Bob Hanley is the Senior Executive Director of Operations at Sabre On Point for Cyber Security Safety and Engineering, where he develops and implements in-depth cyber defense capabilities for civilian, commercial, federal, and Department of Defense applications. In his nearly four decades with the Navy, he helped establish and improve their cyber security systems, including co-writing their current SecNav policy on Cyber Security Safety. Today, he shares key insights on keeping businesses cyber safe.

At Sabre On Point, we pride ourselves on our ability to provide each client, regardless of their size or complexity, the same level of cyber protection that secures our government’s most critical infrastructure. In my experience, this starts with five main principles that businesses can immediately implement to reduce their cyber security risk.

1. Be proactive versus reactive.

Cyber threats are becoming much more sophisticated and adaptive when attacking information technologies and networks. Reactive defenses typically only protect against known threats; proactive defenses are required to counter these intelligent threats before they happen. These defenses, such as machine learning computer immunization systems, can adjust to changing attack profiles and automatically patch themselves against anticipated future attacks.

2. Ensure functionality when a breach occurs.

Breaches are inevitable. Unfortunately, many organizations assume their cyber defense will protect them from a breach, and in turn they have no contingency plan for when a breach occurs. Businesses can lose critical information, intellectual property, financial resources, or even their ability to function post -intrusion. Providing ‘defense-in-depth” is critical to ensuring that the damaging effects of a breach are minimized or eliminated and that businesses can keep functioning even while the breach is remediated. Understanding how an IT/network is connected to a business’s people, processes and external connections also plays an important role in ensuring that the appropriate defenses are in place when the inevitable breach occurs.

3. Go beyond boundary protection.

When coupled with anti-virus solutions, boundary protections such as firewalls and intrusion detection and prevention systems (IDS/IPS) are the critical first line of defense for all IT/networks. However, hackers today are very sophisticated and have an infinite amount time to break through those boundary protections. Think of a house. If your house is empty for a week while you are on vacation, a burglar has plenty of time to figure out how to disable any alarm system you may have. They can break in through a window or door, steal whatever they want… and if they get it, no boundary alarm system will catch them. You need a layered defense system to protect what is most valuable to you. A business is the same. Boundary protections will be breached given enough time.

4. Always assume your business will be breached.

Look at your business from a holistic perspective, especially access. What other organizations have access to your business that might be attractive for a hacker to get to through? Think about the stories of banks that got robbed because thieves tunneled in from a building next door. Your company could be used the same way in the cyber world. Everyone could be a target, and everyone could be used to “pivot” to get to another target. Either way, in the cyber world, everyone should assume that they could be a victim. Many cyber attackers are looking for “unlocked” access doors anywhere and everywhere, so lock all of your doors!

5. Identify all access points vulnerable to a cyber attack.

First, you must know every way your IT/network could be accessed. Most people grossly underestimate the number of access points into their business from the cyber world. Back to our house analogy, homeowners often overlook small windows, doors, attic vents, or even the garage door! Before you can put in boundary and layered defenses, first know where a hacker can get in, and what data can be exploited by that access. Hackers conduct reconnaissance on targets before they even plan an attack. They will try to understand your potential vulnerabilities, like an opponent before a baseball game. A “cyber attack surface evaluation” is a way to define your access point vulnerabilities, whether that is your people, policies, processes, or your IT/network itself. Once you know the ways in, you can begin to build your defense-in-depth protections and ensure you can not only survive a breach, but continue functioning after a breach.

As technology evolves, cyber attacks and breaches are becoming the norm rather than the exception. Sabre On Point is working ahead of the curve to ensure others are ready for those threats when they happen, not if they happen.

The advanced levels of protection Bob and his team bring from the military to the commercial world are part of Sabre Safe, the new Premier Cyber Security Protection offered by Sabre On Point.

Interested in learning how military-grade cyber security protocols can work for your business? Contact Sabre On Point today for an assessment.