For now I’d like to focus on how IT groups – especially in small and mid-sized organizations – can remain secure with limited budgets.
This cheap and “low hanging fruit” of IT security includes:
1. Making sure that Windows Update is turned on and working on every machine, and that each system receives the latest updates every time. Automatic patch management is free. Consider any complaints you receive about machines rebooting to be the cost of security. And don’t forget to tell users to shut down their Outlook before they leave for the night so that their email won’t be corrupted by a reboot.
2. Keeping anti-virus software signatures up to date. Use the highest update frequency possible. This may mean checking for updates every 10 minutes. Malware is always evolving.
3. Educating users about:
- Opening email from hostile entities. Cover phishing, spear phishing, attachments, etc.
- Social engineering – so that access is not granted to those with a silver tongue
- Going to “interesting web sites” and downloading “fun” content that’s actually hostile malware
- Bringing in their own USB sticks or phones, and inserting these devices into their machines and potentially infecting the network
- Letting other people, such as family members, use company notebooks at home to surf the web or access email
- Key loggers – what they are, why they’re a threat, etc.
5. Managing passwords. Change passwords frequently, use complex credentials, and eliminate shared passwords.
Now, assuming cuts will have to be made, which aspects of IT security should you fight for and insist be spared at all costs?
- Never stop educating users (this actually is expensive because it takes time away from other work).
- End-users are the weak link.
- Don’t stop paying for anti-spam/malware/virus software running on your servers, but consider switching vendors or using a multivendor solution to improve the net.
- Never stop scanning your network for signs of an attack. Look for malware, key loggers, remote control software, and unusual network activity.
- If your Internet bandwidth spikes at odd times when there are no employees working and no updates are happening.
- If there are a lot of outbound network connections to individual home systems and strange countries where you don’t do business.
- If users complain about slow performance, pop-ups or web pages that don’t load.