As companies continue to struggle in today’s difficult economy, cutbacks affect all sectors of organizations. Unfortunately, IT security solutions are often not spared form the chopping block – a risky and shortsighted decision if you ask me, but perhaps that’s fodder for a future piece.

For now I’d like to focus on how IT groups – especially in small and mid-sized organizations – can remain secure with limited budgets.

This cheap and “low hanging fruit” of IT security includes:

1. Making sure that Windows Update is turned on and working on every machine, and that each system receives the latest updates every time. Automatic patch management is free. Consider any complaints you receive about machines rebooting to be the cost of security. And don’t forget to tell users to shut down their Outlook before they leave for the night so that their email won’t be corrupted by a reboot.


2. Keeping anti-virus software signatures up to date. Use the highest update frequency possible. This may mean checking for updates every 10 minutes. Malware is always evolving.

3. Educating users about:

• Opening email from hostile entities. Cover phishing, spear phishing, attachments, etc.
• Social engineering – so that access is not granted to those with a silver tongue
• Going to “interesting web sites” and downloading “fun” content that’s actually hostile malware
• Bringing in their own USB sticks or phones, and inserting these devices into their machines and potentially infecting the network
• Letting other people, such as family members, use company notebooks at home to surf the web or access email
• Key loggers – what they are, why they’re a threat, etc.

4. Making IT and the Help Desk paranoid about the network. Have them on the lookout for users who complain about slow machines, update services that no longer work or strange pop-ups, and take action IMMEDIATELY. Infections are no longer a mere annoyance that can be ignored; they’re now real business threats that can get out of control in minutes.

5. Managing passwords. Change passwords frequently, use complex credentials, and eliminate shared passwords.