Wash your hands…wear a face mask…keep your distance…The last year introduced these hygiene Most Valuable Player (MVPs). Similarly, taking several low cost but effective steps can significantly reduce both the likelihood and severity of the most common cybersecurity incidents. Your business should also make use of the cyber hygiene MVPs.

So simple and so common in sectors such as government, finance , retail, and yet – far too rarely used by many companies we work with in the maritime and logistics sector. In fact we often meet with managements who are not aware of this security principle.

So what is MFA? Multi-factor authentication (MFA) requires a combination of something the user knows (password) with something they have (such as a physical key or a one- time code delivered to their phone). Two-factor authentication (2FA) is offered at no cost and is the most common type of MFA.

If your employees enter ‎business systems using just a password, you’re asking for trouble.‎ Account hijacking remains the most common way to breach a business. Threat actors could steal credentials, login, and simply impersonate the CFO and CEO ‎to order money transfers. Or they could abuse an administrator account to gain full, ongoing control of your network. MFA protects your business from unauthorized access. Microsoft claims that applying MFA blocks 99% of account hacks, and Google claims it blocks 66% of targeted cyberattacks.

Advanced attackers may succeed in intercepting SMS authentication codes. For even more hardened MFA, hardware tokens or FIDO2 security keys offer stronger authentication, and NIST Digital Identity Guidelines recommends using these methods instead of SMS.

Enforce multi-factor authentication (MFA), certainly for key users and IT system administrators to curtail the risk of unauthorized access.

Cost: Very Low. Impact: Very High

A software update is an improved or safer version of a program (like Microsoft Office), a device (think printers and security cameras), or an operating system (like Apple iOS) your business has installed on its computers or mobile devices.

Multitudes of software vulnerabilities or “bugs” are discovered every year, each igniting a cat-and-mouse race. The bad guys, such as ransomware groups, rush to perform cyber-attacks to breach and infect as many targets as possible before the vulnerability is fixed. Vendors develop, test and release software updates or “patches” free of charge. Most updates fix a specific vulnerability in the software. For a patch to work, it has to be deployed and installed on each device. The time between the discovery, the patch release and the actual installation is a window of vulnerability for your business.

The good news are that there is a built-in automatic update function in all modern operating systems and applications. You can even set a convenient time for auto-updates to avoid disruptions.

Turn on automatic updates on every IT device to minimize your window of vulnerability.

Cost: Very Low. Impact: High

A backup is a digital copy of your business’s most important information (e.g., customer details, purchasing orders) and systems (e.g., production software). It is a crucial element of Business Continuity. Restoring systems and data from a backup mitigates malfunctions such as hardware failure. Restoring a recent backup lessens the impact of ransomware that locks your data.

An automatic backup is a ‘set and forget’ system that periodically backs up your data, without human intervention. Typical backup destinations are removable media (e.g., USB hard drive) or networked storage (e.g., Cloud.) Online backup storage is convenient and speedy but also vulnerable to being deleted or overwritten. Off-line storage requires human intervention: inserting a tape into a drive or plugging in a cable. However, current ransomware seeks networked backup locations and encrypts these too. The disconnected backup drive offers increased resilience.

Operating systems have basic built-in backup functionality. Dedicated vendors offer a range of affordable backup solutions. First, move on from basic built-in functionality to a dedicated backup solution. Test restore functionality business-wide at least once a year. Review the findings to fine-tune what to back up, when, where and how often.

Implement (at least) an automatic backup solution.

Cost: Low. Impact: High

Cyber hygiene can be simple. In this blog, we singled out three software MVPs of cyber hygiene: multi-factor authentication, automated patching, and automatic backup. Our next blog will present MVPs in the People and Procedures category.