Five regular checks for SMBs

[Bot]

Your company’s security is in your hands

It is not always economically viable for small and medium-size businesses to maintain a dedicated IT security team, so it often happens that one person is in charge of monitoring the entire infrastructure. Sometimes he or she is not even a permanent, full-time employee.

Here are our Top 5 regular checks.

1. Renew the corporate site security certificate
   • Any website that requests or processes user data must have an SSL certificate. It protects information entered by visitors from being intercepted, and almost all modern browsers warn users that sites without an SSL certificate are insecure. That can scare off potential customers.
   • Your website most likely has an SSL certificate, but its validity period is limited. Depending on the certification authority, it will need to be reissued every three, six, or twelve months. Therefore, we recommend setting a reminder in your calendar about certificate renewal.
2. Update router firmware
   • The older the software, the more likely it is to contain vulnerabilities, so it’s critical to keep all software up to date. Workstation operating systems and applications themselves usually notify users when updates become available to install. But if you’re still worried about missing an important patch, use our corporate products, which contain an entire subsystem for tracking fresh vulnerabilities and fixes for them.
   • That said, it is not only employees’ computers that need updates. Routers also have built-in software — firmware — which over time likewise becomes outdated and vulnerable. Cybercriminals can then exploit the old firmware to infiltrate the corporate network. Unlike software on workstations, SOHO routers generally do not send notifications when the firmware is out of date, so updates have to be done manually.
   • Therefore, it’s important to inventory all corporate network equipment, and at least every couple of months check the administration console to see if a new version of the router firmware has appeared. If the console has no function to check for updates, you need to do it yourself on the manufacturer’s website. And if some devices are outdated and no longer supported, you should think about replacing them; vulnerabilities in such models will remain unpatched forever.
3. Revoke unnecessary rights
   • A dismissed employee can cause all kinds of trouble if their accounts and access to the corporate network are not closed in time. Cyberrevenge against former employers is real. To avoid a similar situation, make it a rule to revoke all access rights immediately after dismissal.
   • In addition, regularly audit all accounts and their permissions. It can happen that a person remains in the company but moves, say, to another department, where they no longer need some access rights but no one remembered to revoke them. Any unnecessary privileges can prove costly in the event of a cyberattack.
4. Back up
   • Backing up your data helps protect it from wipers, ransomware, careless employees, and other hazards. You can back up manually, but it’s better to schedule an automatic backup so as not to clutter your calendar with reminders.
   • That said, even if your company’s backups are automated, you should periodically check your data storage. Are the backup programs running smoothly? Is the storage address correct, or did someone sneakily change it? Do you have enough space for all of the data? Are the storage devices acting up? Modern data storage devices use S.M.A.R.T. technology to diagnose their own problems and predict how long they will survive. The technology analyzes the status of disks and reports issues.
   • If you store backups in the cloud, check the settings periodically and buy additional space before you need it.
5. Update antivirus licenses on servers
   • Security software on workstations and mobile devices won’t let you forget about subscription renewal. But don’t forget about servers. An unprotected server can cause a range of problems — from data leakage to hosting malicious resources in your infrastructure to turning your office into a cryptofarm. Set a repeating reminder in your calendar to update server protection.

Source:

Five regular checks for SMBs

Five things that, if neglected, can cost SMBs dearly.

www.kaspersky.com