6 Common-Sense Security Measures Every Business Should Adopt
December 27, 2012 8:45 AM
comment(s) - last by
Beware threats from both within and without; protect employee privacy; secure your networks via education
Today's workplace is a massive nightmare for information technology folks when it comes to security. But by emphasizing consistent, workplace-wide policies and by enforcing reasonable access limits, a company safeguard itself against both internal and external data loss.
Let's discuss a few keys to maintaining a secure workplace.
1. Rule BYOD, don't let BYOD rule you
Most businesses are going to let employees bring their own devices (laptops, tablets, etc.) to do work with. But holding seminars on how to keep private and workplace data is crucial.
must be managed with a clear and consistent policy, with well-defined limits to prevent your IT employees from accessing personal data.
BYOD can save costs, but poses unique privacy and security risks.
[Image Source: Andrew Hinderaker]
That way if employees do choose to bring devices and their privacy is violated, the liability will lie not with your management, but on the staff member who violated that trust. Likewise, if the employee engages in inappropriate behavior (say viewing adult videos at work) you'll have the analytics to challenge them as necessary.
2. Ban USBs, CD Burning; go to an Internal Cloud
An internal cloud is a much more secure solution than allowing employees to share and transfer files via physical media such as USB sticks or CDs. Not only can such media
, but it can also be used by a malicious employee or person posing as an employee to steal valuable trade secrets from your firm.
If your private cloud is properly designed and firewalled from the external world, it not only will allow you employees to share information more easily, it will also cut off a major source of data loss.
Banning physical media
is a smart idea and easy to do with today's technology.
3. Adopt the Latest Software
Still kicking around Internet Explorer 7? Kicking it with Windows XP? Quit it.
Old software is a security risk. If it is patched, it is often patched at a sordidly slow pace. And there's typically a lot of it lingering around here and there, so inevitably it's a highly attractive target for malware authors.
We know you loved Windows XP, but it may be time to move on. [Image Source: Microsoft]
While few businesses have the need or resources to upgrade with every single release of Windows and every single new browser release, many should put a bit more effort into staying up to date. And if you're testing software for older browsers or other older platforms with inherent security risks, be sure to isolate them from your other networks. Just ask Google Inc. (
) which saw
IE 7 test machines exploited by Chinese hackers
to steal data off its network.
Huge security risk, enough said.
5. Enforce Passphrase Use, Use Strong Hashing
Hold an employee seminar and explain how you can make a sentence into a password. A 30 or 40 character long password is very hard to break even with modern GPUs.
Like the sound of that? Do one better by also securely backing the password with the
most modern hashing algorithms
like SHA-256 or SHA-512. Combined these two techniques will make it virtually impossible to brute force your passwords.
6. Hold Education Seminars on Phishing, Spear-Phishing
Phishing -- sending malicious links inside innocent-looking email messages -- is a huge security risk for every company. Even the best password won't protect you if you go giving it to the wrong web-form. Teach your employees to watch their url bar in their browser and to avoid clicking on email links to access a site, unless they really trust them.
Beware spear-phishing, lest it compromise your employees who hold the most valuable files.
[Image Source: FBI (modifications: Jason Mick/DailyTech LLC)]
Special care should be taken to prevent
-- attempts to target specific high profile catches, such as a CEO/CTO/CFO's login information. You executives may moan and groan, but they're far to valuable to let them fall for such ploys.
Special screening of executive email can help cut down on spear-phishing threats as well. While staff obviously can't hand-screen every email message, it is practical to screen high-level management's messages for clear fraud/spam attempts.
Again a clear-cut policy to protect privacy must be enforced here, to prevent unfortunate incidents.
Following those 6 principles will take some work, but it will be worth it. After all, your firm is only worth as much as its security.
This article is over a month old, voting and posting comments is disabled
Bad ideas there
12/27/2012 2:24:00 PM
2 and 5 are just asinine.
If you make your people pick a long password, the longer or more complicated it gets, the more often they'll write it down and tuck it under their keyboard. This is even more likely with passwords that expire too quickly. Password systems that expire every 30 days, and then remember the last two dozen passwords, are so incredibly dumb. long or complicated passwords are utter stupidity. Use a second factor authenticator: keyfob, fingerprint, smartcard, or some other unique identifier. The Smartcard system is already built into both Windows and Linux. It's not hard to implement.
