The 8 Essentil Lyers of Smll-Business IT Security While there is no technology tht cn gurntee your network is truly impenetrble, you cn significntly reduce your risk by deploying multiple lyers of defense. This pproch provides two key benefits: first, ech lyer ddresses specific (nd in some cses overlpping) thret vectors; employing them ll provides the most comprehensive coverge. Secondly, using multiple lyers of defense mkes you less ttrctive trget. You re hrder to brek into thn other orgniztions whose defenses re not s robust. Here s n nlogy: Suppose you re burglr ssessing which house to brek into. House A s exterior is well-lit. There is no shrubbery or other obstruction obscuring the front door, which hs two locks, one well-mde dedbolt. There is prominent sign tht the property is protected by security service. From inside the house you her the deep, throty brk of very lrge dog. Tired of IT hssles? Let Nimble Systems tke them off your shoulders! We hve been providing relible, effective, secure IT to smll businesses in SE Michign nd northern Ohio for over 13 yers. At House B, right next door, there re no exterior lights. Lndscping or other structures obscure the front entrnce. The front door is secured by single lock, nd it s not dedbolt. There re no sounds coming from inside the house. You snek round to the bck, nd find tht the sliding ptio is even less secure thn the front door, nd cn esily be jimmied. Which house will you choose to burgle? Your stisfction is gurnteed or your money bck. Nimble Systems offers limited number of free consulttions Most hckers re looking for esy trgets. If you re hrder to hck, tht gives them n incentive to look elsewhere. ech month. Cll 734.997.7145 tody to reserve yours. You ve nothing to lose except your IT hedches! 1
The 8 Essentil Lyers of Smll-Business IT Security The 8 essentil lyers Here re the eight lyers of defense tht ny smll business cn nd should deploy: The physicl lyer A well-configured LAN Emil filtering Anti-virus nd nti-mlwre softwre Up-to-dte operting systems nd pplictions Smrt IT policies Verified, complete bckups Educted, vigilnt stff 1 The physicl lyer is pretty obvious. Presumbly, you hve tken steps to secure your office fcilities. But we find some smll businesses overlook these potentil risks: Is ll of your telecommunictions equipment inside the fcilities you control? Probbly not t minimum, your demrc (the plce where phone lines connect to your provider s) is most likely not, unless you occupy n entire building. Your phone switch my be inside closet in public hllwy, long with your brodbnd modem. Is ccess to these devices controlled (e.g. behind locked door or in locked cbinet)? In our prctice we hve severl clients who sublet prt of their fcility. If you do tht or re in n re where breking nd entering is concern you my wnt your core on-premise resources (like your server, bckup pplince nd key network devices) locked up. Don t neglect your trsh. Be sure you re shredding ll printed mteril tht contins user informtion. Even simple emil ddress cn be wy in for hcker. 2
The 8 Essentil Lyers of Smll-Business IT Security 2 A well-configure LAN is one tht is designed to isolte you from others: It s protected by properly-configured, enterprise-grde hrdwre firewll tht s not more thn 4 or 5 yers old nd for which you hve wrrnty/support contrct. If you shre your network with other tennts, your ccess nd trffic is seprted from theirs; you cn t see or ccess their network, nor they yours. You hve seprte (usully wireless) network for guests. After ll, you cn t be sure how well protected nd clen their devices re, nd you don t wnt them lunching nything infectious into the network you rely on for your opertions. 3 Emil filtering is essentil: emil is the vector for phishing ttcks, nd you wnt to try to keep ny of it from reching users inboxes. No smll business should be filtering their emil on-premise: Up to 80% of emil trffic is stuff you don t wnt junk emil, phishing scms, etc. Why hve ll tht stuff clogging your bndwidth? By filtering in the cloud, you keep most of tht from ever hitting your network perimeter. It tkes lot of work to mintin your own emil filters. Why bother when there re good cloud services tht re very ffordble? (Our emil filtering is just $2.25/user/month, nd it ctches 99%+ of rogue emil, with the industry s lowest rte of flse positives.) Most business-grde hosted emil solutions include competent filtering. 3
