Cybersecurity for organizations: where to start
The question we hear most often from executives is "What do we need to buy to be secure?" In practice, though, most incidents at mid-sized organizations don't come from sophisticated hacking but from basic weaknesses that can be fixed with almost no extra investment. This article sets out what to do first, and in what order, for organizations that don't yet have a dedicated security team.
Real threats are usually simpler than you think
The patterns that come up again and again are emails that trick people into entering passwords or transferring money, user accounts that reuse passwords from other services that have already been breached, devices that haven't been updated in a long time, and former employees who can still access data because their access was never revoked.
Notice that all of these are fixed with processes rather than by buying tools. That is why starting here gives you the best return on the time and budget you spend.
1. Start with user accounts
User accounts are your organization's front door. The first things to do are:
- Turn on two-step verification for every service that supports it, especially email, accounting systems and banking
- Stop using shared accounts where several people use the same password, because when something goes wrong you can't trace who did what
- List every account your organization has and name the person responsible for each system
- Set up a procedure to revoke access immediately when someone leaves or changes roles, and check back for any old accounts that are still active
2. Backups are your last line of defense
When a ransomware attack hits, the only thing that saves an organization from having to give in is a backup that can actually be restored.
The rule to follow is to keep at least two copies on different types of media, with at least one copy kept separate from your main systems and not left connected all the time, because backups on the same network are often encrypted along with the main data.
Just as important, you need to test real restores regularly, not just check that backup files exist.
3. Keep systems updated and deal with end-of-life devices
Most vulnerabilities exploited in attacks are ones for which patches have already been released but not yet installed. Setting a clear update schedule for operating systems, browsers and the software you use is therefore basic work with a high payoff.
Another area that is often forgotten is network equipment the manufacturer no longer supports, such as older routers or CCTV cameras, which will never receive another patch. These devices should be inventoried and scheduled for replacement.
4. People are the first line of defense
No tool can protect you if an employee, acting in good faith, types their password into a fake web page. Effective training doesn't need to be long, but it should use real examples that feel close to home, such as an email impersonating an executive and ordering an urgent money transfer, or a fake invoice with changed bank account details.
Alongside this, set a verification procedure before transferring money or changing a payee's account number, with confirmation through a different channel, not a reply to the same email.
5. Have a plan ready before an incident happens
The questions you should be able to answer in advance are these: if you turn on your computer tomorrow morning and can't open your files, who is the first person you call? Who has the authority to order systems cut off from the network? And how will you communicate with customers?
The plan doesn't need to be long, but it must include a contact list that actually works, kept somewhere you can reach even if your main systems are down. It should also specify which kinds of incidents must be reported to regulators or to the people whose data is involved, as required by law.
A checklist for the first 30 days
- Turn on two-step verification for email and financial systems
- List all user accounts and close any that no longer have an owner
- Check that your most recent backup can actually be restored
- List devices and software that haven't been updated or are no longer supported
- Set a verification procedure before transferring money or changing a payee's account number
- Write down your emergency contacts and keep a copy outside your systems
These six steps don't take much time or require a large investment, yet they close off almost all of the routes through which real incidents happen. Once the basics are solid, you can then consider specialized tools based on the risks your business faces.