Take the fight to the cybercriminalsAn IT leader’s guide to keeping your business running with proactive cybersecurity

The IT leader’s biggest risks

It’s an incredibly risky time to be an IT leader.

On the one hand, it is vital that your business changes the way it works and innovates. No enterprise can afford the risk of being out-maneuvered by faster-moving competitors. So initiatives around digital transformation and workforce mobility are critical priorities.

At the same time, those very initiatives will bring with them a host of new threats, vulnerabilities and issues. And no enterprise can afford the costs, disrupted operations, and financial and reputational damage that unfortunately accompany data breaches.

The challenge for IT leaders is to keep the business running — both by embracing the promise of new technologies while tackling the potential of new threats.

The thing is, you can’t be proactive about digital transformation if you aren’t equally proactive about cybersecurity.

The range, sophistication and incidence of new threats is evolving too fast for anything less than a deliberate, proactive approach.

DDoS attacks are rising 40% year-over-year, with 25% of businesses facing a repeat attack within 24 hours.1 Email phishing operations are becoming more confident and complex, with cyber-thugs targeting business executive accounts for a more lucrative payout.2

And yesterday’s novel attacks are becoming tomorrow’s most common attacks far too rapidly.

The bottom line is that innovative, transformative companies must take a proactive stand in their security strategy by moving first to shift the balance of power away from cybercriminals.

In this guide, we’ll explore what it takes to proactively protect a modern company’s data and assets from harm, while patrolling the ‘cyber-grounds’ to root out any threats that have already snuck inside. And above all, keep the business running…

1. www.corero.com/resources/reports/h1-ddos-trends-report2. www.siliconrepublic.com/enterprise/cybersecurity-trends-iot

2Sprint Business Take the fight to the cybercriminals 2

01 The foundations for proactive cybersecurity

01The foundations for proactive cybersecurity

The foundation of any security initiative will always be the endpoints and data it aims to protect.

So even if you’re worried about the most sophisticated new threats, ground zero should always be maintaining the security of your apps, data, endpoints, network and users.

Here, being proactive is about prioritizing the systems, processes and education that matter most. It’s about automating the basics so you can focus on the critical.

#1 Secure your apps and data

Look for the threats and issues you aren’t dealing with because your team is stretched too thin. Then look for ways to automate your remediation workflows or control them remotely. Some low-hanging fruit to think about:

• Are you verifying who accesses your systems, apps and data? If not, identify which of your user authentication policies and controls need to work in smarter ways.

• Are your people allowed to access suspect web sites and download risky content? If they are, you need to block dangerous sites and downloads. Or you need to limit certain users and how they access to the network.

• How do you prevent message interception? Too many organizations go far too long without even basic tools like strong encryption.

Sprint Business Take the fight to the cybercriminals 4

01#2 Secure your endpoints

Companies have a lot of devices to manage, from printers and laptops, to smartphones and tablets. Every endpoint represents a potential gateway for hackers to gain unauthorized access. Companies must maintain constant vigilance and account for every endpoint to make sure that they are secure and protected.

A proactive approach is key. For example, the reactive response to an employee leaving a device on a flight is changing their privileges or preventing their device from accessing the network. This, however, is counterproductive as employees need their devices to effectively do their jobs.

A proactive approach is to design a holistic security program, one that makes sure every device is

protected. For mobile devices like smartphones, a mobile device management program allows IT to monitor and manage those devices in a unified and centralized manner. One that gives you the control to secure every device remotely, while still freeing your people to carry on working the way they need to.

Again, the sensible thing to do is to make sure this doesn’t become a cumbersome, manual process that your team can’t handle. And empower them enough so that:

• If a device is unintentionally left unattended Secure access policies can prevent unauthorized usage.

• If a device is lost or stolen You can locate, lock and wipe the device remotely.

#3 Secure your connections

Your people’s productivity depends on having access to your business’s systems and apps — even when they’re on the move. Instead of trying to fight this trend and prevent users from doing what makes them valuable to the business, a more proactive approach would be to make it easier for them to work remotely, in a secure way.

