“When you hear “best practices,” run for your lives. The Titanic was built with best practices. lt was faithfully operated in accordance with best practices.”

— Retired US Army Colonel Gregory Fontenot, Director of the University of Foreign Military and Cultural Studies (Red Team University), 2011

involves a combination of strategic and tactical measures designed to secure a network against cyber threats. These measures can be divided into four main categories

• Prevention
• Detection
• Response
• Recovery

Cybersecurity is a growing concern for students and organizations alike. As technology advances, so do the threats posed by cyber criminals. To protect their data and systems from malicious attacks, organizations must adopt proactive and reactive strategies to defend against these threats. 

The art of the ultimate cyber-defense involves a combination of strategic and tactical measures designed to secure a network against cyber threats. These measures include prevention, detection, and response and should be implemented holistically and coordinated to provide excellent protection against cyber threats.

Oversights in cybersecurity

Companies make several joint cybersecurity and information security mistakes that could be futile to the business

1. Failing to properly secure devices and networks 
   1. This includes not properly configuring security settings, not keeping software and security protocols up to date, and not correctly securing devices when they are no longer in use.
2. Failing to professionally train employees
   1. Employees should be trained to recognize and prevent potential security threats, such as phishing attacks, malware, and other forms of cybercrime.
3. Using weak passwords and password reuse
   1. Weak passwords can be easily guessed or cracked, making them a prime target for attackers. Companies should encourage strong, unique passwords and consider implementing a password manager to help employees create and manage secure passwords.
4. Neglecting to implement multi-factor authentication and Biometric security
   1. Multi-factor authentication (MFA) adds an extra layer of security by requiring users to provide additional proof of identity before accessing certain systems or data.
5. Failing to regularly backup data
   1. Regular data backups are critical in a security breach or data loss. Companies should have a robust backup and recovery plan to quickly and easily recover from data loss.
6. Neglecting to monitor and detect cyber threats (Cyber threat Intelligence)
   1. Companies should have systems to monitor for potential security threats and quickly detect and respond to any breaches.
7. Not having a clear incident response plan
   1. In the event of a security breach, companies need to have a clear and well-defined plan for responding to the incident and mitigating any potential damage.

Best practice

To quickly give an overview of what we can improve, here is a list of 39 security controls we could use to improve the security of our organization. It is important these are guidelines and should be implemented to the security requirements of your organization

1. Implement a strong security posture and establish clear policies and procedures
2. Do not store passwords encrypted on a file share and use strong cryptographic algorithms
3. Deploy intrusion detection systems (IDS) to monitor for unusual activity on the network.
4. Use network monitoring tools and security logs to identify potential threats,
5. Use security information and event management (SIEM) tools to centralize and analyze security logs
6. Install and regularly update EDR software to protect against malware
7. Educate and train employees on cybersecurity best practices, including password management, safe browsing habits, and being aware of social engineering
8. Implement a robust patch management program to address known vulnerabilities in software and system components
9. Segment the network into smaller, isolated segments to limit the spread of an attack
10. Have an incident response plan to quickly and effectively respond to threats
11. Implement backup and recovery systems to restore critical data and systems during an attack
12. Identify critical assets and systems and implement measures to ensure their protection
13. Enable multi-factor authentication for access to sensitive systems and data resistant to MFA fatigue.
14. Regularly review and update security policies and procedures
15. Conduct regular security audits to identify and address vulnerabilities
16. Limit access to sensitive data to only those who need it and apply the least privilege
17. Use the Tiering account system and never use admin accounts for daily use.
18. Use a privilege access management solution or PAM
19. Monitor and control external devices, such as USB drives, on the network
20. Regularly test and update disaster recovery plans
21. Implement software update policies to ensure that all systems are running the latest version
22. Use a web application firewall to protect against web-based attacks
23. Use a content delivery network to protect against distributed denial of service attacks
24. Monitor and control social media and other online platforms within the organization
25. Make use of Cyber Threat intelligence and open-source intelligence to see if you are targeted by known hackers and what common threats you are facing and how to mitigate possible attack vectors that are used by different threat groups (APTs)
26. Implement a mobile device management solution to secure and manage mobile devices
27. Implement continuous access controls and authentication measures to protect against unauthorized access
28. Use data loss prevention (DLP) tools to detect and prevent the unauthorized exfiltration of sensitive data
29. Deny Outgoing traffic by default unless it meets the organization is continuously checked compliance regulations of the organization
30. Disable any kind of PowerShell execution on machines without it being required
31. Put Powershell into a restricted mode and make sure it cannot be called
32. Disable services that unquoted service paths which are unsafe
33. Set Powershell across the domain to “”=$ExecutionContext.SessionState.LanguageMode = “ConstrainedLanguage”” to prevent Powershell tools from abusing certain functions
34. Implement SDP authentication and filtering and monitor its traffic flow from encrypted endpoints.
35. Set access control entries for all executable binary files to read-only. This helps to protect their integrity. Examples of Windows-based executables, libraries, and other specialized binaries that should be
36. Set to read-only include those with the following extensions: com, exe, scr, dll, tlb, ocx, drv, sys, vxd, cpl, hlp, and msc.
37. Prevent execution from removable media. Prevent applications from automatically running from removable media.
38. Use host-based firewalls. Set the policy to explicitly identify which programs are allowed to connect to the network. Ensure that the associated policy file or registry entries are set to read-only using DAC. Conduct software integrity inventories. Use tools such as Tripwire (open source for Linux based systems, or Enterprise for Windows based systems),Cimtrak or splunk to identify unauthorized change in programs, and validate the integrity of those that are authorized. Monitor executions. 
39. Consider implementing specialized tools that can keep an audit of software running on a machine. This can be used to identify users violating policy or malware not detected by antivirus monitoring.