As for banning USB sticks and CDs, that's just not going to work. It costs money to get network storage. Many companies can't afford, especially now, to get more storage. (It took over three years of being at 95% capacity with monthly requests to employees to delete old data before my last company finally ponied to to get new storage, and all they did was double it. it was full again within a year.) When main network storage is full, many employees resort to emailing documents all over, multiplying the problem on the email system. Yes, you can 'encourage' employees to stop that and adopt safer, cleaner, more responsible methods of storage, but that's like pulling teeth, and most people will do anything to get around it. Having them use their own thumb drives is about the only way to keep them from storing their personal Quicken files and home photos on the network drive. I'm still not convinced that contracting to an outside company for "cloud" systems is a smart security move. I will never like putting my data in someone else's hands. I'm uncomfortable enough with my email going through someone else's server.
For IT these sound just fine, but the general population is stupid and lazy. They will use the company computer for their personal stuff. They will fill up their hard drive and then shunt that onto the network drive. Banning USB drives will only make that worse. They will write down their passwords. Those passwords will get picked up by janitorial staff. You're never going to get around that. Work with it and live with it and you'll be less stressed. There are strategies around much of these flaws. Charging them straight on is a losing strategy.
"A politician stumbles over himself... Then they pick it out. They edit it. He runs the clip, and then he makes a funny face, and the whole audience has a Pavlovian response." -- Joe Scarborough on John Stewart over Jim Cramer
Microsoft Raises Its Licensing Fees to Cash in on Bring-Your-Own-Device
November 27, 2012, 11:35 AM
"High Roller" Hacker Attack is Stealing Hundreds of Millions From the Rich
June 26, 2012, 3:13 PM
Bitcoin Giant Mt. Gox Promises to Change Post-Hack
June 22, 2011, 2:21 PM
Future is Uncertain for Popular .ly Domain
April 15, 2011, 8:03 AM
CDs, DVDs, Thumb-Drives Banned from SIPRNET Under Threat of Court-Martial
December 13, 2010, 12:33 PM
Tech's Tax Day Fortunate Few: Qualcomm, Xerox, GE, et al. Pay Little or No Taxes
April 15, 2015, 11:30 AM
LinkNYC Terminals to Blanket New York City With Free WiFi, Free Calls, and Ads
November 17, 2014, 6:50 PM
Microsoft is Open-Sourcing Most of .NET, Adding OS X and Linux Support
November 12, 2014, 8:27 PM
Home Depot Lost 53 Million Emails, Blames Windows, Buys Execs New Macs
November 9, 2014, 5:00 PM
Former NSA Lawyer: If Google, Apple Encrypt User Data, They’ll Wither on the Vine Like Blackberry
November 6, 2014, 12:15 PM
Report: AT&T Eyeing $40B DirecTV Purchase
May 1, 2014, 8:00 AM
Most Popular Articles
Worst Kept Secret -- $35 Million Anonymous Sharing App Startup Shuts Down
April 30, 2015, 7:33 AM
Microsoft "Welcomes Developers" to Its New "Edge Browser" (Codename: Spartan)
April 29, 2015, 7:25 PM
China's Tencent Gets in on the Kardashian Empire w/ $126 Million Glu Investment
April 30, 2015, 8:28 AM
Windows 10 Build 10061: A Quick Review
April 27, 2015, 10:57 AM
Report: Apple Pulls the Plug on Apple Watch Store Launch
April 16, 2015, 3:18 PM
Latest Blog Posts
Sceptre Airs 27", 120 Hz. 1080p Monitor/HDTV w/ 5 ms Response Time for $220
Dec 3, 2014, 10:32 PM
Costco Gives Employees Thanksgiving Off; Wal-Mart Leads "Black Thursday" Charge
Oct 29, 2014, 9:57 PM
"Bear Selfies" Fad Could Turn Deadly, Warn Nevada Wildlife Officials
Oct 28, 2014, 12:00 PM
The Surface Mini That Was Never Released Gets "Hands On" Treatment
Sep 26, 2014, 8:22 AM
ISIS Imposes Ban on Teaching Evolution in Iraq
Sep 17, 2014, 5:22 PM
More Blog Posts
Copyright 2015 DailyTech LLC. -
Terms, Conditions & Privacy Information