The challenge for many SMBs is finding a balance between security and expenditure. How can an IT administrator justify the investment in a security tool when the whole business is in cost-cutting mode?
Human error is still probably the most critical security vulnerability facing storage environments in small and medium sized enterprises. With cyber crime and identity theft expected to increase in 2009, SMBs will need to be even more vigilant in their defenses against attacks directed at human gullibility to fall for phishing and social engineering attacks.
SMBs cannot afford to ignore security. Even if budgets are tight, the overall cost of a security breach, loss of data and downtime far exceeds the amount an SMB needs to spend to secure its data and network. Short-term gains could translate into long-term losses if the security of the business becomes another victim of the recession.
Implementing adequate security can be achieved using a mix of technology and security best practices and the following 10 steps can help SMBs go a long way towards addressing security threats in a tough financial climate.
1. Determine Vulnerability
Conduct an extensive audit of all security measures in place - all hardware, software and other devices - and the privileges and file permissions given to all employees in the organization. Actively test the security of the storage environment and check the logs of the network and storage- security controls such as firewalls, IDSs and access logs to see if anything was discovered and highlighted as a possible security event. Event logs are an important, but often neglected, source of security information.
2. Monitor Activity
Monitor user’s activity 24 x 7 x 365. For a single administrator, monitoring event logs and carrying out regular audits is a massive undertaking. However, it might be realistic to monitor the logs within the storage environment rather than the entire network. Logs have proven to be a source of great value if a security breach occurs and an investigation ensues. Logs analysis transcends all of this as it is not only a post event type of tool but it also allows you to better understand the way your resources are being used and allows for improved management of it.
3. Control Access
Access to data should be given only to those who need it, even if that person happens to be your cousin or the boss’s son.
4. Safeguard Information
Safeguard all business information. The use of uncontrolled portable storage devices, such as flash drives and DVDs, puts considerable volumes of data at risk. These devices are easy to lose and they can be stolen quite easily if left lying around. In many cases, the data that is on portable storage devices is often not protected using encryption.
5. “Need-to-know and need-to-use”
Enact technological barriers that permit device use according to a clear and defined policy. Recent studies show that data leakage by employees increases when people lose their job. Portable devices such as USB stick or PDAs can hold large volumes of data. Monitoring and controlling their use on the network is key to reducing the risk of data leakage or malicious activity by disgruntled employees. Use of devices should be restricted to those who really need to be mobile.