Category: Atlantic IT

New York State Provides Great Example of How to Improve Organizational Cybersecurity

Key Points

• The state of New York has introduced multiple pieces of legislation to help bolster private-sector cybersecurity.
• It is recommended that all businesses consistently monitor for threats, educate their workforce on them, enforce strict policies regarding data transfer, bring your own device (BYOD), VPN usage, and other hallmarks of good cybersecurity.
• Good cyber hygiene requires energy, effort, and buy-in from all members of your organization – but it’s worth it, as the impact of faulty cybersecurity practices can be catastrophic.

As the need for a secure cybersecurity posture continues to grow in importance for businesses everywhere, the state of New York has become a national leader in cybersecurity. That’s a good thing for New York businesses, as it can inspire confidence in them to operate successfully and securely. It also means those same businesses must comply with existing state regulations while maintaining a high standard for cyber hygiene within their organization. This enhances your organization’s security but isn’t necessarily easy to implement. With a little forethought and guidance, however, businesses can better understand what’s needed to make secure and informed decisions about their organization’s cybersecurity.

In this post, we’ll take a closer look at the groundwork New York state has laid regarding cybersecurity and what your New York business should focus on to ensure compliance and optimize data security.

New York Has Taken Multiple Measures to Show How Seriously It Takes Cybersecurity

The state holds one of the biggest cities in the world – one of the most influential municipalities for businesses. Because of this, it should be no surprise that the Empire State takes cybersecurity seriously. Its legislators have come up with multiple efforts to improve cybersecurity at the organizational level.

Several years ago, the New York State Department of Financial Services approved a first-in-the-nation cybersecurity regulation for banks, insurance companies, and other financial services institutions. The Department’s regulation requires organizations to adopt security policies and procedures to protect their information systems and nonpublic information.

Other cyber policy measures enacted statewide reach beyond the financial services sector. In 2018, the New York State Office of Information Technology Services unveiled its New York State Cyber Security Strategy & Policy Framework, which guides the implementation of cybersecurity best practices throughout all agencies within the Executive Branch of New York State.

The measure calls for agencies to do the following:

• Develop risk assessment frameworks
• Identify and assess the risks to their organization’s information systems
• Implement controls designed to ensure adherence to organizational policies and procedures
• Train employees on cybersecurity best practices
• Implement BYOD policies
• Use VPNs when connecting remotely
• Integrate multifactor authentication for sensitive applications and systems
• Educate staff members on phishing scams and other social engineering techniques
• Create incident response plans to limit damage in case of a breach

To comply with this regulation, agencies should develop a written cybersecurity policy that includes the following:

• Purpose and scope statements
• Roles and responsibilities
• Management commitment
• Awareness training requirements (e.g., policies/procedures, roles/responsibilities)

There’s a good reason the state of New York believes in these recommendations – they don’t eliminate cybersecurity risks, but they can help you mitigate them. Of course, enacting these measures is easier said than done. Many teams struggle with cybersecurity even though everyone should view it as an organizational imperative. While this was aimed at the Executive Branch, it’s good advice for private sector organizations.

What Can Your New York Business Do to Practice Good Cyber Hygiene?

The first step New York state recommends is for you to develop your cybersecurity plan. Implementing a comprehensive cybersecurity plan is one of the most innovative things an organization can do to secure itself from malicious actors. Cybersecurity demands that your organization take it seriously, from senior leadership to employees in all departments and roles. A comprehensive plan for which all members of your staff are accountable builds a solid data security foundation.

Cybersecurity also requires vigilance. It requires an ongoing commitment by organizations to keep up with the rapidly changing technology landscape through continuous training, software updates, hardware upgrades, and more. Ensuring your IT department is responsible for implementing these – but that all members of your organization share in that responsibility to ensure the updates are happening – is paramount.

To successfully maintain proper cybersecurity, you need to clearly understand the threats that exist today and may arise in the future. You also need to understand what data is valuable for your organization, who can access it, where it is stored, and how often does it change?

Another essential component of a comprehensive cybersecurity plan is conducting regular assessments. This enables you to identify vulnerabilities in your systems and implement solutions before hackers exploit them. It also helps reduce the risk of data breaches, which can be costly for an organization financially and reputationally.

Cybersecurity is not a one-time undertaking but rather something that needs constant attention and updating as you discover new threats or witness existing ones as they evolve. Don’t view your cybersecurity plan or efforts as a “set it and forget it” feature of your business. Your cybersecurity plan should be a living document that adapts as needed.

Organizational Flexibility and Awareness are the Hallmarks of a Solid Cyber Posture

The truth is that the protective steps suggested by the state of New York are valid in any state. Cybersecurity should be one of your top concerns for a New York business or a business residing anywhere in the world.

The risks associated with cyber threats continue to grow as the technology landscape evolves rapidly, making it increasingly important for organizations to ensure they are implementing effective measures to protect their business operations and confidentially. Organizations need to continuously train employees on best practices related to cybersecurity while investing in software updates, hardware upgrades, firewalls, and other protective measures and hiring staff experienced with protecting against various types of threats (e.g., phishing).

The world is changing, and so are the threats that organizations face. The cybersecurity space is constantly evolving, so your organization needs to be vigilant about keeping up with the latest trends and developments. Keep cybersecurity at the top of mind for everyone throughout the organization to limit vulnerabilities and keep your systems more secure. Contact us today for more on how we can help you do this.

