Seven Keys to Securing Your Growing Business

Transcription

1 Seven Keys to Securing Your Growing Business Common-sense guidelines for simplifying your security By Tsailing Merrem, Senior Product Marketing Manager The economy is picking up and business is growing again. If you re adding workers and buying new computers, you may be using whatever consumer-grade PC security solution or antivirus software is pre-installed on those new PCs. But consumer-grade packages simply aren t good enough to protect the business. What s more, enterprise-class options that require specific IT training to deploy and manage aren t appropriate solutions either. So, how can you secure your assets and intellectual property, protect employees and valuable customer data and do it easily? In this paper, we provide clear guidelines for business owners to identify a cloud-based security solution that is simple to use, eases growing pains and hardens security.

2 Who s looking out for growing businesses? Every business, regardless of size, is vulnerable to information theft and security breaches. Small and mid-sized businesses often lack the security resources of larger companies, becoming easy targets. That s why cybercriminals go after small business banking accounts more than any other sector. 1 It s akin to thieves robbing convenience stores instead of banks. Why are these businesses facing serious risks? According to industry analysts, there are plenty of reasons. According to the 2012 Verizon Data Breach Report, smaller organizations (less than 1,000 employees) represent the plurality of 2012 breach victims. The reason is simple: smaller organizations are the low-hanging fruit, posing little-to-no resistance. According to the Aberdeen Group's latest research, smaller businesses lag behind larger companies in terms of keeping pace with IT security. 2 There s a significant security gap that s common as businesses grow a dangerous in-between stage where consumer products are no longer capable of protecting assets and enterprise solutions are too complex. Despite the size and value of the SMB market, SMBs are underserved by large security vendors who simply scale down and repackage their enterprise offerings for them. One major factor contributing to these risks is that obtaining the appropriate types and levels of security for a growing business isn t as simple as it should be. Fortunately, there are guidelines that SMBs can readily follow and solutions that are easy to implement. 1. FCC Small Biz Cyber Security Planning Guide, Cybersecurity%20Planning%20Guide_1.pdf 2. Modernizing Security for the Small and Midsized Business Recommendations for 2013, Aberdeen Research, January 2013 A Sophos Whitepaper October

3 Seven keys for identifying the right-sized security solution 1. Simplify security management You don t live and breathe security. You have other things to worry about. Better management of security means consistency across the board. You hire people for their skillsets, not because they are naturally conscientious when it comes to keeping security software up to date. Consumer-grade antivirus products are notorious for displaying pop-up alerts that mean little to end users. Many vendors' aggressive renewal campaigns barrage users with warnings of lapsed protection months before renewals are due. These messages distract users from their jobs and often annoy them to the point that they turn off the scanning or uninstall the software. Without a management component, you have no visibility into the protection status of each machine until it is infected, causing loss of data and productivity. Standardize security enforcement by taking it out of the hands of your employees. Find a solution that is painless to deploy, automates updates, and doesn t rely in any way on employee knowledge or vigilance. 2. Stop the latest threats without slowing users down Security software companies often convince customers to load up their servers and PCs with security products that require so much processing power that they impact performance and productivity, and annoy everyone. Look for a solution that doesn t overwhelm your servers, PCs and mobile devices. 3. Focus on the user, not the machine Seek an affordable solution that makes it easy to create and enforce user-based security policies that follow users. That means not having to worry about loading security software (and upgrades) on every PC and mobile device that comes in (or goes out) the door. Userbased policy and reporting follows users across systems, everywhere they go. So if users work on multiple computers or get new ones, their personal policy is always in effect seamlessly and automatically. Forward-thinking security companies make this process easier with user-based licensing plans that protect a user's additional devices, such as home systems and mobile devices, for the same price. 4. Get a solution you can easily manage (or co-manage with an IT consultant) Effective security management must be simple yet powerful. That means the management A Sophos Whitepaper October

4 console must eliminate unnecessary configuration complexity, making policy a lot easier and more intuitive. It also means making sure you re not getting a scaled-down version of enterprise software. You shouldn t need an IT security genius to make sense of the security jargon and unnecessary rules and settings. You also shouldn t have to set up a server just to manage your security. The ability to manage security from anywhere is quickly becoming a must-have capability not only for IT administrators, but for anyone considering co-management opportunities. Solutions that use a cloud-based management console allow you to co-manage security with an IT consultant, or offload some or all of your security management tasks. Should you need escalated support, you can quickly invite a consultant to view your management console. And since the IT consultant can perform management tasks from their office, they don't need to show up to yours, which leads to faster reaction and resolution times. Make sure your next security solution includes a cloud-based management console that has been engineered to make your job easy and allows you to outsource tasks while still maintaining control. 5. Make sure your security solution covers laptops and other mobile devices It used to be that businesses could simply set up basic perimeter defenses a network firewall, for example, and some antivirus software and that would take care of security. But now it s not enough to protect physical assets in office locations. That s because nowadays people work everywhere and anywhere. A recent Sophos online survey found that 85% of respondents carry a smartphone, 65% carry a laptop, and 48% use a tablet computer. In fact, on average, respondents in the U.S. said they use three devices. 3 Remote and mobile devices introduce a threat to your data security, whether they are company-owned or employee-owned. Either way, they require the same protection as on-site PCs. So, before introducing employee-owned or managed devices into the workplace, you need to consider several factors as part of a remote work policy. For example, does your security solution support Macintosh notebooks and desktops? Many road warriors are Mac enthusiasts and some remote users work from home on Mac desktops. In addition, some Windows users may not use the most current OS versions. Look for essential endpoint protection that deploys quickly and easily, and find a solution that provides complete coverage everywhere on all platforms while making your life simpler. 6. Protect your proprietary data, no matter where it's stored Chances are, your most valuable company data is getting around more than you realize. Whether it's payroll records on the CEO's notebook, customer lists that travel on the systems 3. Users weighed down by multiple gadgets, Naked Security, March 14, 2013, A Sophos Whitepaper October

