THREATS COMPANIES SHOULD PAY ATTENTION TO

We are constantly analyzing and studying how cybercriminals spread their threats, not only throughout the region but also worldwide. Every day we receive various types of malicious code for the most diverse purposes, some aimed at home users, but also others with a very latent focus on the corporate world.

From a corporate point of view, security is constructed as a process that requires management and support from other key areas of the organization. The challenge is constant and security teams must cover different fronts by which malicious code could enter the organization's network, betting on the use of proactive detection, management and education technology as part of their defense plan.

Considering that resources are finite in organizations, and IT personnel are often in charge (among other tasks) of information security, it is important to develop a clear and concise incident response plan. At the same time, it will help to identify the most common points of infection in order to be aware of what is happening.

Next we will present the most common types of threats in companies, their impact and some resonant cases of the last time.

1 Emails That Carry Threats

Email has almost a central role in today's companies, since it forms a backbone of communication with customers, suppliers, services; In addition, it makes it easy to share information internally. Company email accounts are usually one of the main channels for receiving malicious code and we have commented on propagation campaigns for different types of threats that used this means of communication.

As one of emails-threats the most recent cases, we have the example of Win32 / Bayrob, which spread in different waves posing as an Amazon coupon. In less than a month it was positioned in the first places regarding detections in countries such as Argentina, Chile, Colombia and Mexico, among others.

In addition, malware through attachments caused major problems in campaigns such as CTB-Locker just over a year ago, where waves were observed in different languages spreading a Trojan detected. The latter then installs the ransomware to encrypt its victims' files and demand a ransom payment.

To protect companies' email accounts, it is necessary to have a total security solution at the endpoint that detects malicious attachments, but also to protect the mail server, and filter these elements before they reach the tray input. A recommendation for security teams is to use their management tools to generate reports on what threats employees receive through emails, and thus adjust their incident response programs if a problem occurs.

2 Removable devices that make files disappear

The use of USB sticks and other types of removable devices are also a very common vector for the spread of malicious code. Particularly in Latin America, we have seen a large number of families using this technique, which over the years has generated more than one headache.

The main modality in this type of infection is the abuse of shortcuts (LNK), where when connecting the USB device to an infected machine, all files and folders disappear and are replaced by shortcuts. If the same USB is inserted in a new machine, when the user double-clicks on them the system is infected and then the folders are opened so that he does not realize it.

It is important for an organization to define the policies for the use of removable storage devices, in the first place because they could also open the doors to the theft of information. Depending on the business or the organization's decisions, using a total security software that allows you to selectively block its use is highly recommended.

3 Exploits

The exploitation of software vulnerabilities is another of the vectors for the spread of malicious code, mainly through office applications, browsers and websites. The challenge with app or browser failure is that if the vulnerable app hasn't been updated, or even a patch isn't available yet, a business could be exposed.

We see that Internet Explorer was one of the applications with the greatest incidents. The risk of an exploit is mainly associated with the installation of malicious code, remote code execution or, in simpler words, allowing an attacker to remotely control a system.

Also, exploits don't just affect the endpoint; web servers or other devices directly connected to the internet could be the target of these types of failures. To combat these types of threats, in the first place, you need proactive Internet security solutions with functionalities. These help prevent the execution of exploits, even protecting users from the well-known-day. As for other services, such as web servers, databases and different devices where a security solution is not usually installed, the periodic execution of pentesting services helps to prevent any type of incident.

4 Ransomware

The ransomware is one of the threats that most headaches caused large, medium and small businesses throughout the world. An infection with this type of malicious code can expose many vulnerabilities in an organization. From the configuration of total security software to the information protection policies, they are usually a point of review after suffering an attack of this style, where business continuity can be threatened depending on what information was hijacked.

A company looking to implement a proactive security policy will try to avoid any type of infection, but in the event that it does happen, damage remediation tools are vital. In the event of a ransomware infection in an organization, the time that elapses until the information can be obtained from a backup copy is key to put the business back into operation, minimizing the impact.

5 Unprotected mobile devices

Another factor that has become a concern of companies is mobile devices. There are 8 out of 10 companies have problem in mobile devices. If we take into account that these devices are usually connected in many cases to the same network as the company's computers and are not protected, they can be another attack vector that opens the doors to cases of information leakage.

Protecting the company's fleet of mobile devices not only prevents the infection of malicious code from them, but also helps to protect what happens on the internal network when they are connected. At this point, the management of a fleet of mobile devices can be done from the same endpoint management console.

A company must also have an effective policy for mobile devices and thus have clear rules on the use of smartphones and other devices.

What To Do About It?

The challenge for security teams in companies is to protect the business make sure that no equipment in its network is infected and if that happens to respond in the shortest possible time to minimize the impact. It is a difficult challenge, but not impossible if you make the decision to tackle it proactively.

To do this, knowing which are the threats that most threaten an organization is a good starting point. It may take time, but knowing what detections security solutions have on a day-to-day basis will help put together a plan that goes along with the company's security policies. These, together, will help keep the business and especially its information safe.