10 Practical steps to maintain security in a crisis.
When businesses face disruption, knowing how to maintain security in a crisis becomes critical. Crises force rapid change, risk exposure, and new threats. These 10 practical steps help your organisation safeguard operations, protect staff, and secure data during uncertain times.
Before anyone had heard of Covid-19 or the coronavirus, many organisations, and in particular SMEs, have been typically slow in recognising and responding to the business risks of Privacy concerns, Data Breach legislation and associated increases in Cyber Security threats.
Such organisations are typically operating using legacy tools, ineffective processes and outdated IT policies. They are unaware of the increased business risk that this creates.
Given the current ‘crisis’ business leaders are rightly prioritising their staff and their customers. However, if organisations are to survive – and thrive – beyond this crisis then leaders must not forget to manage underlying business and IT risks which (unfortunately) do not disappear.
In reality, organisations running remote workforces are now potentially exposing their networks, applications and data to more risk.
Hackers are switching to target SMEs having recognised larger organisations have increasingly effective cyber measures in place. This is already resulting in specific campaigns (e.g. via email, SMS and Voicemail) to trick staff into compromising their systems or data.
It is arguably, now more important than ever to ensure organisations have reviewed and updated their IT policies and procedures and that remote staff have effective Cyber Awareness training.
So what can organisations do?
Here are 10 practical steps:
1. Ensure staff dedicate their personal device for company use.
Request staff to not visit sites considered inappropriate for office use on any devices (company or personal) used to access company networks and systems. Staff should also be required to ensure company approved Antivirus and Endpoint protection software is installed.
2. Implement a password policy.
Ensure all staff use strong passwords and that they understand not to share credentials.
3. Harden your applications.
Make sure staff can only access the applications, files and data required for their roles and also restrict the use of office macro files.
4. Secure access to your network,
Consider implementing a company VPN or similar. You may also wish to require your staff to use a VPN for all work-related internet activity.
5. Review your Backup / Restore and Disaster Recovery capabilities.
Given your staff pose the biggest threat to your digital security, review your backup and restore policies. And test them! Should your network, files or data be corrupted how quickly can you recover? Don’t forget your staff will be working remotely so if your systems go down, you can’t rely on a ‘war-room’ situation.
6. Provide Cyber Awareness training for your staff.
They are your first line of defence and also your weakest point.
7. Move away from legacy tools to secure collaboration tools.
If you have been over-reliant on Excel, Email and whiteboards to track work then now is the time to consider implementing tools designed to facilitate remote collaboration. There are plenty of tools to choose from that will help your organisation manage your clients, workflows and tasks etc.
8. Review all staff-focused IT policies and procedures.
Make sure they are appropriate for the current circumstances. (E.g. Acceptable Use, Password Policy, Bring your Own Device (BYOD), Cyber Security Policy, Business Continuity, Disaster Recovery). However, if this is likely to be too time-consuming then a ‘crib sheet’ of key initial policy information should be created. This can be a single ‘emergency’ document of additional rules that could span all of these policy areas.
9. Implement data leakage prevention software.
For organisations storing large amounts of personal or sensitive information (e.g. health and professional service organisations), the risk of data loss or breach is heightened with remote working – staff can potentially copy emails or send data through personal email accounts. So, being able to automatically identify sensitive data (e.g. TFN’s) or documents and prevent that data from being emailed or printed requires specialist software. (For more information contact email simon.cohen@cohesis.com.au).
10. Run a network vulnerability scan.
Understand whether your network has any basic vulnerabilities that might already be compromising your business.
In times of ‘crisis’, implementing these measures is easier said than done. It is for this reason, Cohesis is offering to help Perth-based SMEs mitigate their IT and business risk through this time of uncertainty.
In conjunction with Essemy, we will provide a free initial consultation and based on that discussion may provide you with one or more of the following:
-
- A free review of your IT policies and procedures and policy ‘crib sheet’. (e.g. Cyber security Policy, Acceptable Use, Password Policy, BYOD, Backup / Restore, Business Continuity / Disaster Recovery and Incident Management)
- A free online Cyber Awareness session for your staff.
- A free network vulnerability scan.
This is a no-strings offer designed to help SME’s protect themselves through this current crisis. However, it is limited to a first-come, first served basis and is subject to availability and capacity. To register your interest, please email simon.cohen@cohesis.com.au.