5 of your traveling sales force, or business plans on employees' home computers, your most valuable data is out there and needs to be protected. Look for an SMB security solution that can encrypt data in all of these scenarios, and do so in a way that doesn't slow down employee productivity. 7. Evolve your security measures to stay one step ahead ahead of cybercriminals Forget about static solutions that are outdated the day you buy them. You need a software solution and a vendor that are working to stay one step ahead of all threats on the horizon, and upgrading your software remotely in real time. In addition to antivirus protection, up-to-date web filtering has become critical as cybercriminals increasingly target users of social media. An employee may click on a link they believe is from a trusted friend, which is actually a cleverly disguised virus or piece of malicious code. A good web filtering solution blocks access to these and other dangerous websites. Look for a vendor with a solid track record for protection and a way to help you deploy their latest updates and innovations. Cloud-based security designed for growing businesses A cloud-based, cloud-managed security solution makes sense on all levels. Being cloudmanaged means there is no server to set up. In addition, deployment is almost instantaneous, upgrades are automatic, coverage is pervasive for all company-sanctioned devices, and scalability is infinite. What s more, a cloud-based solution lets you eliminate costly investments in hardware and ongoing maintenance. The responsibility stays solely with your software vendor and/or IT consultant, so you don t have to worry about it. And you can get on with doing what you do best: focusing on your business. A Sophos Whitepaper October

6 Sophos offers the right-sized, cloud-based solution Sophos Cloud offers the same Sophos protection that businesses know and trust and use on-premise, except now it s available as an easy-to-manage, simple-to-use cloud service. Per-user licensing provides a sensible and affordable way to secure both company-owned and employee-owned devices. For a single fee, you can protect multiple computing devices that your employees use for work including their desktops, notebooks, and home computers, with complete tablet and smartphone support coming soon. Its modular design allows you to pay for only what you need and add capabilities as you are ready. Instant deployment, automatic upgrades, everywhere coverage and unlimited scalability make this a powerful, practical, growth-friendly solution. Sophos is a Gartner Magic Quadrant Leader IT analyst firm Gartner Research recently put Sophos in the leaders quadrant of three Gartner Magic Quadrant reports: July, 2013 for Unified Threat Management; January, 2013 for Endpoint Protection; and September, 2012 for Mobile Data Protection. Figure 1: Sophos Cloud setup Protect all your devices Sophos Cloud Endpoint delivers comprehensive cloud-based protection as a service for businesses, remote offices, and mobile employees. Highlights include: Antivirus with advanced malware detection techniques and the latest built-in host intrusion prevention system (HIPS) deliver award-winning protection and performance. Continuously updated malicious website protection keeps users safe from the latest infected websites the number one source of malware infections today. A Sophos Whitepaper October

7 Live Protection closes the gap between regular updates. Your systems will always have access to the latest threat intelligence from SophosLabs through the cloud. Device control gives you clear visibility into USB devices that plug into your computers. With this information, you can decide whether or not they threaten your company, and if you should have a policy to limit them. Figure 2: Sophos Cloud Events reports Protect data everywhere Sophos encryption technology provides secure access to confidential data without requiring users to even think about encryption. It allows your company to: Effortlessly encrypt data on desktop and laptop computers. Protect proprietary data in the event a laptop is lost or stolen. Enforce data loss prevention (DLP) policies across and mobile endpoints. A Sophos Whitepaper October

8 Flexible management options with an eye to the future Sophos Cloud gives you control over all your IT security needs from one convenient, easy-touse, cloud-based management console that's available from any computer with a browser, from anywhere. It can be easily managed in-house, outsourced to an IT consultant, or comanaged. With this flexible platform, you can: Outsource management to supplement your IT staff, support remote offices, or meet other business objectives. Perform security management yourself, with the flexibility to escalate issues to an IT consultant without requiring them to come onsite. Adopt a future-friendly security platform, with instant access to new, fully integrated security services modules as they become available. How can you make sure your company s systems, intellectual properties, and customer data are secure regardless of who your employees are or where they happen to be? Sophos Cloud is the answer. More than 100 million users in 150 countries rely on Sophos as the best protection against complex threats and data loss. Sophos is committed to providing complete security solutions that are simple to deploy, manage, and use that deliver the industry's lowest total cost of ownership. Sophos offers award winning encryption, endpoint security, web, , mobile, server and network security backed by SophosLabs a global network of threat intelligence centers. Read more at Sophos Cloud Get a free trial at sophos.com United Kingdom and Worldwide Sales Tel: +44 (0) sales@sophos.com North American Sales Toll Free: nasales@sophos.com Australia and New Zealand Sales Tel: sales@sophos.com.au Asia Sales Tel: salesasia@sophos.com Oxford, UK Boston, USA Copyright Sophos Ltd. All rights reserved. Registered in England and Wales No , The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned are trademarks or registered trademarks of their respective owners GH.wpna.simple