For now I’d like to focus on how IT groups – especially in small and mid-sized organizations – can remain secure with limited budgets.
This cheap and “low hanging fruit” of IT security includes:
1. Making sure that Windows Update is turned on and working on every machine, and that each system receives the latest updates every time. Automatic patch management is free. Consider any complaints you receive about machines rebooting to be the cost of security. And don’t forget to tell users to shut down their Outlook before they leave for the night so that their email won’t be corrupted by a reboot.
2. Keeping anti-virus software signatures up to date. Use the highest update frequency possible. This may mean checking for updates every 10 minutes. Malware is always evolving.
3. Educating users about:
- Opening email from hostile entities. Cover phishing, spear phishing, attachments, etc.
- Social engineering – so that access is not granted to those with a silver tongue
- Going to “interesting web sites” and downloading “fun” content that’s actually hostile malware
- Bringing in their own USB sticks or phones, and inserting these devices into their machines and potentially infecting the network
- Letting other people, such as family members, use company notebooks at home to surf the web or access email
- Key loggers – what they are, why they’re a threat, etc.
5. Managing passwords. Change passwords frequently, use complex credentials, and eliminate shared passwords.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.