We’re increasingly hearing from organizations that need to establish that they have sufficient security policies in place, either to meet the requirements of a larger client or to qualify for cyber insurance that insures against breaches and similar losses. Details vary, and we’re happy to work with you on the specifics, but here are some of the kinds of questions you may be asked. Of course, if you don’t have to prove that you’re doing the right thing to some other company, answering these questions for yourself can only improve your security readiness.
Do you enroll all organizational devices in a device management solution?
With device management, an IT department or managed services provider (MSP) maintains oversight and control over all organizational devices. That’s helpful for automating configuration and deployment, providing secure access to organizational resources, ensuring consistent security policies, managing app and operating system updates, tracking device inventory and status, and much more.
Do you have an organization-wide backup strategy with offsite backups?
Regular backups — some stored offsite — are essential if you need to recover from lost or stolen hardware, a natural disaster, or a ransomware attack. Even though ransomware isn’t currently a major problem in the Mac world, it wouldn’t hurt to start creating immutable backups using “write once, read many” tape or something like Retrospect’s Cloud Object Lock, a technology that ensures that cloud-based backups can’t be corrupted. Finally, have you tested restoration and recovery of key systems from your backup data Backup is important, but only if you can restore.
Do you have a policy for updates?
It’s essential to install security-related updates to operating systems and major apps, but how quickly that happens has to be weighed against problems that version changes can cause for important workflows. There’s no right answer here, but you want to make sure that you aren’t leaving your organization’s apps and devices vulnerable to known security exploits for longer than necessary.
Do you have a strong password management policy?
Short, easily guessed, or cracked passwords are one of the primary ways attackers breach corporate networks and systems. At minimum, your password management policy should require that all passwords be stored in a password manager, new passwords be generated by the password manager and meet minimum requirements for strength, and two-factor authentication be used when available.
Do you use an endpoint protection platform?
Endpoint protection is essentially software aimed at preventing and detecting malware on employee workstations, often with an organizational dashboard and management capabilities. Although the Mac doesn’t have nearly the exposure to malware that Windows does, it’s still important to keep computers free of malware that could hurt performance, exfiltrate data, or provide an entry point for future attacks. Endpoint protection is usually part of a larger managed systems approach that can also ensure that devices adhere to security policies like full disk encryption, run only approved software, stay up to date with security updates, and more.
Do you have a list of sensitive data on your network?
Exactly what counts as sensitive data will vary by organization, but anything related to network and corporate security qualifies, as does any personally identifiable information you may hold about or for clients. It’s not uncommon to store information about people that includes names, email addresses, phone numbers, and postal addresses, but you should be even more careful if you store Social Security numbers, credit card numbers, driver’s licenses, passports, financial records, or medical records. Knowing what you have is the first step; after that, consider what additional precautions you should take to protect such information.
Do you provide periodic anti-fraud and security training to employees?
Social engineering is another common way attackers gain access to corporate networks and systems. Does your organization require that all employees take regular training to learn how to identify phishing attacks, require appropriate approvals for unusual transactions or access requests, and report suspected incidents to the necessary people? If an administrative aide in the accounting department gets an email request from the CEO to pay an urgent invoice to a new vendor, will that person know how to respond?
Do you allow access to organizational email and systems from personal devices?
It’s tempting to allow users to access their email from personal devices or to have contractors use their personal email addresses for work communications. Since your organization can’t enforce software updates and install security software on personal devices, you should think twice. At a minimum, establish a policy that personal devices used for work are to be kept fully up-to-date with app and operating system updates. We recommend keeping as clear a line as possible between work and personal devices and accounts to reduce the security implications of such mixing. Particularly when there’s sensitive information in play, personal email addresses should never be used for work communications, and if personal devices are being used, they should be set up with two-factor authentication for organizational logins.
Do you have incident and disaster response plans?
Bad things happen, and it’s important to consider how you would respond to different types of security incidents and natural disasters. How will your organization maintain crucial business operations, communicate with employees, coordinate with partners (insurance, legal, PR, and clients), and more? Is your plan written down and updated regularly? Have you tested key aspects of your plan?
We know there’s a lot to think about regarding security in today’s world, and we’re always available to help if you’d like assistance answering any of the above questions.
(Featured image by iStock.com/Bulat Silvia)