Some key security technologies will help you deal with this more proactively. First, is of course mobile device management and the ability to remotely control devices. But a secure web and mobile VPN can help you solve some of these challenges too.

• When employees connect to an unknown Wi-Fi hotspot, such as in a coffee shop, their connection should be secured automatically and their data should be encrypted between their devices and the internet.

• When employees access the internet, they need a secure web solution that protects them, and your company, regardless of where or how they access the internet.

• When employees roam between IP networks, they should be using a secure mobile VPN to remain on a network your team trusts.

The foundations for proactive cybersecurity

5Sprint Business Take the fight to the cybercriminals

#4 Educate your stakeholders

Getting proactive about prevention isn’t just about having the right technologies in place. One of the most important aspects of proactive security is being deliberate about education and visual controls.

Instead of just hoping people will read emails, it’s important to think about this as a communication challenge that security is responsible for dealing with.

• Conduct formal training sessions that educate users about identifying risks, counter measures, and what not to do (e.g., leave devices unattended).

• Encourage a proactive culture around identifying and reporting cyber-risks.

• Share examples of common threats so people know what to look for — such as types of phishing emails or ways hackers can access devices from unsecure web sites in public areas like airports.

The foundations for proactive cybersecurity

016Sprint Business Take the fight to the cybercriminals

02 Proactive detection

02Proactive detection

When it comes to detection, the most proactive thing you can do is set yourself up to detect an evolving list of cyber-threats. It’s about deliberately setting yourself up to detect comprehensive threats and spot seemingly minor behavioral anomalies in real-time with artificial intelligence.

With the wide array of threats facing companies, automating the process is critical. You need to do this across:

• Cloud and web usage With a cloud-based web monitoring solution that checks network traffic for malicious threats regardless of how, where or when the user goes online.

• The company network With an enterprise-grade firewall to monitor data on the company network for viruses, malware and other threats such as ransomware and data corruption.

• Website traffic behavior With IP defense capabilities that can monitor online traffic for signs of DDoS attacks, alert IT, and mitigate the threat before downtime occurs. If you don’t want to do this in-house, managed cloud-based services are available.

• Business devices – For smartphones, tablets, and other mobile devices: use an AI-powered on-device mobile application that can monitor apps and data for unusual behavior, detect potential threats, and flag them for remediation by an MDM/UEM solution.

– For PCs, servers and laptops: use a secure AI-powered endpoint monitoring solution to prevent advanced threats, quickly detect issues and provide remediation.

Through continuous monitoring of device and network behavior, an AI-powered solution can learn and adapt in real-time to better detect new and emerging threats.

8Sprint Business Take the fight to the cybercriminals

03 Proactive remediation

03Proactive remediation

It’s easy to preach the importance of proactive cybersecurity, but what does it look like in practice?

Let’s look at some scenarios, from a range of industries:

Proactive DDoS remediation in retail

A popular fashion brand operating a hybrid-retail model is concerned about the emerging risk of DDoS attacks, especially in its own sector where cyber-attacks are frequent.3

DDoS attacks on a website can be particularly detrimental to retailers as the flood of traffic with superfluous requests can overload a company’s systems and disrupt service by preventing legitimate traffic from coming through.

To protect both the integrity of its services and brand reputation, the retailer opts to integrate a proactive IP defense solution that can:

• Monitor traffic and detect malicious traffic and unusual bandwidth patterns on its website

• Automatically alert IT when anomalies are detected — and filter out unwanted traffic to only pass through legitimate data

• Finger-print and flag known and new attacks for future reference

By filtering DDoS traffic and only allowing the right traffic to enter its network, the brand is always ready to mitigate and remediate even the most unexpected of attacks.

Proactive AI-powered threat management in private healthcare

A private healthcare firm is concerned about high-profile ransomware attacks in its sector and the threat they pose to its critical patient and staff services.

