The Most Common IT Vulnerabilities in 2020 & How to Stop Them

In a digital world, if you have a white collar job you’re probably using a computer to do the vast majority of your work. The transition from analog work to digital work has only taken a few decades, but now businesses rely heavily on their IT infrastructure to securely store data and get work done.

With more work happening online, the risk of cyberattack grows. Every year, the attacks grow more sophisticated, and it can feel difficult to stay ahead of the curve. However, following security best practices and updating your software regularly can mitigate most attack vectors. In this article, we’ll review the top exploits IT teams have seen recently, and how to prevent them.

1. Phishing & User Error

While this one is the hardest to prevent as an IT team, it’s by far the top attack vector so we should address it up front.

Phishing is the use of fake emails, texts, phone calls, or even cross-site scripting to get a user to submit or send login credentials to a destination controlled by attackers. It’s difficult to stop because phishing attacks can come in all shapes and sizes. The attacks vary in complexity from simple spam emails to multi-level social engineering campaigns with live “customer support” representatives.

Preventing phishing is an ongoing education battle. Employees at your organization should be aware of phishing and its dangers. They should know to only input credentials into sites with trusted URLs, and everyone at your organization should know what a phishing attempt looks like.

Additionally, using a password manager across all company devices can go a long way. Password managers will tell you when they don’t recognize a given URL, and IT teams can even set more restrictive settings around when and where passwords can be used.

2. Updating Software

The federal government’s Cybersecurity & Infrastructure Security Agency (CISA) has compiled information on the top vectors attackers are using against the federal government and companies in the US. They found that nearly all these vectors are the result of using unpatched versions of software.

For instance, CISA’s top attack vector in 2020 is a loophole in Microsoft Office that was patched in 2015. However, so many companies have failed to update their software that this vulnerability continues to exist on a broad scale.

Staying up to date with the most recent version of software can be a challenge for IT teams across dozens of software providers and hundreds of devices. Your IT department should have a manifest of all software your company uses and should receive security emails from software manufacturers.

In addition, the ability to roll out patches company-wide across all devices and servers is incredibly useful in the fight to keep software up to date. To do so, you’ll need some type of remote access client installed across all company devices, preferably one that supports automatic or scripted updates to machines.

3. Malware

Malware and ransomware are increasingly popular attack vectors, because for attackers they’re simple to deploy. Most malware comes via email as a downloadable attachment or via a link to a downloadable file. Your organization’s employees should know never to open attachments from an untrusted source.

Additionally, using a malware scanner and filtering emails through a trusted email provider can make sure malicious emails never make it to the inbox.

Email isn’t the only delivery vector for malware, though, so make sure your IT team has systems in place to restrict other delivery methods. Users should rarely need to download executable files, so IT can restrict file types or origin websites from download rules. Use of flash drives should be heavily restricted as well for the same reasons.

4. No Firewalls, Malware Scanners, or VPN

Cyberattacks can come via many different vectors and it’s difficult to predict what attacks will be launched against your organization. However, there are some commonly accepted security measures all IT teams should put in place to protect users in the organization.

Your organization should have some combination of virtual private network (VPN), firewall, and/or malware scanning to prevent malicious attacks and unauthorized access. When used in combination, these measures can greatly reduce potential attack vectors and make it much harder for attackers to gain access.

Preventing Common IT Vulnerabilities at Your Company

Stopping cyberattacks is a combination of educating employees, keeping software up to date, and restricting potential attack vectors. If you set up good rules around downloads, flash drive use, VPNs, and firewalls, you can greatly reduce risk. From there, good monitoring software will help you identify and quickly respond when malware is present in your network. Remote monitoring and management solutions, like Level, can help with all of these steps. They can also help you programmatically roll out company-wide software updates and security patches.

From there, IT security is a matter of education. Teach your employees what to look for in a phishing email or malware link. User error is the most difficult part of cybersecurity, and the teams that do well at training are the most successful at preventing cyberattacks long-term.

‍