Founder & CEO at Dynamix Solutions
Cyber hygiene refers to a set of habitual practices that organizations should employ to reduce their susceptibility to cyber-attacks.
With the average data breach costing over $3 million in 2021, cyber hygiene is more important than ever.
You may think cyber-attacks are complex, sophisticated undertakings. While this is sometimes the case, most data breaches are actually the result of basic, avoidable errors on the victim’s part.
Hackers are infamous for looking for ‘low hanging fruit’ – companies that don’t pay attention to basic security practices and therefore make themselves vulnerable to attacks.
Don’t let your company fall into this bucket. Adopt good cyber hygiene practices and stay safe.
Here’s how to get started today.
Diligent Documentation
You can’t protect your company unless you have a clear picture of your digital environment. To that end, we advise you to create a live document of your company’s hardware and software.
On the hardware front, this should include everything from laptops and company-owned mobile phones to fax machines.
Regarding software, take note of all applications that your employees use for work purposes.
Assessment of Inventory
Your documentation should be a work in progress that is updated regularly in line with IT infrastructure changes. This is what’s known as an inventory assessment.
This assessment is not just about streamlining hardware and software and removing redundancies. It’s also about reducing risks.
For example, if your company uses two communications platforms, you may choose to uninstall one, as to reduce the risks of application compromise.
Policy Synchronization
With clarification of your inventory, you can now put in place company-wide policies to ensure consistent cyber hygiene.
Consider following a framework, such as NIST’s CSF to guide your policy creation. You could also work with a managed security services provider that will create and manage your IT security services for you.
Software Defense
Often, cybercriminals try to compromise organizations via malicious software (malware).
To protect against this risk, you should put in place antivirus and antimalware software that scans your network, infrastructure and endpoints for malware variants.
Best-in-breed solutions provide automation, 24/7 protection, working in the background to discover and quarantine malware threats before they impact your business.
Remote Device Encryption
If your employees work on devices outside of the corporate network, you should implement remote device encryption to keep company data safe.
Devices to encrypt include laptops, smartphones and USB sticks.
Network Firewalls
A network firewall is a crucial security solution that works by monitoring inbound and outbound traffic on your corporate network.
Based on predefined security rules, the firewall can block or re-route traffic that it deems suspicious. Firewalls are one of the first lines of defense against cybercriminals.
Router Protection
Your WiFi network is a potential point of entry for attackers if it’s not properly secured.
Make sure to use a router with either WPA2 or WPA3 encryption. These provide the most robust WiFi protection.
You should also ensure to update the router’s password to a unique, hard to guess passphrase. This is because default passwords are often easy to guess, and are vulnerable to leakage.
Scheduling of Updates
Update schedules are another important element of cyber hygiene. These updates are also known as patches. They apply to applications and operating systems.
Regularly, application and hardware vendors will release updates that amend vulnerabilities they have discovered. Left unpatched, these vulnerabilities can be exploited by criminals.
It’s vital to install patches as soon as they are released.
Don’t rely on your employees to update their devices and applications manually. Put in place processes that update devices and hardware automatically.
Password Strengthening
Your employees should never use passwords like 1234 or qwerty.
Passwords must be difficult to guess, containing a mixture of upper, lower and special characters, plus numbers.
Passwords should also be unique to each application. To help your employees remember numerous passwords, deploy a password manager.
Hard Drive Management
Hard drives need to be updated in line with people changes. When an employee leaves your company, you will need to wipe the hard drive clean.
Another crucial part of hard drive management is putting a robust backup strategy in place.
Hard drives can sometimes fail and are vulnerable to downtime, so it’s sensible to backup critical data to the cloud. This should be part of your organization’s wider disaster recovery strategy.
Multi-Factor Authentication
In the event that a hacker gets their hands on one of your employee’s email and password details, multi-factor authentication (MFA) provides an extra line of defense.
MFA works by requiring an additional method of verification before your employee can access their accounts, such as an email link or text message.
MFA may not be available on all your applications, but consider implementing it on critical applications with sensitive data, such as payroll, HR and customer relationship management applications.
If you’re concerned about MFA hampering the employee experience, you can implement a single-sign-on solution.
Incident Response Plan
In today’s day and age, it’s a case of when – not if – you suffer a security incident.
An incident could be a small-scale phishing email or a huge cyber-attack. No matter how severe the attack, you need to have a plan in place.
This is where incident response planning comes into play. It’s a document of procedures that will guide your team on how to handle a response in a calm and timely manner.
A good incident response plan should reduce the severity of a breach, saving you time, money – and even saving your reputation.
If you’re not sure where to get started, consider working with a cyber security consultant, who can create and manage incident response planning for you.
Educate Your Users about Cyber Hygiene Best Practices
Last but not least, you need to account for the ‘human factor’ of security.
Often, cyber attacks start because an employee unintentionally clicks a malicious link or downloads a malicious app.
To that end, education is essential. You can empower your employees to identify and report threats, rather than fall victim.
Education shouldn’t be a one-off, tick-box exercise. You should aim to create a culture of security, where employees feel responsible for, and committed to, implementing security hygiene practices.
Schedule a Cyber Security Audit Today
Looking for better cyber security in Toronto or Calgary? Dynamix Solutions can conduct a thorough IT security audit and make affordable recommendations to fortify any found vulnerabilities.
Contact us today to schedule a consultation! Call Toll Free: 1 (855) 405-1087.