10 Basic And Easy Cybersecurity Steps

Is cybersecurity a top priority for your business? We certainly hope so. A recent report revealed that almost 64% of all businesses prioritize IT security above everything else. Even 80% of all SMBs rank IT security as a top business priority.

The Impact Of Cybercrime Can Be Far-Reaching

A successful cyberattack can damage your company beyond repair. This could include several tangible or intangible damages such as financial losses, intellectual property theft and the erosion of customer confidence and trust. By 2021, cybercrime could cost the world more than $6 trillion, and it is estimated that almost 50% of all businesses that suffer a data breach could shut down permanently.

What can businesses do? Start with these 10 first steps.

1. Adopt A Risk Management Strategy And Program Plan

One of the first steps organizations can take toward an effective cybersecurity strategy and program plan is to understand its risks, prioritize them, document them and communicate them. Understanding these risks includes determining the company’s risk appetite (i.e., how much risk is the organization prepared to tolerate?). Once this is ascertained, it is important to communicate this information to management and other important stakeholders to raise awareness. Make it a regular agenda item to ensure ownership and buy-in from management. Building a sound information security program plan (“playbook”) is essential.

2. Invest In User Awareness And Education

Information security is the responsibility of not just the IT team, but of all stakeholders involved, including senior management, employees, partners and suppliers. Once a risk framework is established, an official information security policy (overarching policy) should be produced, reviewed and communicated on a regular basis to ensure strict adherence.

Not only should new users be made aware of their personal security responsibilities, but the company should also invest in refresher training to remind users of all cyber risks. Since more than 90% of breaches are caused by phishing, IT teams can look at investing in phishing simulation tools to raise security awareness. Companies must encourage employees to stay abreast of the latest cybersecurity trends and continue to develop their skills and raise their information security awareness.

3. Secure IT Infrastructure

Be sure to create and maintain (typically with the use of automated tools) an inventory of every network device, user and application on your network. Establish timescales to maintain these devices and applications by performing regular updates and patches. Using vulnerability management strategies, perform regular scans of your infrastructure to look for vulnerable applications and devices to plug these vulnerabilities as quickly as possible.

4. Protect Your Network Perimeter

Deploy firewalls and intrusion detection protection to safeguard your trusted internal network from untrusted external networks. Secure internal IP addresses and prevent any direct connections to your own network. Filter out unwanted content, applications and websites to control unwanted access. Use monitoring tools to monitor network activity and conduct regular penetration testing to test security controls. Think outside the box with zero-trust networks, which I wrote about in a recent 2020 trends article.

5. Deploy Adequate Malware/Zero-Day Protection

Deploy best-of-breed malware protection to secure your endpoints and servers. Run automated and scheduled scans to check for malware across the entire organization. Invest in next-generation technology, like machine learning and AI, that can block both known and unknown attack vectors. Extend malware protection to all removable and mobile devices.

6. Safeguard Removable Devices

Produce a corporate policy to control the use of removable media in your organization. Removable media should only be used as a last resort, and all data must reside on the corporate network. It is important to limit the type of media that can be used and the type of content that can be transferred over removable media. Any new media that is connected to the corporate network should be scanned for malware (and encrypted) before any form of data transfer takes place.

7. Tighten Your Grip On Users, Sensitive Applications And Data

Establish an effective account management process to review user accounts from creation to modification and deletion. Understanding job roles and responsibilities is crucial to providing access to critical applications. Limit privileged access to select users only and create generic access for all regular accounts. Review the requirements for privilege accounts more frequently than regular accounts, and make updates if necessary. Monitor sensitive applications and privileged accounts regularly.

8. Extend Security Policy For The Home And Mobile

Flexible worker schedules come with great business benefits, but they also expose the company to a great deal of risk. Adequate safeguards must be put in place to ensure that data is protected at rest and in transit. IT teams must make users aware of the risks of using mobile devices and also train them on how to use mobile devices securely. Your security policy must cover aspects of permitted device types, information types, applications, encryption and incident reporting.

9. Establish An Incident Response Plan

Prepare for the worst. Develop a response plan and individual playbooks in the case of a cybersecurity incident. Create an incident response team, and assign responsibilities to all stakeholders involved. Conduct regular fire drills (tabletop exercises) to test your plan and know when to escalate. The incident response team must also receive specialized training to ensure they have the skills to address any incidents that may occur.

10. Monitor All IT Systems

Continuously monitor your entire IT network–systems, devices, users, access and applications. If you do not have the resources in-house, partner with an IT security service provider if necessary. Conduct spot-checks and analyze logs for unusual activity. Establish a centralized capability so that logs and security alerts from systems can be collected and analyzed.
No industry is immune to the growing cost of cybercrime. Overall, the volume of security breaches grew by 67% in the past five years. Don’t fall victim. Take these 10 basic measures to minimize the chances of a security event, putting you on a safe path for 2020.

This article was originally posted on Forbes.com. Click here to read >