ultimate it security checklist

15
Ultimate 10-Step IT Security Checklist for Protecting your Business from a Breach A Publication of

Upload: qdevery

Post on 14-Jan-2015

262 views

Category:

Technology


0 download

DESCRIPTION

 

TRANSCRIPT

Page 1: Ultimate it security checklist

Ultimate 10-Step IT Security Checklist for

Protecting your Business from a Breach

A Publication of

Page 2: Ultimate it security checklist

WWW.PARANET.COM SHARE EBOOK

Ultimate 10-Step IT Security Checklist // 2

Paranet IT Consulting Services

IT is complex, managing it shouldn’t be.

IT Advisory

Network & Convergence

IT Due Diligence IT Security

Virtualization Backup & DR

http://info.paranet.com/security-vulnerability-assessment

Page 3: Ultimate it security checklist

WWW.PARANET.COM SHARE EBOOK

Ultimate 10-Step IT Security Checklist // 3

Ultimate 10-Step IT Security Checklistby Quinn Devery

Quinn Devery is the Director of Marketing at Paranet Solutions as well as the founder of DFW IT Professionals. He is responsible for Paranet’s marketing efforts and channel strategy. Follow Quinn on Twitter @qdevery or on LinkedIn.

Page 4: Ultimate it security checklist

WWW.PARANET.COM SHARE EBOOK

Ultimate 10-Step IT Security Checklist // 4

IntroductionEnterprise security is a many tentacled beast. Each time a vulnerability is patched by an anti-virus firm or IT product vendor, hackers find a new hole to stay one step ahead of the most advanced IT security professionals. In addition to this constant war between security vendors and hackers, every security solution you add to your business has an impact on agility or productivity. For example, encrypting all of the data in the enterprise would prevent many breaches, but the cost in systems performance and business operations would cripple most organizations.

All of this means there is never an end to the IT security battle, and there are no fool-proof ways to protect businesses from a breach. In most companies today, a lot rides on the data within networks, and fighting it without the right expertise is a constant challenge.

To help keep your business safe from the threats that exist today, we’ve put together a 10-step IT security checklist to miti-gate the risk of a security breach. Hackers are like thieves constantly looking to slip through an unlocked door rather than assaulting you over 10-foot fences guarded by German shepherds. Have your IT support staff or managed IT services pro-vider use this checklist to help make your organization a harder target.

Page 5: Ultimate it security checklist

WWW.PARANET.COM SHARE EBOOK

Ultimate 10-Step IT Security Checklist // 5

1. Train Your EmployeesYour IT security is only as strong as your weakest link. Train your employees to use strong passwords, to not open email from people they don’t recognize and to not click on suspicious attachments. Passwords are a big problem. In one recent study, a majority of hack attacks could have been prevented with better password practices. You need a password policy that, if it doesn’t require multi-factor authentication, at least requires users to switch it up on a regular basis.

A recent experiment showed 85 percent of mobile users connected to Wi-Fi hotspots without checking. A security expert then captured login information from all users connected to the hotspot. Here are some other scary stats:

637,965,373 passwords were leaked globally in 2012.

76 percent of people who use public Wi-Fi don’t use any security mea sures.

Page 6: Ultimate it security checklist

WWW.PARANET.COM SHARE EBOOK

Ultimate 10-Step IT Security Checklist // 6

2. Know where your data lives Do you know where all your confidential information is? You should. And, you should limit access to private or confidential data. That includes setting up tools that alert you when that data is accessed.

68 percent of businesses still use email as their main method to send and ex change large files and sensitive data.

Only 17 percent of businesses take any steps to secure company data on personal devices.

With stats like these you need to do the following checks:

Make a list of where all you most sensitive & critical data lives for your user files, application data, and backups.

Make a best effort to consolidate and centralize sensitive and critical data on file servers and in the data center

Limit and/or block applications that are not approved by the enterprise and synchronize data to a 3rd party cloud or somewhere else outside the corporate network

Page 7: Ultimate it security checklist

WWW.PARANET.COM SHARE EBOOK

Ultimate 10-Step IT Security Checklist // 7

3. Inventory your devicesTools are available that can identify and secure all devices your employees are using on your network, including BYODs. You need an inventory of everything from thumb drives to smartphones and tablets to laptops.

