Newmind Cybersecurity Iceberg: 4 Layers that Keep Our Clients Safe

Did I get your attention with the meme? Did that work? I’ve gotta confess, I’m just a fan of the format and you might have seen it before on YouTube: a streamer will break down the “depths” of a subculture or hobby, giving you a glancing summary of different mysteries that you’ll find as you dive deeper into the culture. 

I was having a conversation with a colleague recently about ransomware, and they were telling about a time when a client was nearly hit with an attack that somehow dodged three different defenses which should have caught the threat, before an antivirus canary finally detected that something was wrong, and saved his device from the attack.

This let to us talking about how, as security providers, we find ways to barricade our clients under as many layers of security as possible, because no single security protection is infallible. An email scanner that protects you from malicious emails at your work address isn’t going to protect you from a malicious email opened from your personal address. A password manager is a safer way of saving login details, but a determined attacker may still find a way to steal your credentials. 

There are a lot of ways you can protect your organization, from filtering your entire WiFi network for suspicious sites, to the true final barrier that can protect company data: training your employees to spot threats using their own wits (and respond appropriately). I feel like the iceberg is a pretty effective way to visualize the depths of defense that can keep your team safe (and your data, too). 

The Newmind Group Security Iceberg

Network Security (The Surface)

When we call this “The Surface”, we mean it almost literally. Your network is the outermost layer of your company’s data footprint, and it’s the first point of contact for most IT threats as they attempt to reach your team (or any guests on your network, for that matter). By placing defenses here, you have the opportunity to stop a threat before a single person can make actual contact with it, by blacklisting certain sites and behaviors from occurring. This would include tools like:

• Managed Firewall
• DNS Filtering

Device Protection (Shallow Waters)

Unfortunately, network security can only do so much before it gets in the way of your team’s productivity, so our “Shallow Waters” of security are for all of the data that makes it beyond the network level and onto employee workstations, or other endpoints in your environment. This area is where you’ll find a lot of the tools that an average person might think of when you say “cybersecurity”, like antivirus and antimalware software.  For us, it includes:

• Next-gen antivirus
• Platform security tools (i.e. Microsoft Defender and Apple Platform Security)
• Patch Management software

Browser Protection (The Deep)

This is where you begin finding more specialized tools for protecting personal data—tools that generally live in the cloud and are concerned with your team members’ inboxes and online footprint. We think of them as one last protective layer between company data and the real person behind the computer. 

• Email Scanners
• Identity Threat Detection and Response (ITDR) 
• Cloud Backup
• Multifactor Authentication

Personal Protection & Social Engineering (The Abyss)

This is the final frontier, and the biggest challenge for IT security today. One of the main reasons there is no perfect solution for cybersecurity is that, as long as there is a human involved to make a simple (human) mistake, there will always be a non-zero chance of an attack landing with your team. All of the other layers can be made useless, if an attack makes it through the outer layers and catches a team member off-guard—and attackers are getting better and better at this every day. Creating a sense of false trust and urgency are incredibly effective tools for outwitting one of your team members and the best you can do is train your staff to be cautious and weary. This is your opportunity to ease the burden of managing sensitive information (like passwords and account numbers) and build better defense instincts in your users.

• Password Managers
• Actual Security Training

What does your company’s “Iceberg” look like?

As ransomware attacks become easier and more common, it has paid off time and time again for our clients to have multiple cybersecurity solutions in place in place. If you need to layer some extra defenses, or need a fresh assessment of your current security setup, we can help. Get in touch.