2018 Cybersecurity Review
It’s our 2018 Year-End Cybersecurity Review!
It’s not quite the end of the year, but it’s time for our 2018 Year-End Cybersecurity Review.
As 2018 winds down we all start to reflect on what happened over the year in our respective organizations. It’s only natural for a business to look to the past to see what can be done better in the future. While some industries might see modest fluctuations from year to year, changes to the IT landscape affect businesses across industries.
Much like 2017 with its predictions and realizations of ransomware attacks, 2018 continued this trend with increasing warnings about breaches. The not-so-fun thing about being right and these predictions coming true is that a lot of small-to-medium sized businesses were the targets and victims of cyber criminals.
It’s easy to see the big companies or cities being hit and thinking that it’s not going to happen to you. Being in the MSP (managed IT service provider) arena, we see how these types of warnings affect a wide range of businesses and also know that size doesn’t matter. We see our clients being targeted regardless of industry and size.
The Intersection of IT and Security
The most valuable lesson learned in 2018 has been that the boundaries between IT services and cybersecurity have merged. IT Service providers have to be able bridge the divide between the two and provide both services. Those companies that don’t make the connection will be left behind.
Providing both good IT management and security is possible, but it does take added expertise. Bolting on products to existing solutions and hoping that a system is safe is not enough. Best practices mean that certified security personnel that are separate from the IT realm analyze the security aspects of the network. The first step is realizing that security has to be center of any service or solution and not an afterthought.
As organizations had to adjust to the changing IT landscape, so have outsourced IT providers. Unlike some small to medium sized businesses that don’t have the adequate resources, security-focused IT providers are equipped to manage this merging of IT and cybersecurity. Link High has made the investment in a separate Information Security division that works in conjunction with our Technical Services team to provide security-centric IT solutions and services.
Put simply, this means we review all our solutions to make sure security is at the center of all our statements of work, and that processes and procedures are security-centric in design.
How an MSP/MSSP can Up its Game in the Changing Cybersecurity Landscape
Link High Technologies was honored to be selected to the CISO Think Tank peer group. This select group meets throughout the year and consists of other security minded IT service providers from across the county. Instead of working in a vacuum, Link High gets to share best practices with some of the top IT Service providers in the country and meet best in class security vendors to fill in our security gaps.
Lessons to Share from What We’ve Seen
The first important task is to promote a Culture of Security. This involves enlisting everyone in an organization to protect the network. This endeavor needs to be promoted from the top down to truly be a transformative process. Recognizing that a network cannot be protected simply through security software and firewalls is the important first step.
- Best security practices begin at the organizational level. Complex passwords, regular password changes, minimizing administrative access to users unless absolutely needed, and 24×7 security monitoring need to be implemented.
- The individual employee can be one of the weakest links in an organization. The news is full of stories of how large and small corporations have been infiltrated by cybercriminals through social engineering and phishing attacks. Security awareness training is a key component in keeping a network secure and needs to be ongoing and up to date. The good news is that implementing an awareness training program is relatively easy. Web-based training, simulated phishing attacks, and more importantly, record keeping ensures that everyone is getting the appropriate security training and taking the training seriously.
- Once a company implements best security practices at the organization level and end user security awareness training, the prudent next step is to add security monitoring. Standard IT security is defensive in nature, but organizations must be proactive in detecting and responding to intrusions. A good managed security provider will provide CISO services to tailor the proper security programs to each organization based on their risk tolerance and compliance requirements.
Looking / Moving Forward
How does a business make improvements from one year to the next? In some industries it’s easy to apply a checklist of functional to-do’s and go from there. For instance, in our case the foundation of our managed services has always been the never-ending task of updating and patching operating systems and software. Currently our best practices include patching workstations on a weekly basis and servers monthly. Given the pace of infections and persistence of cybercriminals, this will eventually change to updating daily for workstations and weekly for servers. 24×7 security monitoring will also become a necessary part of a proactive maintenance plans.
Unfortunately, it is impossible to prevent all infections and intrusions which makes it vitally importantly that security monitoring and comprehensive backup and business continuity plans are in place. We’ve also identified several ways to bolster our clients’ networks by adding advanced security controls such as automating desktop shutdown protocols in case of a breach or simply automating password resets. These extra steps are part of the ongoing battle against cyber attacks.
How did we come to the conclusion that we needed to add more security devices to our service plan offerings? We strategically looked at the cybersecurity landscape and adapted to what is needed for our clients to have the best possible strategies in place.
The process we went through is one that every business can take advantage of, regardless of industry. Everyone needs a good cybersecurity plan in today’s environment. The value of security professionals (in the form of a virtual Chief Information Security Officer or security-focused MSP) as an added resource can make all the difference in today’s IT landscape.
Continue the Conversation
Link High has successfully implemented several security awareness training programs and provides a full suite of Information Security services for our clients. Our Director of Information Security is available for a free consultation to discuss how you can develop a custom security program.