How Granting Local Admin Privileges Could Cost You Your Business

Key Points in This Article

• Historically, many overburdened IT departments have sought to save time and work by granting multiple users across their business or organization local administrative privileges.
• Doing so substantially increases the risk that their network security may be compromised.
• The costs of a data breach are far higher than the productivity savings that may be achieved by granting such privileges.

These days, organizational cybersecurity should be top-of-mind for any cybersecurity professional. Whether cybersecurity is in your title or you’re a generalist handling everything from network maintenance to changing printer ink cartridges, it’s always critical that you keep an eye out for how our organization’s operations may inadvertently be creating vulnerabilities third parties can exploit.

When cybersecurity professionals conduct risk assessments, they often find vulnerabilities stemming from organizational practices that are pretty common across industries. One such practice is granting local administrative rights to individual users, most often in small businesses, organizations, and those with understaffed IT departments.

The Dangers of Granting Local Admin Privileges

If you’ve worked for an understaffed IT department, you’ve likely spent much of your day handling mundane helpdesk requests. None of them take that much time, but there are a lot of them, and they don’t stop. You cannot devote adequate – sometimes any – time to the IT aspects of the organization’s revenue-diving activities or essential network maintenance and security because there are so many requests.

In this scenario, perhaps you, like many IT administrators, realized many of these requests could be handled by individual users simply by giving them administrative privileges. You may have saved some time on routine tasks, like adding applications, users, and hardware. And you may have found yourself breathing a sigh of relief given that you’ve now reduced the number of requests across your desk.

But doing so is a mistake. When you provide local admin rights to users across your organization, you’ve inadvertently made it more vulnerable to intrusion. And the extra work you’ll perform to address a data breach compared to the few minutes you may save installing a printer here, or there is certainly not worth it.

Users frequently try to install software programs they find online. When they do and lack local admin privileges, they’re prompted to ask permission to download the software in question. This prompt allows IT administrators to vet the software and ensure it does not present a threat. But when users have local admin privileges, they have the freedom to download applications as they see fit. And they may even disable network security measures that vet new applications for the presence of malware and viruses to expedite installation.

In doing so, they’ve exposed your organization’s network to risk. Malware and viruses lurk in seemingly harmless downloads found on official-looking websites. Not only can they compromise your user’s account and device. If downloaded on an account with local admin privileges, they can compromise your entire network’s security. Malware on such an account could disable your organization’s antivirus protections, turn off your firewall, and hijack your data on multiple devices.

Local admin privileges allow users to override the Group Policy you’ve established. If a hacker gains control of an account with these privileges, they could prevent your Group Policy from being accessed or create their own. In either case, your security protocols would be compromised, giving a criminal the ability to access and steal your data, encrypt your system and hold it for ransom, and conduct other activities that could be financially catastrophic for your company.

Many cybercriminals specifically seek administrative credentials to penetrate corporate networks. Fundamentally, the smaller the number of accounts with administrative credentials, the less risk one of these accounts will be compromised. In practice, users who have been granted these credentials outside of the IT department, by and large, have had minimal, if any, cybersecurity awareness training or have not followed best practices to safeguard their accounts. Accordingly, cybercriminals have found their way into these accounts easily and have been able to cause considerable damage.

Why Local Admin Privileges Must Be Restricted

Even if your IT department remains small and understaffed, granting users across your organization local admin privileges is no longer justifiable. Any time you save will be more than offset by the damage that can be caused in the event of a breach.

As an IT professional, you will face countless hours over the following days, weeks, and months scrambling to address the threat, regain control of compromised systems, and ensure your employer can remain operational. Your business might face reputational damage and legal consequences if client data is compromised. And depending on your industry, you may face regulatory action if the breach occurred because you failed to meet legally mandated cybersecurity standards.

The cumulative financial consequences of a breach can be catastrophic. Some research asserts that as many as 75 percent of small and medium-sized businesses go under after a ransomware attack. And no industry or sector of the economy is safe. In May 2022, Lincoln University permanently closed its doors after a devastating ransomware attack.

Even if you don’t suffer a breach in the near term, granting users local admin privileges can create more work and headaches for IT. You may find that departments are now downloading and using software applications you’re not equipped to support. Or you may find that in attempting to manage relatively simple tasks themselves, they’ve inadvertently created more complicated problems for themselves – and other users. You may not be saving yourself nearly as much time as you think.

It’s also not uncommon for senior leaders to believe that they should be granted local admin privileges by virtue of their position. And when they have them, they may accidentally cause problems for themselves or other users that you must address. Or you may find them using their privileges to undermine organizational cybersecurity measures out of a misguided attempt to increase productivity or out of hubris.

The cybersecurity of your organization must supersede all of these considerations. To preserve it, you must tightly restrict administrative privileges across your organization and actively monitor the accounts that possess them. Moreover, you must educate all users about cybersecurity continuously and thoroughly. Doing so will help you keep your organization safe and help them understand their loss of these privileges is not about a lack of trust. In fact, when your co-workers make the connection between the proliferation of accounts with local admin privileges, data breaches, and their own jobs, they’re likely to accept the removal of these privileges without protest.