{"id":21,"date":"2023-10-23T13:44:00","date_gmt":"2023-10-23T10:44:00","guid":{"rendered":"https:\/\/blog.comping.fi\/?p=21"},"modified":"2025-09-16T15:02:17","modified_gmt":"2025-09-16T13:02:17","slug":"security-basics-part-1-why","status":"publish","type":"post","link":"https:\/\/blog.comping.fi\/?p=21","title":{"rendered":"Security basics, part 1 – Why?"},"content":{"rendered":"\n

Overview<\/h2>\n\n\n\n

This series discusses on the security on higher level so it doesn’t get too technical and is aimed for IT service owners and decision-makers. Focus is on prevention rather than the aftermath after something’s gone wrong.<\/p>\n\n\n\n

Update 16th Sep 2025!<\/strong> TLS Best practices link updated<\/p>\n\n\n\n

Topics<\/h3>\n\n\n\n

Why<\/strong> – Why someone tries to access the environment?<\/p>\n\n\n\n

Who<\/strong> – Who should be able to access the environment? Can we authenticate the users or identify them in another way?<\/p>\n\n\n\n

Where<\/strong> – Where are the users connecting from? From the office network? Some specific country\/countries\/region? Can we either whitelist or blacklist the locations?<\/p>\n\n\n\n

When<\/strong> – Is the environment accessed around the clock? Can we recognize peak usage times?<\/p>\n\n\n\n

How<\/strong> – What kind of device they’re using, what possibilities we have locating and authenticating the user?<\/p>\n\n\n\n

I think there are two levels of attacks to IT environments; vandalism<\/strong> – “let’s sweep the area and see if we can break anything”<\/em> and the more dangerous one – targeted<\/strong>. I would say there are different measures one should take to be protected from these.<\/p>\n\n\n\n

This post drills down to very basics, more will follow.<\/p>\n\n\n\n

Vandalism<\/h3>\n\n\n\n
\n
\n

Someone just sweeps the network for known vulnerabilities and uses these to cause service distruption. The attacker doesn’t really care whose environment they’re breaking, but might use the stolen data to sell it forward or blackmail the company.<\/p>\n\n\n\n

There’s plenty of tools that are really easy to use for this kind of activity and the attacker just might get their kicks just from causing an outage to a company access portal or web service. I would consider Denial-of-Service (DoS) attacks as one form of vandalism (ofc… targeted DoS attacks are certainly a thing also).<\/p>\n<\/div>\n\n\n\n

\n
\"https:\/\/unsplash.com\/photos\/ZKuZNTogNdM\"<\/figure>\n<\/div>\n<\/div>\n\n\n\n

Targeted<\/h3>\n\n\n\n

Attack might occur on multiple vectors including social engineering, targeted phishing, etc\u2026 Protecting from these kind of attacks is much trickier and can’t be only prevented with technical measures.<\/p>\n\n\n\n

One charasteristic for these attacks is likely doing subtle tests for the targeted environment on many levels just to check if there are one or many ways to gain access. My take is that a targeted attack is likely to be done “in the shadows” so that no one notices anything before it’s too late.<\/p>\n\n\n\n

Protection<\/h2>\n\n\n\n

It takes way less effort (and money) to act in advance, because repairing damage after an attack takes a lot of work and money and there are things that one might not be able to fix like company’s reputation.<\/p>\n\n\n\n

There are plenty of measures to protect the IT environment from attacks that fall in to one or both of the categories above.<\/p>\n\n\n\n

Posture<\/h3>\n\n\n\n

One obvious thing is to avoid being an “easy target” and I think this applies for the both cases. Great ways to easily check your current security posture, is to use great free online tools like:<\/p>\n\n\n\n