Smart Phones Tablets Network Devices PCs Laptops Servers

Page 8: Ultimate it security checklist

WWW.PARANET.COM SHARE EBOOK

Ultimate 10-Step IT Security Checklist // 8

4. Protect your network

You need to be using virtual private networks (VPNs) and firewalls to pro-tect your network. Today’s users want access from anywhere, at any time, on any device. That means all kinds of new security risks. With the right protocols, your employees can enjoy both flexibility and security.

Only 53 percent of IT leaders are confident their SaaS applications are secure.

35 percent of SaaS apps are not evaluated for security prior to de ployment.

Only 49 percent of businesses evaluate a IaaS provider’s security prior to deployment.

Page 9: Ultimate it security checklist

WWW.PARANET.COM SHARE EBOOK

Ultimate 10-Step IT Security Checklist // 9

5. Secure physical devicesYour business may have an open-door policy, but not when it comes to IT security. Your servers and unused devices should be kept behind locked doors with limited access.

Limit the number of employees who have physical ac cess to your infrastructure and devices

Keep track of lost keys and quickly replace physical security

Vet your managed it services provider for security poli cies and protocols

Choose a datacenter provider that meets SAS 70 II and/ or SSAE 16 requirements

Page 10: Ultimate it security checklist

WWW.PARANET.COM SHARE EBOOK

Ultimate 10-Step IT Security Checklist // 10

6. Keep your facilities safe

You probably have given thought to security access to pro-tect your personnel. The same principle applies for your IT. You don’t want strangers wandering your halls. Limit physi-cal access to areas where your IT hardware exists.

Know your office building’s security policies

Invest in key card access for employees to keep strangers out

Invest in video surveillance for your office in the case something does go wrong

Page 11: Ultimate it security checklist

WWW.PARANET.COM SHARE EBOOK

Ultimate 10-Step IT Security Checklist // 11

7. Protect your website & ensure safe browsing

Protect yourself and employees with strong anti-malware and reassure customers by using trustmarks on your website. You might be sur-prised how many more clicks you get when you reassure customers your site is safe.

Centralize anti-virus deployment, management, and policies

Deploy IPS/IDS systems for logging and threat analysis

Evaluate web-application firewalls for additional protection

Perform an annual 3rd party security assessment that includes penetration testing and external scanning

Page 12: Ultimate it security checklist

WWW.PARANET.COM SHARE EBOOK

Ultimate 10-Step IT Security Checklist // 12

8. Create clear IT security policies

Research indicates half of businesses have experienced an increase in malware at-tacks because of employees’ use of social media. Look at these stats on

53 percent of public Wi-Fi users log onto social networking sites. Are they doing so with a work-provided computer?

32 percent of public Wi-Fi users were not aware of the risks; 13 percent were concerned with the risks; only 17 percent of users knew the risks.

You’re not going to end the use of social media – your business might depend on it. However, you can set clear, written policies on how your devices may be used, and on the use and disposal of confidential documents.

Page 13: Ultimate it security checklist

WWW.PARANET.COM SHARE EBOOK

Ultimate 10-Step IT Security Checklist // 13

9. Properly dispose of end-of-life devices & documents

Management and disposal of retired IT assets is a critical element in both keeping yourself in compliance with a growing number of laws and holding data thieves at bay. You should be “digitally shredding” data from old machines and discarding those ma-chines properly. Follow recommended procedures when hiring an asset retirement vendor and work with the company selling you new technology to see if they can help take the old stuff off your hands safely.

Identify assets that hold potentially sensitive data

Wipe all end-of-life devices

Use a 3rd party for hard drive destruction of sensitive customer data

Reconcile end-of-life device disposal with asset inventory

Page 14: Ultimate it security checklist

WWW.PARANET.COM SHARE EBOOK

Ultimate 10-Step IT Security Checklist // 14

10. Screen employees thoroughlyYou should be conducting background checks on the people you hire, particularly those you are entrusting with your secure IT. You also should be limiting access to administrative IT accounts and setting up alerts whenever those accounts are used to access sensi-tive information.

Employ a third-party screening company for back ground checks and drug testing.

Make checking employee references a policy.

Develop a standard set of interview questions that hiring managers must use.

Page 15: Ultimate it security checklist

WWW.PARANET.COM SHARE EBOOK

Ultimate 10-Step IT Security Checklist // 15

CONCLUSIONA successful IT security department isn’t one that can defend any attack from any attacker. A good IT security profession-al will make their organization less of a target and focus their efforts on defending their most critical assets such as client data, Intellectual property and trade secrets.

Follow this checklist and you’ll be well prepared to protect your organization from malicious people and organizations both internal and external.

Thanks for Reading