We asked our Information Security Office (ISO) staff to recommend practical steps that businesses can take to improve their digital security stance for 2019. They made it clear: the core of any security initiative is your people. Invest in protecting your employees from online attacks and reducing the damage from any attacks that get through.
Let' check out our TOP 5 Tips in priority order!
Cloud-based filtering services use machine learning to detect and block malicious email before it reaches your organization. We recommend Barracuda Essentials and Barracuda Sentinel, which provide excellent security at low cost per user. Net Friends can implement email filtering (including staff training) in just a few hours and then monitor effectiveness over time.
Extra Credit: Deploy email server authentication
Deploying DKIM, SPF, and DMARC on your email server or cloud service helps ensure that real emails between you and your partners get through while malicious emails are blocked.
We believe 2019 is the year when businesses should implement multi-factor authentication (MFA) on their internal platforms and LOB web applications. MFA is the single most effective tactic to ensure that only authorized personnel can log into your critical infrastructure. We recommend asking Net Friends to help you deploy the industry-leading Duo MFA service. Standardizing all your applications on Duo' MFA plug-ins makes it easier for employees to manage MFA prompts.
Extra Credit: Get tipped off when one of your accounts may be compromised
Sign up for alerts from SpyCloud and you'll be notified if they discover credentials on the "dark web" associated with one of your company' email accounts.
For workstations and mobile devices, there' no silver bullet – you need a multi-layered approach to security using built-in security features and next-generation tools:
Extra Credit: Beef up your IT standards and do an assessment
Have your IT team review the free CIS Benchmarks to ensure networks and hosts are properly secured. Then commission Net Friends or another 3rd party to assess your infrastructure, looking for Shadow IT and other weak points.
Does your new-hire onboarding program include cybersecurity training? Do your staff know how to report a suspicious email or unusual digital activity? Do you have a written password policy? Net Friends can help you build a full security policy and training program to ensure that new hires not only get trained immediately but remain active assistants in your security efforts throughout their employment.
Extra Credit: Test your employees' security awareness
Find out who was really listening during that phishing presentation by using Duo' free Phishing Simulator to send simulated attack emails to employees and get reports on who clicked through or put in their credentials. Barracuda Sentinel includes a more sophisticated paid version of this tool.
Even the best protections won't stop all attacks. A subcontractor, partner, or long-standing employee can be the unwitting target. Make sure your entire company knows how to handle security incidents properly with live drills and exercises. There really is no substitute for practice. Contact Net Friends today to help you develop a Security Incident Response Plan. The makers of credential management platform Secret Server have a terrific free Incident Response Plan template if you want to try your own hand at it.
Extra Credit: Go to the next level with MSIEM
If your incident response starts when someone notices that something' wrong, you could be responding to an attack from weeks or even months ago. We recommend Lumifi Managed Security Incident and Event Monitoring service to provide real-time analysis and response to anomalous activity on your network.
We hope you found these tips and recommendations useful. Whether you're engaging us to implement your security improvements or going it alone, we wish you all the best in your efforts to protect your business data and productivity.
Happy 2019!
