Cyber Security Awareness Month

October is cyber security awareness month, this is a global initiative to raise awareness around the importance of cyber security for individuals and businesses. Some small and medium Australian businesses may think ‘No one is going to target my business’ or ‘I’m too small to be a target.’ But that simply isn’t the case.

More and more Australian businesses are being targeted, especially those that deal with financial or personal data. Untargeted attacks are also prevalent, all it takes is a team member to click a wrong link or give their password to a suspicious website.

This year’s theme is ‘Be cyber wise, don’t compromise’. In line with this we want to cover some important fundamentals that small and medium businesses can take to better secure themselves in this everchanging threat landscape.

Check your patching status with your IT team

Patching your Endpoints, Servers, NAS’s, Phone Systems and other devices is a crucial first step to securing your environment. While zero day’s exist (Attacks unknown to the vendor of the software and not yet fixed) ensuring your fleet of devices are patched correctly and up to date provides a strong baseline of security.

At FordhamIT we use a comprehensive patch management and compliance solution. Our system manages and controls the patching for all of your endpoints. We ensure all updates are applied and installed correctly across your fleet. It also allows us to manage and control patches that may cause issues with your systems.

MFA Everything

You’ve heard it again and again, Multi Factor Authentication. This involves using a second form of identification when logging into systems and services. This can include:

Hardware Security Keys
Biometrics
Authenticator apps
Time-Based One-Time Password (TOTP)
Email and SMS tokens

It is important to use strong MFA methods. Email and SMS codes are now considered less secure methods of verification. However, if this is the only option, it is better than no MFA.

Ideally use TOTP at a minimum and aim for Biometric or Hardware security keys. We can help you plan and deploy Hardware Keys across your business to strengthen your security posture.

Strong Passwords and Passphrases

The most secure option here is to use a password manager. Password managers not only allow you to save all your passwords in a convenient location, but they also enable you to automatically create strong and secure passwords. Password managers include password generators to create strong and random passwords, it means you don’t have to think of a password each time you create a login for a service. This helps reduce password reuse.

At FordhamIT we can implement an enterprise grade password manager for you and your team. These password managers allow team members to store passwords in their personal vault, you can then share passwords securely across your teams. This eliminates the need for password lists and sticky notes.

These solutions include dark web monitoring for your passwords. Your passwords will be scanned and if they have been exposed in a breach or on the dark web, you will be alerted and can take action accordingly to protect your organisation.

You also gain valuable insights and logging to enable auditing and verification of who is accessing what data in your password manager. You can also get a business wide overview of the strength of your passwords and see if anyone is at risk.

If you are creating passwords manually, consider using a passphrase. These are more like a sentence but remember to still include a range of characters and symbols.

Updating Software

Similarly to patching, it is crucial to update your software. Using old, unsupported or out of date software puts your devices at risk and can leave vulnerabilities and security holes open. It’s important to have a system and process in place for updating critical software.

At FordhamIT we automate and manage the updates to a wide range of software. Software such as Microsoft 365, Google Chrome and Adobe, just to name a few. We deploy and ensure updates are applied company wide, keeping your devices updated and secured.

Reduce Phishing Risk

BEC (Business Email Compromise) is still one of the most prevalent initial access points for attackers. Training and awareness are critical for your business and team. You should keep a healthy level of skepticism when reviewing any emails. Threat actors are crafting more and more sophisticated emails every day. They use tactics such as:

Creating a sense of urgency
Fake email or non-matching email address
Using generic introductions “Hello User”
Suspicious links that on hover show a strange web address
Grammar and spelling errors
Fake or unknown attachments (.exe, .html, .htm)

At FordhamIT we can implement solutions to reduce the amount of Phishing that reaches your inboxes. Many of these options use AI and Machine learning to weed out sophisticated Phishing emails.

Further options include Security awareness training which teaches your staff what to look out for, they can also send fake Phishing emails to test your staff. These allow you to get an overview of where your business’s security posture sits.

Endpoint, Identity and Local Admin Access

While it may make things ‘Easier’ to give employee’s local admin access, it also makes it much easier for attackers to gain access to your systems. With the shift to the cloud and away from servers onsite, many businesses neglect the need for identity and computer management.

Microsoft offers solutions to manage and control access to your endpoints. For MacOS devices there are 3^rd party solutions that achieve the same level of user management. At FordhamIT we can leverage these solutions to secure and manage your devices and identities. They also allow for pushing policies to secure and harden your devices security.

The next level is Application Control. Long considered the gold standard for security and protecting businesses from known and unknown threats; Allowlisting adopts a “Deny by Default” approach. Unlike Antivirus software, allowlisting controls what software, scripts, executables, and libraries can run on your devices. This means that only items on the “allowlist” are permitted and everything else is blocked. This not only stops malicious threats but also stops unwanted or unapproved software installs.

People and Processes

As we always say, people are your first line of defense. Software and security controls are essential, but it is the people who secure your business. It so important to foster a culture of Cyber Security in your business. Make it part of your day to day and have conversations with your teams about IT and security. Something as simple as a suspicious email, should be sent to your internal or trusted IT partner. It may be a quick check, but it could prevent a lot of issues.

At FordhamIT there are no silly questions. We encourage our clients and their teams to come to us with any questions or concerns, no matter how small. Through the relationships we foster with our clients, we are able to provide knowledge and guidance to staff giving them the confidence to work securely.

Wrap Up

Cyber Security isn’t just for big business. At FordhamIT we give small and medium businesses the level of service that big business gets. This continues into our security and planning. By taking a holistic overview of your business, we secure from the ground up. We make sure you get the fundamentals in place and ensure a good security baseline. If this article has raised any concerns or thoughts about IT and Cyber Security in your business, let us know. We’d love to have an initial conversation with you about how we can help you achieve your security and IT goals.