Risk prevention

Cybercrime has grown along with computers in companies . Cyberattacks are becoming more numerous and dangerous. Malware, viruses, worms and other Trojans threaten the health and safety of businesses, and prevention must no longer be limited to installing software and a few complex instructions. Companies must consider IT security like all other dangers and put in place a global strategy for employee involvement and training.

Simple measures prevent the risks:

• Staff training : this involves informing employees when new threats appear by providing them with advice through practical examples.

• Securing workstations : this is an important question which encompasses many aspects such as password management.

• Protect communications : this means that the company must tell its employees how to secure communications, for example explaining why your company is blocking certain .exe and .zip files. On the other hand, we must also offer them alternative solutions so that they understand why they should not bypass the anti-malware filters that protect corporate email.

• Use messaging safely : by educating staff about spam and other phishing attacks. To protect yourself against these attacks, security software suites (Antivirus) offer protection mechanisms for instant messaging.

• Surely use social networks : because if certain social networks such as Facebook are not authorized in the workplace, others can prove useful for their activity. It is therefore necessary to inform staff about the dangers of disclosing information via professional networks and about the different levels of confidentiality available for this purpose.

• Secure business trips because on the move they are not protected by the secure network of their company. They must therefore be informed that they must observe the same security rules as at the office.

• Pay attention to the use of WiFi networks because it is very easy to intercept data on unencrypted WiFi networks. This is why employees should never connect to an unencrypted WiFi network, even in an emergency.

Protection of web applications:

• If the web application is the result of an internal development or if the source code of the application is available, it is necessary to audit the PHP, JAVA, .NET, C / C ++ source code to detect possible vulnerabilities in the code and verify that the code follows good security practices.

• The application server on which the web application operates must be audited to verify:

  • For the operating system, if vulnerabilities are not present at the level of the basic components.

  • If encryption used by secure protocols (SSH, HTTPS, LDAPS ...) does not use vulnerable algorithms.

  • If the application server is accessible from the internet, an application firewall will be added to the solution.

  • May all communications be secure.

SecureHenlo has all the analysis tools to strengthen the security of application platforms.