Data privacy is something that businesses continually need to content with. The focus is with how data should be collected, stored, managed, and shared with any third parties, as well as compliance with the applicable privacy laws.
In the U.S., data privacy remains a key business topic and many states are seeking to put in place more of their own consumer privacy laws, as well as potential for new federal laws. This is according to Tilo Weigandt, COO and co-founder of Vaultree, a data-in-use encryption provider.
The expert took some time to answer some pertinent questions relating to data privacy.
Digital Journal: How should businesses prepare your organization for a ransomware or cyber incident?
Tilo Weigandt: Regularly testing the incident response plan and having an incident management team are important steps in preparing your organization for a ransomware or cyber incident. As a business leader, you must also ensure that appropriate security controls are in place and that employees know cybersecurity best practices. Backing up data regularly and having an outside incident management and cyber insurance company can help organizations quickly respond to a cyber incident and recoup its costs. Additionally, it is crucial to develop a cybersecurity incident response plan that outlines the steps that will be taken in the event of a ransomware or cyber incident. But most importantly is to have proper encryption in place so you don’t even have to worry about the negative impacts of an incident.
DJ: How important is it to train your staff/customers on cybersecurity basics?
Weigandt: The first line of defense for organizations to stop some attacks is to simply educate employees about the dangers of clicking on links. Only a fraction, however, will listen and learn. It generally takes people to make a mistake before they learn. That can be too late, however. There is a new movement where security teams send phishing emails containing fake malware to their employees which, when activated, simply lead them to a site telling them about their mistake and educating them about the dangers of what they did. Education is crucial.
DJ: As remote work seems likely to persist in 2023, will cybersecurity attacks related to remote vulnerabilities continue? If so, how can businesses/IT combat these attacks?
Weigandt: Remote work will persist in 2023, and so will the cyberattacks related to remote vulnerabilities. It is essential for companies to continually adapt and evaluate their security strategy to address the ongoing challenges of remote work. IT departments can take several measures: strengthening endpoint security, educating employees on cybersecurity best practices, and keeping systems updated and patched. Additionally, monitoring and inspecting systems using virtual private networks (VPNs) and multi-factor authentication (MFA) can help secure remote connections and access to the company’s networks and systems.”
DJ: How effective is two-factor authentication? Is there anything brewing in the industry about improving/replacing 2FA?
Weigandt: Two-factor authentication (2FA) adds an extra layer of security by requiring two forms of identification, which is more than welcome. However, alternatives to 2FA, such as behavioural biometrics, security keys and FIDO2, are being developed and are considered more secure. Still, organisations must carefully understand their needs and requirements before replacing 2FA.
