Information courtesy of Kaspersky Daily
Establish a few habits
When it comes to security for your small-medium business (SMB), the more regular and thorough the checks are, the better. Software, firmware, and licenses are all items that expire or need routine updates.
Here are our Top 5 regular checks:
Renew the corporate site security certificate
Any website that requests or processes user data must have an SSL certificate. It protects information entered by visitors from being intercepted, and almost all modern browsers warn users that sites without an SSL certificate are insecure. That can scare off potential customers.
Your website most likely has an SSL certificate, but its validity period is limited. Depending on the certification authority, it will need to be reissued every three, six, or twelve months. Therefore, we recommend setting a reminder in your calendar about certificate renewal.
Update router firmware
The older the software, the more likely it is to contain vulnerabilities, so it’s critical to keep all software up to date. Workstation operating systems and applications themselves usually notify users when updates become available to install.
Routers also have built-in software — firmware — which over time likewise becomes outdated and vulnerable. Cybercriminals can then exploit the old firmware to infiltrate the corporate network. Unlike software on workstations, routers generally do not send notifications when the firmware is out of date, so updates have to be done manually.
Therefore, it’s important to inventory all corporate network equipment, and at least every couple of months check the administration console to see if a new version of the router firmware has appeared. If the console has no function to check for updates, you need to do it yourself on the manufacturer’s website. And if some devices are outdated and no longer supported, you should think about replacing them; vulnerabilities in such models will remain unpatched forever.
Revoke unnecessary rights
A dismissed employee can cause all kinds of trouble if their accounts and access to the corporate network are not closed in time. Cyberrevenge against former employers is real. To avoid a similar situation, make it a rule to revoke all access rights immediately after dismissal.
In addition, regularly audit all accounts and their permissions. It can happen that a person remains in the company but moves, say, to another department, where they no longer need some access rights but no one remembered to revoke them. Any unnecessary privileges can prove costly in the event of a cyberattack.
Backing up your data helps protect it from wipers, ransomware, careless employees, and other hazards. You can back up manually, but it’s better to schedule an automatic backup so as not to clutter your calendar with reminders.
That said, even if your company’s backups are automated, you should periodically check your data storage. Are the backup programs running smoothly? Is the storage address correct, or did someone sneakily change it? Do you have enough space for all of the data? Are the storage devices acting up? Modern data storage devices use S.M.A.R.T. technology to diagnose their own problems and predict how long they will survive. The technology analyzes the status of disks and reports issues.
If you store backups in the cloud, check the settings periodically and buy additional space before you need it.
Update antivirus licenses on servers
Security software on workstations and mobile devices won’t let you forget about subscription renewal. But don’t forget about servers. An unprotected server can cause a range of problems — from data leakage to hosting malicious resources in your infrastructure to turning your office into a cryptofarm. Set a repeating reminder in your calendar to update server protection.
Your company’s security is in your hands
When it comes to security, the more regular and thorough the checks are, the better. To avoid serious issues:
- Update software regularly, including router and other network device firmware;
- Keep an eye on the expiration date of security certificates and security software licenses;
- Make backup copies of data, and if your company automates the process, periodically check that it is being done correctly;
- Revoke access permissions from employees as soon as they are no longer required;
- Use security solutions to help monitor the health and status of your corporate infrastructure.
CommWest is your IT partner, here to help with all these areas of vulnerabilities, along with a myriad of more. We are not a “one and done” solution. Working with us is a relationship based on your business needs. Contact us today to start your network security discussion.