Four Actions to Take TODAY to Secure Your Business Data!
On our last blog, Is Your Business Data Secure? It Matters More Than You Might Realize, we promised a list of crucial items to ensure your business data is secure. So, without further ado, we’re delivering on that promise to you!
This list is organized in a rough order of importance to help you focus your efforts where they are going to have the most impact.
- Policies / Planning
The very first step in securing your business against cyber-crime is to develop a plan in the form of Policies. Information tech is always evolving so it is critical that these policies are in a live document that is regularly refined and revised, as things change.
Creating a new policy can be scary and daunting, so here are a few starter templates from one of the most foremost experts in the security industry: https://www.sans.org/information-security-policy/
When starting these policies, we recommend that you be very broad. Then, spend some time performing table-top exercises to evaluate your policies and update, as necessary.
A critical feature of every piece of network equipment (from servers to smart fridges), is the ability to update software on a semi-regular schedule. Often, these updates are new features that users have requested, but most of these patches include necessary security fixes.
When a patch is released, dedicated groups of attackers will begin reverse engineering the fix to find vulnerable components in the software. That way, they can create malicious software specifically designed to attack an unpatched device. Occasionally, a patch is released for a vulnerability that is already being exploited in the wild which means it’s even more critical that you apply this patch as soon as possible!
Patching can come with challenges. Usually, vendors thoroughly test prior to releasing a patch to the public. However, there are times that it doesn’t go well, and people are left to revert the change or wait until another fix is released. These potential issues mean it’s imperative to balance the risk of patching with the risk of not patching. We recommend patching a few devices to ensure everything goes accordingly to plan, then patching the remaining devices. Read more about patching here: https://expertitsolutions.ca/patch-tuesday-july-2020/
- User Education
The best firewall on the planet is YOU. The human brain is a marvelous tool for logic, reasoning, and pattern recognition.
Unfortunately, this firewall module doesn’t come pre-installed and requires some programming in the form of user education. 😉
Technology is going to catch most attacks on a network, but for the occasional ones that make it through, it is up to users to keep the network safe. This means evaluating levels of risk and deciding rapidly enough to not interrupt your workflow. It can be very tough to make this evaluation if you don’t know what to look for or how to respond to a suspicious event. We highly recommend training your users to give them the required skills to keep your business safe!
Throughout the educational process, it’s important to verify user skills with regular testing and evaluations of the reporting process. Without this test component, there is no way to know if the message is landing… unless there is a data breach. Testing can be simple but needs to be done frequently to ensure skills are kept as fresh as possible.
It’s likely that you already know what this is and have a favorite product in mind. Though we don’t have a specific tool recommendation, we do have some criteria that should be considered when looking for an antivirus product.
- Is there a central management console to monitor all the installed stations in your office? Managing more than a handful of computers can be a burden, especially if you need to go to each computer to check on scans or the status of a machine. Centralizing to a single console allows you to access information quickly and identify emerging trends across the network.
- What kind of actions are initiated when an infection is detected? (Full scan of the station, email alerts, removal of device network connection, etc.) Infections won’t occur if you’re ready for them, so it’s ideal that the software acts as quickly as possible and then notifies you of the event and action, potentially with recommendations!
- Does it offer a sandbox tool to secure suspicious applications? Essentially, this will isolate the actions of an application and monitor what happens. It only releases to the computer when things are deemed to be safe.
- How frequently are the virus definitions updated? It’s unlikely you will be targeted by a brand-new vulnerability, but the longer between release and the definition being installed, the greater the risk.
- Is technical support available? If you have questions about a scan result or require assistance with an upgrade, support will make your life a lot easier when issues come up.
Running multiple tools at the same time does not ensure greater safety. In fact, running multiple agents has been known to cause numerous strange behaviours and could even result in missing an infection or the accidental removal of valid data from your system.
We’ve got quite a few more tips for you, but this is a great place to start securing your network and data. Tune in next week for more actions to improve data and network security!
In the meantime, feel free to reach out to our team of experts with any of your questions. We’re always here for you.