Guarding Your Virtual Storage Against Cyberattacks

All too often these days we see headlines about customer information being compromised due to a company’s database being hacked. We don’t always see the ways that organizations successfully keep data safe. To gain insight into these methods, we sat down with Jeff Groman, Course Author at EmergingEd and founder of Groman Consulting Group, to discuss measures companies can take to safeguard their servers and storage from malicious cyberattacks. 

1. In your opinion, what are the best practices a company should be following to protect storage resources against a cyberattack?

 Jeff Groman, Course Author at EmergingEd and founder of Groman Consulting Group: Let’s start with a definition. Storage resources commonly include traditional databases and cloud storage services. Depending on how these storage resources are set up, defenses and protections may be a bit different. There are basically two sets of controls you want to have in place in order to protect your data storage: network controls to prevent unwanted visitors and identity access management to ensure authorized users have the correct roles and permission.

Network controls like firewalls prevent “drive-by” attacks on your storage resources. Strong identity access management requires that users have minimal permissions and privileged access requires multi-factor authentication through a one-time passcode.

2. What makes these controls so effective? 

JG: This approach aligns well with the attacks we’re currently seeing. Exposed databases are a common target for cyber threat actors because database platforms aren’t designed to be internet-facing, and tend to be vulnerable to attack. So by restricting network access to these platforms, this type of attack can be mitigated altogether. The other attack vector that commonly allows threat actors to compromise a database is by obtaining user credentials. However, if user accounts have minimal permissions and require multi-factor authentication for access, would-be attackers have a much more difficult time compromising a database.

 3. In your opinion, is there anything that’s commonly misunderstood about safeguarding data?

JG: It’s always best to understand what data is being stored, and the classification it falls under. Too often, organizations don’t realize that sensitive data resides in storage that isn’t being protected all that well.

4. What's the largest error a company can make when securing their storage resources?

JG: Failing to apply the security controls consistently in a manner that is prescribed by their own policies. Technology is deployed quickly and in so many areas that IT has a hard time keeping up and ensuring that implementations comply with security policies.

5. Do you have any closing thoughts you’d like to share??

JG: Security isn’t just the job of the security team. The business and IT need to partner with security and ensure the proper controls are being applied to applications and data.