Many companies feel overwhelmed with the burden of covering all aspects of IT security, since growing network structures and factors — such as device proliferation and an increasingly mobile workforce — mean there are a greater number of systems and end-points that need to be secured than ever before. Even standard measures such as regularly installing the latest patches can become an endless task. Therefore, continuous protection through fundamental measures is especially important.
Free eBook: Modern Retail Security Risk – Get your copy now.
According to the 2014 US State of Cybercrime Survey, mobile technologies and risks are proliferating but security efforts are not keeping up. Only a third of companies have a mobile security strategy in place. The study also reveals that organizations typically include cyber risks in enterprise risk-management programs but do not regularly assess threats. Only 47% perform periodic risk assessments and 24% have an objective third party assess their security program. Businesses must ask themselves whether all measures can really be mastered in-house or whether collaboration with an IT partner should be considered in order to reduce risks and expense. Regardless of the strategy, businesses should adhere to the basic checklist below to establish a solid security foundation.
The six-point security check:
1. Patch management: It sounds so simple: regularly install the latest patches on all operating systems and software solutions over the entire IT infrastructure. So why is this simple measure one of the most common weak points in companies? Unfortunately, for many IT managers, patch management has turned out to be an endless loop in the growing infrastructure. Missing the patch update on just one machine creates a security hole. Mobile devices are also affected, since they are used to access the infrastructure.
2. Virus and firewall protection: Attacks by virus, worm, trojan and web applications are one of the most common causes of data loss for medium-sized companies. The basic security measures include consistently performing updates on all machines, including mobile devices. It sounds trivial, but it’s becoming increasingly difficult for IT managers to ensure all devices are updated efficiently.
3. Email security: Ideally threats from viruses and malware in incoming emails are already detected and intercepted by an email security and anti-spam software solution. A large portion of email data security is covered by encrypted, tamper-proof storage of emails as well as by the option for legally-compliant archiving.
4. Network security scans: Scan the network regularly to ensure that no threats have slipped through – including all virtual environments,mobile devices and network devices. In this case the operating systems and applications should go through security checks that are based on industry standards such as OVAL (Open Vulnerability and Assessment Language) and SANS Top 20 (SysAdmin, Audit, Network Security).
5. Log data analysis: A lot of companies don’t even notice, or notice only too late, that they have been a victim of cybercrime. Effective security strategies therefore involve some kind of real-time monitoring of log data, and regular analysis of security-related event logs. Only then can critical incidents, suspicious activities and risk trends be detected early enough to issue corrective measures in a timely manner. This involves monitoring policies, access controls and specific activities and applications (e.g. IDS, IPS, firewalls) that are significant to the network security.
6. Mobile device management: Nowadays mobile devices are one of the biggest weak points for many companies. Trends such as BYOD – employees using their own mobile devices for work – make it almost impossible for IT managers to guarantee security. Because of this, a tool to manage mobile devices is now an integral part of any comprehensive IT support solution.
There are many other criteria that relate to IT security, but being aware of this checklist is a great start. It is also important to note that data security always includes a reliable backup solution. Regularly informing employees and raising awareness about security holes (often caused by these same employees) also contributes to IT security in the business. Sound policies, practices and education are staples that every organization should keep in check.
By Ian Trump, Security Lead for LogicNow
Bio: Ian Trump is security lead at MAXfocus, a global provider of cloud-based IT security and management solutions for the world’s largest community of MSPs.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.