To prepare for the worst-case scenario, it decides to invest in an advanced mobile security solution, achieving:

• Proactive AI-powered endpoint monitoring — 24/7

• Immediate alerts for all malicious activity detected

• Smart security that learns as it analyzes behaviors

The healthcare firm can now focus on treating patients, confident that if a ransomware threat is detected, its proactive security will keep it safe.

3. www.computerweekly.com/news/252438382/Retail-sector-top-cyber-attack-target

Sprint Business Take the fight to the cybercriminals 10

Proactive remediation

Proactive device management in the public sector

A public sector agency is no stranger to security.

Government agencies have access to highly confidential information with ties to personal privacy and perhaps even national security. Guarding against cyber-attacks is critical.

Should a government employee lose a device or leave it unattended in a public location such as on a train, in a cab, or even at a rest stop, the implications are serious. If a passerby were to find the lost device and hack it, not only is it a breach of the user’s privacy, but it poses a major threat to the integrity of public data and operations.

To prevent a potentially catastrophic breach, the agency uses a simple, integrated MDM solution to:

• Locate and lock devices remotely

• Manage user access and policies

• Update device security automatically

This way, when a device is lost or stolen, IT has real-time visibility of all managed devices, and can quickly mitigate the risk when time is of the essence.

Agencies can further protect mobile devices from cyber-attacks by utilizing an on-device detection engine that complements MDM technology, using machine learning and behavior analytics to proactively detect threats.03

Sprint Business Take the fight to the cybercriminals 11

04 The road to proactive security

04The road to proactivite security

When you take a more proactive approach to security, you need to integrate new technologies to help you.

You need artificial intelligence to cover more ground than your team can. You need remote protocols to initiate policies when your users are beyond the firewall. And you need technologies like mobile VPNs to free your users to do their jobs.

But it’s important to note that you don’t only need technology to be more proactive about security. In fact, no one technology will be a silver bullet.

A truly proactive approach to security starts with a mindset that then filters into all your practices, people and technologies.

• It’s about how much you do to educate your users and improve their behaviors.

• It’s about how much time you invest in analyzing and responding to new kinds of threats.

• It’s about how many people are addressing serious issues when they find them (as opposed to being unaware of their responsibility).

So while we’ve focused primarily on technologies in this guide, it’s important to note that proactive security is just as much about people and processes.

Sprint Business Take the fight to the cybercriminals 13

When it’s time to transform, it’s time to secure

For the longest time, the most vital skill in IT security was your ability to react to situations.

But when your enterprise is going out of its way to work in new ways, use new technologies and fundamentally transform its infrastructure, reactivity can only get you so far.

Proactive security is about setting yourself up to prevent, identify and remediate the threats that will affect your business as it’s transforming.

And getting it right takes everything from the fundamental basics like endpoint protection and detection and user training to more advanced tools and tactics like artificial intelligence.

But the reason it matters is that when your company is caught between embracing the risks of innovating and embracing the risks of not innovating, there is only one correct answer.

The innovation and transformation at your business will be critical to its future.

Which is why it’s vital that security leaders, IT leaders and business leaders stay aligned around the organization’s roadmap and vision. So that IT and security leaders aren’t just reacting to the future — they’re proactively dealing with it to keep the business running.

14Sprint Business Take the fight to the cybercriminals

Further readingHow to embrace mobile working, without embracing risk

Mobile working has taken over the enterprise. For a lot of good reasons. It makes people more productive and helps businesses solve problems in intelligent, new ways. But it also exposes you to a number of new threats and risks.

Read our guide to find out how to empower mobile working by making it more secure.

15Sprint Business Take the fight to the cybercriminals 15

Let’s talkA proactive approach to cybersecurity is the only way to minimize risk and ensure that your endpoints, data, apps and network stay secure.

At Sprint, we have a diverse portfolio of cybersecurity solutions — including AI-powered MDM, UEM, DDoS protection, and private access authentication.

To discuss the risks most relevant to your own organization contact your local Sprint representative or give us a call at 866-653-1056. More details about our security solutions can be found here.