My name is Quentyn Taylor, Director of Information Security at Canon. We have a
long tradition in imaging but security is my responsibility. Security is not
just about product. It's in everything we do. We'll be releasing regular videos with
hints and tips to help keep you safe. Please don't forget to Like and subscribe.
So how do you cut through the noise?
to get what's important to you? With so many information security issues
occurring in the world today, there's always a new bug, an imminent attack, or a
new vulnerability that you need to be aware of. You need to focus on the basics.
It's too easy to get lost in a race to defend yourself against all possible
threats, whilst the actual day to day issues are occurring right under your nose.
If you look at some of the more complicated attacks and break them down,
what do you find? You find a very basic control failure. Take for example the
Notpetya malware attack. It claimed many victims from shipping companies to
law firms, paralysing their IT infrastructure. Whilst the impact of the
virus was considerable, the root cause and the defense was far simpler.
Patching, and shared admin accounts.
Accept failure. When you get a flu jab you vaccinate to protect yourself
against the virus but there's still a chance you could come down with it even
with that proactive treatment. In the same way it's easy to apply an IT patch,
but when you start to work at scale there will be a tiny percentage of
failures or devices missed. It's simply not always possible to accurately cover
100% of your network and in my line of work it's an accepted risk.
The basic takeaway for you here is that you need to plan for it. Accept that it's
likely to happen and have other measures in place to deal with anything that gets
through the net.
You have a front door in your house for a reas on: to keep
strangers on the other side. Its the same with networks and systems, not everyone
needs access to everything. Whilst it can be hard to set up permissions correctly,
it's worth spending the time on getting it right. So unlike the Titanic, your
whole ship won't sink if you have an intrusion.
Do you know if your upstairs window is ajar?
Do you know if your car is open? Do you know if the car on your drive is
even yours? In the real world it's very easy to check these things. In cyberspace
it's much harder. Your attackers know if your upstairs window is ajar.
They know where your weaknesses are, and it's absolutely critical that you have
full visibility of all of the areas that you're responsible for.
People or tech? It's too easy to spend your limited budget on equipment - and let's be honest
big shiny things! Whilst building a team may not seem as efficient as putting in
servers to apparently fix issues, building a team of the right people will
benefit you far more than any hardware or software.
Protect your email. Your email is the gateway to your customers. It's connected
to everyone on the Internet. be they good or bad. Email security failures start
unpleasant, and they get worse. An email leak or access to one of your accounts
will lead to an attack of being able to read your darkest secrets, as well as
impersonate you. At a minimum make sure that you have multi-factor
authentication in place. And lastly, accept that no matter what you do, you
will never stop 100% of attackers or attacks and no one's
expecting you to be perfect, but they're expecting you to have a plan. If you work
with technology, these videos are for you. In these sessions we'll be taking a
no-nonsense look at key industry topics to help you navigate the increasingly
complex world of information security. I'm Quentyn Taylor and I'll be your
guide in this series: Security Insights.
[Music]