Cybersecurity can no longer be an afterthought in the current scenario. Andrew Gibson, Solutions Engineering Consultant at STANLEY Security emphasizes good cyber hygiene practices matter in order to protect your company from cyber threats. You can start protecting your assets and customers by implementing these eight essential cyber hygiene tips.
Companies large and small face the same cybersecurity challenges. But building your security team and deploying the right features to protect your operations can be equally challenging. Plus, with more employees working from home than ever before, companies have a pressing need for top-notch cyber hygiene throughout their operations.
Even if you’re new to cybersecurity, your company can start protecting assets and employees from cyber threats by employing essential cyber hygiene practices. Developed by the Australian CybersecurityOpens a new window Centre, the Essential EightOpens a new window are the most crucial strategies to protect your business. These basics form the foundation of your cybersecurity policy and can help you mitigate potential risks and promote cyber hygiene practices.
1. Whitelist Business-Critical Applications
Your business and its departments use a suite of specific applications in its daily operations. This collection of trusted applications makes up your company’s whitelist.
You should identify those critical applications Opens a new window and how your staff uses them. With that information in hand, you can deploy tools to allow only approved applications to run on your system. These tools can also block access to non-approved applications that could hamper your system’s performance or security, such as entertainment or gaming sites.
2. Patch Applications
Set a regular cadence to review your whitelist and to process application updates and patches. Software companies constantly uncover new product vulnerabilities and release patches to fix them. It’s your responsibility to keep your applications updated to reduce the risk of cyberattacks.Opens a new window
When reviewing your whitelist, focus on the most pressing updates first. Major vulnerabilitiesOpens a new window should be addressed as fast as patches are released. Outdated applications should be removed from your whitelist until they’re made current with fresh patches.
3. Deploy User Application Hardening
While you’ve approved specific applications, that doesn’t mean they’re always being used appropriately. Review what employees do with applications to ensure they’re only being used as intended. This user application hardeningOpens a new window process can help block malware or other cyber intruders.
Web browsers are one weakness I commonly see in cyber hygiene plans. Browsers often deploy add-ons and plug-ins like Flash and Java or toolbar extensions to simplify work. These add-ons carry their own vulnerabilities and can let intruders circumvent your other protections. To limit your exposure, research which extra features belong in your browser.
4. Vet Microsoft Office Macros
Malicious code can also slip into your system through productivity tools like Microsoft Office. These programs typically run macros to expedite certain functions. They also pose a risk if unvetted macros enter the system, where they can open the door for other cyber attacks.
Vet which macros need to run and which could pose potential hazards. Ensure any macros your company uses were downloaded from trusted and vetted sources. You should also consider disabling most macros by default to reduce your risk Opens a new window profile.
Learn More: How to Securely Scale Insider Threat Management Without Putting Data at Risk: CTO ViewOpens a new window
5. Restrict Administrative Privileges
For any system within your company, you should separate regular user access from privileged or administrative access. Higher-level controls pose a larger security riskOpens a new window , especially if they’re used often and left exposed to cyber-attacksOpens a new window . You should implement tight control and regular auditing on who has administrative privileges and how often they’re used.
This creates a layer between the activities regular users conduct, such as reading emails or browsing the internet, and the administrative tasks requiring elevated permissions, like patching a workstation. While switching accounts for work tasks isn’t as convenient, it ensures admin credentials are less exposed to online risks.
6. Patch your Operating System and Hardware
Just like you have an inventory of approved applications in your whitelist, you should also have a regularly updated inventory of company hardwareOpens a new window . This includes devices like workstation and laptop computers, servers, security cameras, printers and other peripherals. Each device also runs firmware that manufacturers often update with security patches.
You should also track firmware versions for each device in your inventory to know which devices need updating and when. Automated tools exist to enable consistent updating and inventory management to assist you.
Learn More: How to Maintain AWS Cyber Hygiene in Quarantine EraOpens a new window
7. Implement Multi-factor Authentication
Many applications now offer multi-factor authentication (MFA) as extra security for user credentials. Since gaining access to user credentials is one of the most common ways cyber attackersOpens a new window breach systems, MFAs as another step in the login process can limit exposure from this often-exploited avenue.
While some users might find MFAs like SMS codes, securityOpens a new window questions or biometrics Opens a new window to be cumbersome, MFAs are a vital part of protecting your business’s system. Your employees are also already likely familiar with MFAs from their personal lives, as email systems and banking applications often use MFAs. Most applications make setting up MFAs easy and afford a great deal of security in the process.
8. Backup Your System Daily
Sometimes, despite the best preparations, a company’s system is exposed to cyber-attacks. When that happens, you want to have backups to restore your system and mitigate damage from an attack. Backups should occur daily to limit potential losses should an attack occur.
While you can perform system backups Opens a new window on your own, consider an automated solution. Many applications include automatic backup processes and allow you to schedule them at your preferred cadence. Also, ensure your data backup structure enables you to recover your system post-attack and resume normal operations as quickly as possible.
Implementing these cyber hygiene strategies will help you improve your organization’s cybersecurityOpens a new window and mitigate the many risks your company faces. With the number of available tools and automated solutions, your company can easily deploy these initial steps and then expand with other solutions to fit your needs. Wise investments into your company’s security can ensure you protect your assets and customers from cyber risks and empower your employees to help complete your company’s protection.
Let us know if you liked this article on LinkedInOpens a new window , TwitterOpens a new window , or FacebookOpens a new window . We would love to hear from you!