Tip of the Week: Your Cybersecurity To-Do List

It is a well-established and widely-known fact that your employees are some of the biggest threats to your business via the technology that they use each and every day. If your employees aren’t aware of the practices and policies that they need to follow to prevent these threats, you could find yourself in an unpleasant position. Here, we’ll review four categories of cybersecurity basics that everyone in an organization should abide by, and some tips to support each.

Preventing Phishing

Phishing has been becoming more and more of a favorite tactic by hackers, meaning that you and your employees need to look at any messages that come in via your email (or other solutions) with a critical eye. Here are some practices to help you minimize the influence of phishing on your business:

• Watch for “Urgent” messages (or, for that matter, “URGENT!!!!!!” ones). Many phishers will try to manufacture urgency to make sure you click without taking a moment to consider it may be an attack. Resist this knee-jerk response.
• Review in detail. Many phishing messages show distinct warning signs, such as blatant spelling or grammar errors (but this may just be the person you’re talking to as well). You can find other, more reliable signs by giving any links or the email address of the sender the “hover” test. Without clicking on anything, hover your cursor over the links and a small pop-up box will appear. This box will show you the address that really sent the email, or the link that you would actually be redirected to. Check to make sure all the details are kosher. For these reasons, it’s recommended that you don’t click on any links in emails. Instead, retype the URL into your web browser.
• Double-check with the sender. If you have access to another means of communication with the supposed sender of an email, reach out to them using that other means to confirm that they sent it. If they didn’t, it’s a pretty safe bet that the email is fraudulent.
• When in doubt, assume the worst. If you just aren’t sure how legitimate a given email is, don’t click around in it. Assume that it is a phishing attempt, and report it to your IT provider.

Establishing Safe Browsing Habits

Unfortunately, there are plenty of threats that reside online, and it is only too easy for a user to unwittingly allow them in. Make sure your users abide by the following policies to minimize the threats you’ll potentially need to deal with.

• Think before you click. Similarly to links found in emails, there are plenty of opportunities online to let in a threat. Consider what you’re clicking on before you do so. (The “hover” trick works well here too… check out the bottom of the window.)
• Reserve business computers for business purposes. Non-work-related browsing can bring users to websites that can host threats without the user realizing. Discourage your users from surfing the web, downloading content, and doing other things online unless they are work-related.
• Moderate access. Use firewalls and content filtering to keep unwanted content off of your network, and users from accessing unwanted content, respectively.
• Trust your IT resource. If you are even the slightest bit unsure about something, whether it’s a program you’ve been prompted to install or making sure your settings are focused on maintaining security, reach out to IT for assistance.

Enforcing Strong Passwords

It seems that everything requires a password these days, which makes it all the more important that you and your users are aware of how to keep them safe - especially in the workplace.

• Don’t recycle passwords. Once a password has been used and replaced, it is best to not use it again - this is why you’ll often find a “you have used this password too recently” message if you attempt to use it again within a certain timeframe. This is the same reason that passwords should not be used for more than one account - if that password is compromised, you’ve just lost control of multiple accounts.
• Avoid easily-guessed passwords. As a way to try and come up with a password that is easy to remember, many people will resort to using common elements in their password - pet names, maiden names, birthdays or anniversaries - or use a simple phrase or a string of numbers. The entire point of a password is to make it so that others are unable to access one of your accounts, so making it something that can be guessed is counter-productive.
• Consider leveraging passphrases instead. Passphrases are not only typically more secure than a password, they also have a tendency to be more memorable. Let me ask you this… which of these two would you find more memorable, “F4njUJ29S5” or “pearquiethigh?” You can also use basic substitution to make you passphrase more secure, turning our example into “pe@rqu!e+h!gh” instead.
• Use a password manager. One of the main reasons that people reuse passwords so often and neglect to change them is the fact that they are scared of forgetting them. A password manager can help reduce this by securely saving all of your different passwords behind one master password. 

Protecting Your Business’ Data

Finally, there are many threats out there to your business’ data - including any you have on your clients or your employees. You have a responsibility to yourself, as well as these clients and employees, to make sure that this data is as secure as possible.

• Make sure your business’ data is backed up. There are so, so, so many ways that your business could lose its data. While it may be attacked, it could just as (if not more) easily be lost due to equipment failure, user error, weather conditions… the list goes on and on. If your on-site data is lost, you will want to make sure you have an up-to-date copy squirreled away in the cloud to reference.
• Protect your assets with access control. You need to be concerned about both the security of your digital files, and of your actual business location. If you’re using multi/two-factor authentication to secure your online resources, or requiring identity confirmation in order to enter certain areas of the business… you need to be doing both.
• Maintain your security solutions. The thing about security software is that it isn’t something that you can just set up and count on indefinitely. Attackers are always examining these solutions to find vulnerabilities, so it is important that you regularly update and patch the ones you use to keep them safe. Every solution you have should actually be set up with security in mind. A glaring example is your company’s wireless. Not only should that be secured with a password, it should be hidden away from outside users.
• Keep your payment options compliant. For your sake, and the sake of your clients, you should make sure your business is compliant to whatever regulatory standards that apply to it… including the Payment Card Industry Data Security Standard (PCI DSS).

Following these guidelines is a great start to ensuring your company’s security. i-medIT can help get you this far, and beyond. Reach out to us at 630-549-6199 to learn more about what we can do.