Technical professionals. Trusted advisors. Certified expertise.
We’re increasingly hearing from organizations that need to establish that they have sufficient security policies in place, either to meet the requirements of a larger client or to qualify for cyber insurance that insures against breaches and similar losses. Details vary, and we’re happy to work with you on the specifics, but here are some of the kinds of questions you may be asked. Of course, if you don’t have to prove that you’re doing the right thing to some other company, answering these questions for yourself can only improve your security readiness.
With device management, an IT department or managed services provider (MSP) maintains oversight and control over all organizational devices. That’s helpful for automating configuration and deployment, providing secure access to organizational resources, ensuring consistent security policies, managing app and operating system updates, tracking device inventory and status, and much more.
Regular backups—some stored offsite—are essential if you need to recover from lost or stolen hardware, a natural disaster, or a ransomware attack. Even though ransomware isn’t currently a major problem in the Mac world, it wouldn’t hurt to start creating immutable backups using “write once, read many” tape or something like Retrospect’s Cloud Object Lock, a technology that ensures that cloud-based backups can’t be corrupted. Finally, have you tested restoration and recovery of key systems from your backup data? Backup is important, but only if you can restore.
It’s essential to install security-related updates to operating systems and major apps, but how quickly that happens has to be weighed against problems that version changes can cause for important workflows. There’s no right answer here, but you want to make sure that you aren’t leaving your organization’s apps and devices vulnerable to known security exploits for longer than necessary.
Short, easily guessed, or cracked passwords are one of the primary ways attackers breach corporate networks and systems. At minimum, your password management policy should require that all passwords be stored in a password manager, new passwords be generated by the password manager and meet minimum requirements for strength, and two-factor authentication be used when available.
Endpoint protection is essentially software aimed at preventing and detecting malware on employee workstations, often with an organizational dashboard and management capabilities. Although the Mac doesn’t have nearly the exposure to malware that Windows does, it’s still important to keep computers free of malware that could hurt performance, exfiltrate data, or provide an entry point for future attacks. Endpoint protection is usually part of a larger managed systems approach that can also ensure that devices adhere to security policies like full disk encryption, run only approved software, stay up to date with security updates, and more.
Exactly what counts as sensitive data will vary by organization, but anything related to network and corporate security qualifies, as does any personally identifiable information you may hold about or for clients. It’s not uncommon to store information about people that includes names, email addresses, phone numbers, and postal addresses, but you should be even more careful if you store Social Security numbers, credit card numbers, driver’s licenses, passports, financial records, or medical records. Knowing what you have is the first step; after that, consider what additional precautions you should take to protect such information.
Social engineering is another common way attackers gain access to corporate networks and systems. Does your organization require that all employees take regular training to learn how to identify phishing attacks, require appropriate approvals for unusual transactions or access requests, and report suspected incidents to the necessary people? If an administrative aide in the accounting department gets an email request from the CEO to pay an urgent invoice to a new vendor, will that person know how to respond?
It’s tempting to allow users to access their email from personal devices or to have contractors use their personal email addresses for work communications. We recommend keeping as clear a line as possible between work and personal devices and accounts to reduce the security implications of such mixing. Particularly when there’s sensitive information in play, personal email addresses should never be used for work communications, and if personal devices are being used, they should be set up with two-factor authentication for organizational logins.
Bad things happen, and it’s important to consider how you would respond to different types of security incidents and natural disasters. How will your organization maintain crucial business operations, communicate with employees, coordinate with partners (insurance, legal, PR, and clients), and more? Is your plan written down and updated regularly? Have you tested key aspects of your plan?
We know there’s a lot to think about regarding security in today’s world, and we’re always available to help if you’d like assistance answering any of the above questions.
(Featured image by iStock.com/Bulat Silvia)
Social Media: Securing an organization’s digital assets requires ongoing attention. This article poses questions your organization should be able to answer—and that will likely come up when purchasing cyber insurance or doing work for other, larger organizations.
When you subscribe to the blog, we will send you an e-mail when there are new updates on the site so you wouldn't miss them.
80 Orville Drive Suite 100
Bohemia, NY 11716
Tel: (866) 518-9672
65 High Ridge Road #510
Stamford, CT 06905
Tel: (866) 518-9672
3321 SW 194th Terrace
Miramar, FL 33029
Tel: (866) 518-9672
218 Barksdale Drive
Broussard LA 70518
4 Knollwood Place
Joliet, IL 60433
10 Grosvenor Court
London SW15 2AX UK
© Copyright 2023, HCS Technology Group. All Rights Reserved.