The 8 Essentil Lyers of Smll-Business IT Security 4 Anti-virus nd nti-mlwre softwre. Anti-virus softwre ws born to protect you from mlwre embedded in files nd emil; while these products re becoming more robust, you should still supplement your nti-virus softwre with product specificlly designed to prevent infections you cn get when you surf the Internet. Be wre tht not ll products re equl. Further, you cn t just instll them nd forget bout them if you wnt them to be n effective lyer of defense: The softwre needs to be properly configured to provide relible protection. Both nti-virus nd nti-mlwre softwre depend on regulr updtes to their definition files to provide protection ginst new kinds of mlwre, which pper constntly. If your definitions ren t updting, you won t be fully protected. Mny progrms quit updting definitions, or restrict other functionlity, if your subscription expires. You should hve regulr, preventtive scns scheduled nd mke sure tht users llow them to complete. The best protection comes from products tht cn be centrlly mnged nd monitored. For exmple, Nimble Systems provides mnged nti-virus nd nti-mlwre softwre s service; your licenses never expire, nd we monitor definition updtes nd scheduled scns. Finlly, don t neglect your mobile devices. Cybercriminls hve begun to trget mobile devices like smrt phones. Most mobile service providers offer free nti-virus pps nd you should use them. Stff should be trined on how to void instlling infected pps. 4
The 8 Essentil Lyers of Smll-Business IT Security 5 Softwre updtes re n oft-overlooked lyer of your defenses. Operting systems, utilities (like Jv, Flsh, nd Adobe Reder), nd key ppliction softwre ll need to be ptched regulrly. Most ptches re relesed to eliminte security vulnerbilities, nd if you don t pply ptches, you ll remin vulnerble. You my think you re doing this, but we often see these lpses: User computers re set to downlod nd utomticlly instll Windows updtes, usully in the wee hours. This sounds gret, but if your users regulrly turn off their computers t night, the updtes won t instll s scheduled. Users ignore prompts to instll updtes, becuse it disrupts their work dy. So they keep putting it off nd re soon fr behind. Appliction nd/or utility softwre is overlooked. You updte Microsoft Windows nd Microsoft Office, but you neglect your utility softwre (Adobe Reder, etc.). Although there my be resons not to updte ccounting or industryspecific pplictions, the decision to forgo updtes should be resoned one. Mny smll businesses re negligent bout upgrding softwre to new versions; if you re n older, unsupported version there my not be ny new updtes t ll. Any vulnerbilities tht exist will remin until you upgrde to current version. The best wy to keep softwre up-to-dte is to subscribe to mnged mintennce services. Your IT provider tkes responsibility for updting softwre, monitors your ptch sttus nd softwre versions, nd intervenes if/s needed to keep you protected. 5
The 8 Essentil Lyers of Smll-Business IT Security 6 Security-oriented IT policies re nother lyer tht smll businesses often neglect. At minimum, you should hve policies in your employee hndbook tht del with these specific sources of security risk: Wht uses of compny-owned equipment, softwre, nd network ccess re cceptble? Given tht user cn get mlwre on even well-known sites like Yhoo, Disney, nd Fcebook, you my wnt to restrict users to visiting only sites tht re necessry to their job function. You my wnt to prohibit them from downloding nd instlling softwre without prior permission. (In fct, you my even wnt to configure computers so they cn t.) You my wnt to prohibit them from shring mobile devices you provide with fmily members or using them for personl business, becuse ny of these uses increse the chnces tht the device becomes infected. You should hve BYOD ( bring your own device ) policy. Wht compny dt cn be stored on employee-owned devices? Wht hppens to dt on these devices if one is lost or stolen, or if the person s employment is terminted? My employees use personl emil to conduct compny business? Wht kind of protective softwre must employeeowned devices hve to be llowed on your network? (You my wnt to hve employees instll your corporte solution on personl devices they use to conduct your business.) You should hve policy on use of cloud services. You my be surprised to lern how mny employees hve lredy put your dt on Drop Box or other cloud storge services in ccounts you didn t crete, don t know bout, nd don t control. 6
