• Last year one in ten Australian companies suffered an IT breach.
• Since February 2018 The new Australian Data Breach Laws can issue fines of up to $2.1 million for those companies who don’t properly notify their customers of a loss of data.
With that said, here are my 8 Essential Cyber Security Best Practices to help keep companies safe.
1. Endpoint Security
Endpoint Security is a pretty broad term so let’s clarify.
• Windows / MacOS / Linux Device Firewalls – Make sure they are enabled!
• Office Perimeter Firewalls / Cloud Based Security Groups – Only open required ports in and out of the firewall or security Group- ideally to (or from) specific IP addresses only.
• Email Spam Protection Controls – Office 365 / G-suite, configure and enable spam protection policies, if possible use Email Gateway service with Machine Learning for better security.
• Antivirus and Anti-Malware Software – On all Windows AND MacOS devices with regular scans.
• Network Security – Wireless networks secured with strong password – minimum WPA2/WPA3, ideally authenticated centrally. Guest networks with internet access only for guests.
2. STRONG AUTHENTICATION
Passwords
Consensus thinking has changed. Minimum 10 characters, non alphanumeric / numbers doesn’t really matter, different password for each service for isolation.
Multi Factor Authentication
All your accounts, both work and personal should be secured by MFA where possible. Authenticators – NOT SMS where possible.
3. data protection
Mobile Device Management
Setup policies to enforce data protection and allow remote wiping company data. Office 365 and G-Suite already have built in MDM you can configure.
Encryption
Data should be encrypted in transit and at rest.
4. PATCH MANAGEMENT
Enforce regular Software updates on all your devices to prevent hacks. Good patch management software is not expensive – get some.
5. LEAST PRIVILEGE
Least Privilege / RBAC (Role Based Access Controls). Give your users the ABSOLUTE minimum access they need to do their job. Create roles with permission and assign roles to users.
6. backup
Point in time and offsite so you have BCP (Business Continuity Planning) in case you have main site loss.
Backup your server / process configurations and documentation.
7. supply chain security
Ensure your suppliers are compliant. The big vendors will have a page dedicated to this, send out annual audits to your smaller suppliers. Cloud vendors have a Shared responsibility model – just because THEY are compliant, doesn’t mean what you build on their cloud is.
8. Cyber Insurance / Cyber Awareness Training
Train your users to make sure you minimise risk! There are great services out there you can use. Have insurance in case things go wrong.
With multiple certifications in Cyber Resillience, AWS and azure, we can help you implement all of these best practices to ensure the safety and security of your business.
Related Articles
Exxa Home
Managed IT Services
Why choose a managed service provider to do your IT?
Need some help with your IT infrastructure but not sure where to start?
Get a free consultation and IT Audit.