Cyber hygiene: simple measures to prevent the worst
Let’s be honest: hygiene is not the most exciting word associated with cybersecurity. I personally adopted it after ANSSI published its well-known cyber hygiene guide, and it perfectly reflects the realities I observed while managing incident-response assignments.
Admittedly, nobody particularly wants to hear about hygiene. It evokes cleanliness and good habits that we are supposed to have learned in childhood. Yet, as the COVID period showed, even something as simple as washing one’s hands is not universally adopted. Soap manufacturers could confirm that!
To be clear, good cybersecurity obviously involves more than cyber hygiene. But after hundreds of emergency interventions for both SMEs and large groups, it is clear that basic measures—the ones we all know—are often the most effective way to prevent major incidents.
That is precisely where the frustration lies: watching disasters happen when they could have been prevented. A few years ago, when I led a team dedicated to vulnerability intelligence and CTI, we tried to alert companies to risks we could identify from the Internet without even needing penetration tests.
No MFA, an exposed RDP service, leaked credentials—we all know the dangers. A firewall administration interface directly exposed with unpatched critical vulnerabilities, as is happening right now, or the use of technologies known to be porous: all of these leave doors wide open.
At the time, concepts such as responsible disclosure and bug bounty either did not exist or were poorly understood, and we had to proceed carefully to avoid being perceived as ‘malicious hackers.’ Playing the bearer of bad news was not easy. The standard response was often: ‘I’m not worried; I have good antivirus software.’ Today, we similarly hear: ‘Everything is fine; my SOC is AI-powered.’
But what are these essential measures? If I had to select only three, they would be:
- An effective process for patching critical vulnerabilities. Every year, a handful of vulnerabilities are systematically exploited first by attackers, and they are clearly identified as such. Delaying their remediation is therefore unthinkable.
- Limit the exposure of Internet-facing services to those that are genuinely necessary, and protect the others behind a bastion host. At Scovery, we see far too many services that are unnecessarily accessible or even left unmonitored, ready to be exploited by yet another automated script.
- Implement multi-factor authentication (MFA) for every exposed service. Yes, sophisticated attacks against MFA exist, and no, 100% security does not. But without MFA, the door is wide open to the exploitation of the billions of stolen credentials in circulation.
These observations led us at Scovery to develop our external cyber-rating solution. It continuously measures the hygiene of your security exposed on the Internet, as well as that of your suppliers, and gives you the information needed to improve it quickly before a problem occurs.