Cyber Checklist: 7 Ways to Protect Your Critical Business Data

Implementing any cybersecurity solution can feel like an onerous task - but it doesn't have to be. We've outlined the most useful strategies for improving your cyber posture, ranging from employee behavior to network assets, software to mobile devices, and more. With the recent uptick in ransomware attacks, you can't afford to be unprepared.  

Here Are 7 Ways to Create a More Cyber Aware Workforce and Protect Your Sensitive Business Data:

1. Create a Security-Conscious Workforce

While they have the best of intentions, your employees may be trading security for perceived efficiency. They may be reusing passwords or storing them in personal internet browsers. You need to create a work culture that emphasizes how cybersecurity hygiene protects both your organization and their personal data. There are a few ways to do this: 

• Establish Routine Security Training and Education

  • This should include all employees, and provide updates on known attacks, security trends, and preventative tools such as two-factor authentication.

• Evaluate IT Complexity

  • If your IT processes were designed without employee feedback, there may be some big blind spots. Incorporate employee feedback, or use pilot programs, to assess new protocols.

• Restrict Data and Application Access

  • Access should be granted on a "need to know" basis. Keep your data safe by limiting access to strict job-related areas.

• Implement Data Usage Controls

  • Set automatic blocking for unsafe actions, such as uploading data to the web, sending emails to unauthorized contacts, or copying info to external drives. 

• Reinforce a Password Policy

  • You should require regular password changes, and passwords with complex combinations of numbers, letters, and symbols.
    
    

2. Inventory and Manage Hardware and Software Assets

You can't secure assets you don't know about. Before you can reduce your organization's attack surface, you need a 360° view of your network. This is especially important if your organization has highly segmented departments with different resource needs.

• Document and Secure All Network Devices

  • If it's touching your network, it needs to be protected. Include cloud assets, onsite hardware, mobile, and IoT devices.

• Use Guest Networks

  • If applicable, segment your traffic. Keep guests on a separate network from your employees to reduce risk. Oversee all user access to these networks and record authentication errors or unauthorized access. 

• Respond Quickly

  • In the event of unauthorized activity, quickly disconnect any suspicious devices. This includes devices that may be running potentially dangerous software.

3. Analyze, Prioritize, and Manage Vulnerabilities 24x7

24x7 security monitoring is becoming a common requirement across compliance frameworks. These solutions can effectively manage vulnerabilities, monitor and detect threats, and respond to malicious and risky activities in real-time.

• Identify Vulnerabilities and Prioritize Patching

  • A risk-based approach will help your IT team prioritize which vulnerabilities to tackle first. Start with the most severe risks and address others in descending order of severity.
    
    

4. Secure Hardware and Software Configurations on Mobile Devices, Laptops, Workstations, and Servers

Manufacturers design default configurations with ease of use in mind. Basic controls, old protocols, pre-installed bloatware, and open ports are easy targets. Your organization will need to create configuration standards and a way to send out patches/updates across all devices. 

• Train Staff on Anti-Virus and Anti-Malware Requirements

  • They must understand the process for implementing automatic software updates, and why such patches are necessary.

• Configure Items Before They’re Used

  • Remove all default settings and passwords before handing devices over to your employees.

5. Maintain, Monitor, and Analyze Activity Logs

Without logs, attacks go unnoticed and uninvestigated. Many IT teams keep audit records for compliance purposes, but attackers know there are many organizations that lack the time or resources to do so. This creates profitable opportunities to comb systems and data undetected.

• Log, Monitor, and Analyze Security Risks

  • Many compliance frameworks, such as HIPAA, require companies to record, examine, and analyze log activity.

• Continuously Monitor Your Environment

  • Ensure you have an audit trail in the event that a security incident occurs.

• Perform Regular Risk Assessments

  • These are one of the most effective ways to identify weak points in your system.
    
    

6. Back-Up Data Offsite or in the Cloud

In the event of a ransomware attack, your organization will need a second cache of critical data. This will allow you to recover data and bring applications back online as seamlessly as possible. Solutions such as SaaS Protect or iCorps Guardian are designed to recover different types of data - cloud-based and on-premise. Depending on the solution, your backup plan may include:

• Long-term retention

• Storage redundancy and recovery

• Assistance meeting industry compliance

• Ongoing testing and monitoring for validation

7. Stay on Top of Your Compliance Frameworks

Your compliance requirements will vary depending on the framework. That said, there are general best practices when it comes to protecting sensitive personal information, and how to respond in the event of a data breach.

• Ensure Data Protection Tools and Policies Are Followed

  • That way you can demonstrate compliance with regulations when audited.

• Hire a Data Protection Officer

  • A DPO can help your organization establish written contracts with external partners, and foster compliance across your organization.

• Record All Data Breaches

  • You'll need to, where necessary, report these to relevant authorities. Or look to integrate with a partner who will document and report on vulnerabilities and breaches. 
    
    

For more information about securing your business data, reach out to iCorps for a free IT consultation.