Cross Posted from Net Friends

Author(s):

Net Friends

We asked our Information Security Office (ISO) staff to recommend practical cybersecurity steps that businesses can take to improve their digital security stance for 2019. They made it clear: the core of any security initiative is your people. Invest in protecting your employees from online attacks and reducing the damage from any attacks that get through.

Let' check out our TOP 5 Cybersecurity Steps in priority order!

Tip #1

Sign up for advanced email protection

Cloud-based filtering services use machine learning to detect and block malicious email before it reaches your organization. We recommend Barracuda Essentials and Barracuda Sentinel, which provide excellent security at low cost per user. Net Friends can implement email filtering (including staff training) in just a few hours and then monitor effectiveness over time.

Extra Credit: Deploy email server authentication

Deploying DKIM, SPF, and DMARC on your email server or cloud service helps ensure that real emails between you and your partners get through while malicious emails are blocked.

Tip #2

Use Multi-Factor Authentication for all important apps

We believe 2019 is the year when businesses should implement multi-factor authentication (MFA) on their internal platforms and LOB web applications. MFA is the single most effective tactic to ensure that only authorized personnel can log into your critical infrastructure. We recommend asking Net Friends to help you deploy the industry-leading Duo MFA service. Standardizing all your applications on Duo' MFA plug-ins makes it easier for employees to manage MFA prompts.

Extra Credit: Get tipped off when one of your accounts may be compromised

Sign up for alerts from SpyCloud and you'll be notified if they discover credentials on the "dark web" associated with one of your company' email accounts.

Tip #3

Increase your device protections

For workstations and mobile devices, there' no silver bullet – you need a multi-layered approach to security using built-in security features and next-generation tools:

1. Volume encryption prevents data extraction if a computer is lost or stolen. Start with Bitlocker (Windows) or FileVault (Mac).
2. Traditional antivirus applications are still important. We recommend Webroot.
3. Augment your antivirus with a next-generation machine learning application such as Carbon Black.
4. Make sure any smartphone or tablet is enrolled in a mobile device management (MDM) tool like AirWatch that gives you control over the apps that access your networks and data.

Extra Credit: Beef up your IT standards and do an assessment

Have your IT team review the free CIS Benchmarks to ensure networks and hosts are properly secured. Then commission Net Friends or another 3rd party to assess your infrastructure, looking for Shadow IT and other weak points.

Tip #4

Institute regular security training events

Does your new-hire onboarding program include cybersecurity training? Do your staff know how to report a suspicious email or unusual digital activity? Do you have a written password policy? Net Friends can help you build a full security policy and training program to ensure that new hires not only get trained immediately but remain active assistants in your security efforts throughout their employment.

Extra Credit: Test your employees' security awareness

Find out who was really listening during that phishing presentation by using Duo' free Phishing Simulator to send simulated attack emails to employees and get reports on who clicked through or put in their credentials. Barracuda Sentinel includes a more sophisticated paid version of this tool.

Tip #5

Conduct Live Incident Response Drills

Even the best protections won't stop all attacks. A subcontractor, partner, or long-standing employee can be the unwitting target. Make sure your entire company knows how to handle security incidents properly with live drills and exercises. There really is no substitute for practice. Contact Net Friends today to help you develop a Security Incident Response Plan. The makers of credential management platform Secret Server have a terrific free Incident Response Plan template if you want to try your own hand at it.

Extra Credit: Go to the next level with MSIEM

If your incident response starts when someone notices that something' wrong, you could be responding to an attack from weeks or even months ago. We recommend Lumifi Managed Security Incident and Event Monitoring service to provide real-time analysis and response to anomalous activity on your network.

That' All For Now Folks!

We hope you found these Cybersecurity Steps and recommendations useful. Whether you're engaging us to implement your security improvements or going it alone, we wish you all the best in your efforts to protect your business data and productivity.

Happy 2019!