What Businesses Can Learn From the OPM Security Breach

The security breach that hit the U.S. Office of Personnel Management (OPM) has many people demanding answers as to how something so egregious could happen at such an important office. Some reports indicate that as many as 35 million federal employees’ records were exposed in the cyber attack, with some of the data coming from as far back as 35 years ago. Early indications show there were plenty of reasons for the attack happening, from a general lack of professionalism from those involved to limited knowledge about cyber security. Investigations have uncovered that even basic security features were sorely lacking. While many improvements have to be adopted at the OPM, businesses will easily find a number of important lessons to learn from all the mistakes that were made.

Don’t Ignore Basic Security Features

OPM officials were quick to respond to the breach by adding features such as anti-malware programs. Businesses shouldn’t ignore the basics, even if they seem limited in today’s age of cyber threats. Every company should employ anti-malware programs, firewalls, and restricted remote access. Organizations without these features are only leaving themselves vulnerable to breaches in the future.

Identify the Real Threats

Numerous businesses tend to focus on the worst-case scenarios when it comes to cyber security. They focus on the possibility of breaches from super hackers or shadowy underground organizations. Indeed, much of the federal government thinks a possible cyber apocalypse is what should be prevented instead of focusing on the real everyday problems that can be identified and actually measured. Businesses need to stop chasing myths and deal with real world threats. They also need to understand those threats may be internal, which only emphasizes the need for more restricted access and improved BYOD security.

Bring Equipment Up to Date

One of the biggest problems many businesses face is their aging infrastructure. Legacy systems can leave a company vulnerable simply because they are unable to handle the latest security threats. Wherever possible, organizations need to update their infrastructure, improving the capability to combat outside attackers and reducing the likelihood of a security breach. Much of the focus should be placed on making sure the company’s network is updated, especially if a full infrastructure retooling job is out of the question. By adopting network segmentation and multi-factor authentication for data access, companies can receive alerts when data is being misused.

Continuously Monitor Network

An updated network can impede many attacks, but to really meet the new security demands of the modern age, a business needs to monitor the network continuously with the right people. This allows security teams to respond to possible attacks in real time, which could be the difference between stopping a minor annoyance and dealing with a major problem.

Hold People Accountable

If mistakes happen, businesses need to be prepared to hold those responsible accountable for their actions (or lack of actions). Part of this requires making sure employees are aware of the cyber threats that are out there through regular training sessions. Companies that regularly use contractors need to vet those businesses and provide needed oversight to ensure the work is being done properly and no shortcuts are taken regarding security issues. The lessons from the OPM security breach may be simple, but they are incredibly valuable, especially as the number of security threats seems to multiply every single day. A single breach is enough to severely damage a company, not only financially but reputationally as well. By taking these necessary steps, businesses will place themselves in a better position to protect their most sensitive and vital information. These lessons also feed into being more prepared for the future as well. As long as organizations are learning from others’ mistakes, they can be sure they won’t repeat them.  

Image

About the Author: Rick Delgado is a freelancer tech writer and commentator. He enjoys writing about new technologies and trends, and how they can help us. Rick occasionally writes for several tech companies and industry publications. Editor’s Note: The opinions expressed in this and other guest author articles are solely those of the contributor, and do not necessarily reflect those of Tripwire, Inc. _{Title image courtesy of ShutterStock}