Getting buy-in from the C-suite and having documented, enforced security policies is a great start to securing your systems. Training staff members and keeping up-to-date on patches and the latest technology are easy wins in the battle to keep your data secure.
Phil Cardone, a top Boston IT services professional shares 10 insights into getting your senior leadership to open up to digital and cyber security.
1. How Can I Get Senior Management to Champion Digital Security?
It’s important to get senior management behind cybersecurity programs. Every aspect of the business is at risk as soon as a cyberattack makes it through your firewall. You can underscore this by including cybersecurity topics on the agenda when senior leaders come together. The CISO and other tech-savvy leaders can help explain what’s being done to keep the network safe, and where more efforts are needed.
2. What is the Best Way to Evaluate Risk?
The first thing you need to do is appreciate the risks, which include CEO fraud, phishing, ransomeware, malware, and other threats. These all must be addressed as top priorities, with resources assigned to minimize risks. It’s important for decisionmakers to understand this on a visceral level as well as an intellectual one. Statistics, white papers and regular updates on breaches that make the news may help them remember that it’s happening to less aware organizations.
3. Why Are Audits Important?
A comprehensive audit is important whenever you kick off a major cybersecurity initiative. It should include the hardware and software in place as wells as training and awareness efforts. The main aim of the audit should be to find and fill gaps in the process. This can also help prioritize spending to cover the concerns that pose the greatest risks.
4. How Should Security Integration Be Approached?
Your organization must approach security holistically. This includes cloud services meant to remediate threats as well as endpoint solutions. You don’t have to source everything through a single provider, but all solutions should integrate to form a comprehensive defensive strategy.
It’s important to be able to monitor threats from one place to facilitate early detection.
5. What Are the Most Vulnerable Access Issues?
A comprehension policy includes written procedures to safeguard data assets. Passwords are the main point of vulnerability since they are literally the keys to your data kingdom. However, there are an array of topics that need to be covered, including remote access and other events that make it easier for people to access the network. Backing up data regularly makes it easier to recover from compromised devices, but policies for using personal devices to access work email and information should include installation of monitoring software on the device prior to allowing access.
6. How Can Corporate Procedures Address Data Concerns?
Update corporate procedures regularly to emphasize rules for the access, management, and protection of sensitive data. For example, plans to restore data from backups should be outlined in the official documentation. The testing of critical systems post-recovery is another great candidate for official policies and procedures. Basically, everything needed to recover quickly from a malware or ransomware attack should be covered in training and procedural documents.
7. How Can I Improve User Behavior?
Employees with access to financial assets and proprietary data should have communication protocols in place to verify requests. For example, if the CFO wants to confirm a request from the CEO to transfer funds, they may exchange texts or have a phone conversation. Multi-factor authentication also slows hackers trying to break into the system. Patches, software updates and operating system updates give you the advantage of bug fixes and make you less vulnerable to attack.
8. How Often Should Training Occur?
Train everyone adequately and have regular refresher training. A good security awareness campaign empowers employees to exercise caution before clicking on emails, links and social media posts. Raising skepticism makes it less likely employees will click on the wrong file and compromise your data.
9. What Are the Best Safeguards for Employees Using Personal Devices?
Large corporations have a hard time preventing employees from using their own devices to access the company email system or intranet. The best option is to provide devices through the company — but that gets expensive. Consequently, IT must install monitoring software on employee-owned devices or come up with a better option.
10. How Can I Learn More About Web Isolation Technology?
Isolation Technology puts an environment between the web and users accessing the web from company devices. The browser opens outside the firewall, which isolates the code in case it contains ransomware or malware. This technology is likely to be a hot topic this year and may be worth exploring for your organization.