The 8 Essentil Lyers of Smll-Business IT Security You should hve policy ginst shring personl ccess informtion like psswords or posting it in ccessible plces. (Bnish those Post-Its on peoples monitors!). Your policy should encourge the use of strong psswords nd provide guidnce for how to construct them. 7 Bckups, bckups, bckups! We cn t sy it often enough. Bckups re key to limiting the dmge from mny kinds of cybercrime. To recover from some of the worst infections like Crypto-mlwre, which irrevocbly encrypts your files you ll need to restore dt from bckup, unless you d rther procure Bitcoin to py $500+ rnsom. Here re weknesses we often find in bckups when we perform ssessments: Bckups re not being monitored nd it turns out they re not ctully working s intended. You should hve wy ech nd every dy to know whether your bckups were successful or not. You should perform periodic test restores to mke sure tht you relly cn retrieve files from your bckup pplince or cloud bckup. (Nimble Systems monitors bckups dily on mchines under our mngement, nd we preform test restores multiple times throughout the yer.) Dt on user devices hve been overlooked. Dt on servers is bcked up, but some importnt dt reside only on user computers nd those re not bcked up. This is prticulrly true of mobile devices: becuse they re not lwys on your network, it tkes more thought to mke sure dt they contin is bcked up. 7
The 8 Essentil Lyers of Smll-Business IT Security Bckup coverge is no longer comprehensive. Every time you instll new softwre, set up new computer, put dt in the cloud, or mke other significnt chnges to your environment, you should be thinking bout the implictions for ssocited chnges to your bckups. And even if nothing chnges, it s prudent for senior mngement to review wht s being bcked up t lest nnully. 8 Educted, vigilnt stff is perhps the most oftoverlooked yet perhps the most vitl lyer of your defense ginst cybercrime. Your users re on the front line. They re the ones who mke decisions every dy, decisions tht could ffect whether your orgniztion becomes victim or not. Should this prticulr emil one tht slipped through your filtering--be opened? This bnner clicked on? This pp downloded? If your users ren t trined in how to spot suspicious emils, how to surf s sfely s its possible to surf, how to construct secure pssword, nd countless other things, then they cn t mke good decisions. Further, every user should know to whom they should report nything suspicious, nd wht to do if they think they my be infected. No user should ever be mde to feel bd bout rising n lrm, even if it turns out to be flse one. 8
The 8 Essentil Lyers of Smll-Business IT Security Tht s lot to hndle, yes? Indeed, stying secure cn feel overwhelming, nd the consequences of not being secure dunting. Tht s why concern bout security is one of the min drivers tht leds smll businesses to explore outsourcing some or ll of their IT mngement: putting it in expert hnds helps you sleep t night. We ll close with two very importnt points: 1. It s dngerous to be nïve. Don t think becuse your business is smll, cybercriminls re not interested in steling from you. Victimiztion of smll businesses doesn t get the press tht ccompnies hcks of lrge, well-known orgniztions, but don t mistke lck of publicity for lck of risk. The risk is very, very rel. 2. Even if you hire Nimble Systems or someone else to do everything possible to secure your IT, no one cn to gurntee tht you won t be victim of cybercrime. The technology does not exist to crete n impenetrble network. So if nyone tells you they cn give you such gurntee, we recommend you run wy fst, becuse they re trying to sell you modern-dy snke oil. Wht Nimble Systems cn do is substntilly reduce your risk by mking sure you hve ll 8 essentil security lyers in ply. Becuse we hte cybercrime s much s you do, Nimble Systems offers limited number of free security ssessments ech month. To reserve your slot, contct us t 734.997.7145 or visit www.nimble-systems.com nd click on Support. Nimble Systems Miling Address 3915 Reserch Prk Drive Suite A-13 Ann Arbor, MI 48108 Phone: 734-997-7145 Fx: 734-786-1239 Emil: info@nimble-systems.com Web: www.nimble-systems.com 9