.

Most businesses use customized Application Programming Interfaces (APIs) to exchange data between their systems and IoT devices. APIs are a set of protocols that enable the exchange of data between heterogeneous systems. The best way to secure IoT devices is by improving API security.

You can leverage OAuth technology for enhanced API security where users don’t need to disclose their credentials. Instead, a third-party server will provide the secret token to the users that they can use for data access on your systems.

Similarly, you can program a trigger function that offers encrypted tokens for different IoT devices. The exchange of data through APIs is executed after decryption at the system endpoint. Another challenge is integrating advanced technologies like artificial intelligence and keeping them secure for customer data protection.

 

5. Advanced protection

 

Artificial intelligence is an innovative technology that enables organizations with intelligent features and predictive recommendations. However, A.I. has its own set of vulnerabilities like programming hacks, malicious inputs and others. In addition, most of the AI-based programs are output-based, where there is a desired output expected.

Though hackers can influence the output by hacking the input through malicious injection, every A.I. algorithm leverages the input data to train models. So if that information is changing, the output will be different from the expected one.

The best way to ensure data security and A.I. performance in such a scenario is to implement robust cybersecurity policies. It helps in establishing the importance of transparency, testing and accountability for AI-based algorithms.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

 

Keeping your organization secure

 

As we move forward into 2022, data security becomes more prominent due to increasing IoT-based devices and other devices, such as smartphones. Moreover, cybersecurity threats are also growing, with hackers leveraging different advanced techniques to deceive the existing system security measures.

Your organization needs a reliable cybersecurity strategy to deal with such cyber threats and to limit the risk of data breaches and other cyber incidents. I hope this guide provided some practical, high-level strategies to get you started. However, cybersecurity is an ongoing project and will continue to evolve based on your business-specific requirements.

 

Sources

 

• State of Cybersecurity Report 2021, ISACA
• European Commission adopts new tools for safe exchanges of personal data, European Commission
• Internet of things (IoT) security threats and concerns worldwide, Statista