More incidents than ever
There has been a spike recently in incidents, hacks or breaches of different severity focused on businesses or end users. There also have been discovered vulnerabilities that affect millions of users worldwide like KRACK which primarily affects individual users rather than access points.
All these events translated to more media coverage and exposure but many businesses still struggle with questions like ‘How can I protect my data’ or ‘Is my business sufficiently protected?’. As the answers to those depend on each individual business, based on Australian Signal Directorate, Microsoft’s best practices and over 16 years of experience, I can give you 5 things you can do to make your business IT more secure.
1. Enable automatic updates
As with anything, even security starts with the basics which in this case are automatic updates. We all know by now that no software is without issues and that all software needs to be patched for security updates at some point. Operating system is no different. Windows, Mac and Linux have all implemented some form of this process that keeps your security at its highest level without much intervention. For now, we focus on Windows as it is the most popular.
Windows 10 has automatic updates enabled and they cannot be disabled or postponed as easily as it was done with Windows 7. Microsoft realised that to keep any spread contain, it needs to force users to update automatically rather then rely on them to do it manually. A few years back Windowx XP had a flaw and no firewall(!) that would shutdown your PC almost instantly after you turn it on. As you can imagine, it was super annoying but it got fixed and Windows XP got a firewall out of the box in Service Pack 3.
Microsoft updates are being released every 2nd Tuesday of the month and with automatic updates enabled, will install in the background and apply during reboot.
2. Quality antivirus
Antivirus has become a synonym for protection of your system against viruses, malware, ransomware and so on however things have moved on since that association has been made.
How does AntiVirus work? [brief version]
Basic principle of antivirus is that it scans all files that are being accessed and compares them to a large database of known viruses. If there’s a match, it will stop its execution and removes the file. The problem is that even the slightest change in the code will change its unique signature and the virus could pass as legitimate. As you can imagine, this can create lots of problems and it does.
There are other ways AVs scan for malicious content thanks to heuristic or the latest is behavioural, machine learning or combination of them. These do provide more advanced protection against zero-day threats (not yet identified) but they are also more expensive and require dedicated infrastructure.
What AV to get?
Depends on your needs and budget. Avoid free versions as their protection is often insufficient for businesses (often even home users) and they display ads or collect your data to ‘pay’ for it. Paid version will give you multiple daily updates, support and peace of mind. Look at Top 10 small business AV for 2017 or contact us for specific needs or industry e.g. medical or financial.
3. Up to date software
All other software that you use on your PC is again susceptible to security holes and vulnerabilities, discovered or not. Two primary culprits majority of people have installed on their PCs are Java and Flash. The latter is being phased out but it will take a while before that happens. In the meantime, remember that there is a thing called malvertising that can show you, and only you a specific advertisement on a web and without any interaction run a persistent code on your PC. This is why there should be absolutely no browsing on servers.
Most used applications such as Chrome, Firefox, Java, Flash or Adobe Reader have built in updaters that run at least once a week and alert you to the latest version. I know, it can be annoying but the benefits far outweight the drawbacks or posponing it and then waiting for lot more time for the updates to finish.
Call it necessary evil if you have to but grab a coffee while your updates install.
4. Spam filter
‘What has spam to do with security’ you might think. Actually, quite a lot. Email is one of the main avenues for malware into your systems. We all use it, and we all experience the ‘click’ fatigue where we don’t read what we click on. We open the documents because the email or sender seems legitimate.
SPAM filter can filter or at least flag such emails and remove the temptation for us to click. Good email provider, whether it’s your webhost, Office 365 or Google Apps, will check against the sender and makes sure that email that is sent from your CEO to the finance manager, is your CEO, not someone else with an ‘urgent’ money transfer.
SPAM filter requires some testing and configuration but can make your mailbox cleaner and your environment more secure. It also ties to our last point which is education.
5. Education [Training]
Security awareness training is probably the most important point in the list, even if it’s fifth on the list. Why? The sofware can fail, the spam could be too sophisticated or the updated hasn’t trickled through just yet hence the end user is the last resort and good education can go a long way when it comes to security.
Don’t want to bore you with my regular security awareness presentation but will mention major points:
- Green lock does not equal legitimate website
When a website asks you for your email login, it’s not enough to check if it has green lock for SSL certificate anymore. Certificates are easy and relatively cheap to come by and can still be a part of illegitimate domain. Beware and type the URL yourself, do not click ont he link provided.
- If in slightest doubt, do not click
If the email you received looks, sounds or in any other way raises suspicion, contact your IT person and ask them to have a look to be sure. Do not open any documents or zip files as they can contain macros that launch malicious code on your computer by simply opening Word document or loading an image.
- Do not give your password
Many businesses have IT support and bad guys know that so they quite often try to impersonate them and ask you for your password. If you don’t know this particular IT person, ask to speak with the one you know or call them back on the number provided. This will ensure you are speaking to the legitimate person/company. Don’t be afraid, they will appreciate you being cautious.
There are many other ways to protect your business, infrastructure, privacy and so on but the above are simple enough that you can implement easily without much technical knowledge and experience.
What is your tip to protect a business?