With the average beach costing organizations a hefty price tag of $5.5 million cybersecurity is becoming a more essential need. Defining and communicating your Boards Information Risk Management Regime is critical to your organizations overall cyber security strategy. Focusing on these areas highlighted below can help harden your organization.
Information Risk Assessment - Conduct a risk assessment to establish an effective governance structure and determine your organizations risk appetite.
User Education and Awareness - It is no secret that end users are often viewed as the weakest link. With 90% of all cyber attacks originating with a spear phishing attack it is imperative to produce a solid user security policy that covers acceptable and secure use of the organizations systems. Establish a staff training program and maintain user awareness of the cyber risks.
Secure Configuration - Apply security patches and ensure that the secure configuration of all systems are maintained regularly. Create a system inventory and define a baseline build for all IT devices.
Removable Media Controls - Create a policy to control all access to removable media devices. Scan all media for malware before importing on to the corporate system.
Managing User Privileges - Ensure principle of least privilege is implemented within your organization. Establish account management processes and limit the number of privileged accounts. Limit user privileges and monitor user activity. Control access to activity and audit logs.
Incident Management and Disaster Recovery - It is important to establish a plan that involves responding to incidents as quickly as possible. Procedures need to be developed for performing incident handling and reporting, setting guidelines for communicating with outside parties regarding incidents, selecting a team structure and staffing model, establishing relationships and lines of communication between the incident response team and other internal and external groups.
Monitoring - Establish a monitoring strategy and produce supporting policies so everyone is aware. Continuously monitor all systems and networks. Analyze logs for suspicious activity that could indicate an attack or a possible failure in a system.
Malware Protection - Implement end point security on all devices connected to the organizations network. Establish a relevant policy for malware defenses and protection across the network.
Network Security - Protect your network against external and internal attacks. Manage the network and filter out unauthorized access and malicious content. Continuously monitor and test the implemented security controls within your organization.
Want to learn more?
Contact us for a consultation and we can provide more information on how security can be implemented within your organization.