5 Ways to Win the PC Security Battle
Reprinted with permission from the Microsoft Small Business Center
by Heather Clancy
Yes, as you’ve doubtless heard umpteen times, even the smallest business is vulnerable to a PC or network security breach. But you can find some peace of mind simply by taking some preventive measures. Better yet, by taking action before an incident occurs.
IT consultants believe that the most effective data security policies are those that treat security not just as an IT problem but as an underlying business process. What good are firewalls, for example, if you don’t have a way for trusted business partners to access your network from a remote location? How effective is a software patch management service if telecommuting employees who are rarely in the office aren’t encouraged (or forced) to update?
Step one for any security strategy means getting your entire organization involved in the discussion. If you’re an IT type, find yourself a champion who has line-of-business responsibilities; someone who understands your company’s customers. If you know very little about technology but want to protect your company’s most precious intellectual property assets, find someone who can approach the problem both tactically and strategically.
“You can’t just put locks on the windows,” says Rory Sanchez, president of SLPowers, a security consulting services provider in West Palm Beach, Fla. “You need locks on the doors, bars around the windows, a dog in the yard. And, just in case, you need a shotgun by the bed.”
Five questions to guide your security soul-searching
Before his company even thinks about recommending specific products, it focuses on understanding potential customers’ business concerns, says Ralph Figueiredo, director of sales and business development for Aurora Enterprises, a data security consultant in Torrance, Calif., says.
Here are five questions that Figueiredo requires his sales team to ask business prospects. They may help to provide a logical framework for your own security soul-searching.
1. Who are your customers and business partners?
For Figueiredo, this question serves two main purposes. First, it helps him understand which data is most critical. For a services company like Aurora Enterprises, customer records are its most valuable assets. A manufacturing organization, however, might be more concerned about safeguarding certain pieces of intellectual property or product information. By asking about business partners, Aurora can determine how “virtual” a company’s business operations are. If a company relies on a large number of subcontractors who need network access to confidential information, the security architecture will take on a different shape.
2. How do you communicate information with customers and business partners?
This question helps gauge the sophistication of a company’s IT operations as well as the flow of information throughout an organization. Are communications mainly relegated to e-mail exchanges? Or do customers and partners interact through online portals that require a password for entry? If so, what information is created and kept there?
3. Is your business in a regulated industry?
The ramifications of a breach of security are more severe for some business segments than others. In certain states, such as California, certain types of companies are required to disclose certain sorts of security breaches publicly. Figueiredo says most businesses are understandably eager to avoid this sort of publicity. “No company of any size can afford for 25% of their customers to go elsewhere,” he says.
4. Does your company currently subscribe to a policy for physical/facilities security or any other access control guidelines?
The moment you block access to information, you have to list exceptions to the rule. If a small business has already considered a system for controlling physical access at its sites, this can serve as the foundation for a data security project. Your facilities manager (if this isn’t you) can help identify pitfalls and benefits that may help better make your case with those within your company who may need extra convincing on the budget side.
5. Do you know where confidential data is stored?
In the past year, we’ve all read countless examples of respected companies who deployed extensive network security strategies, only to have valuable records walk away via lost or stolen notebook computers loaded with unauthorized information. This is, in part, an access-control problem. It also suggests a need for better data management policies, the foundation for any workable security plan.
Five ways to be proactive
1. Make sure hardware — especially firewalls, networks and IP telephone systems — is configured properly.
At a minimum, invest in a firewall and antivirus software that stops viruses at the gateway into the network.
How many times have you heard about an insecure wireless network that was secured simply by readjusting or turning on the basic settings? The same goes for setting up network servers and firewalls: Hire a technical person who can install them properly.
“A lot of security simply has to do with proper configuration,” says Alex Zaltsman, partner and cofounder of Exigent Technologies, an IT consulting firm in Morristown, N.J.
“I think security concerns need to be part of every project you do in technology,” echoes Kevin Geiger, manager of network integration for Acropolis Technology Group, another IT consulting services company in Wood River, Ill.
Acropolis offers a managed maintenance and monitoring service that does just this behind the scenes, keeping track of changes to all devices across the network including servers, desktops and laptops, and making sure updates for firewalls are handled promptly. The updates are tested in a lab setting before being dispatched at a client site, and changes are made at night so there is a minimal impact on the company’s day-to-day operations.
Security breaches are easier to track this way. Consider the case of one Acropolis client who had his laptop swiped. Because the laptop could be monitored from a remote location using Acropolis’s service, law enforcement officials were able to trace the alleged thief when he logged on to the Internet using the stolen computer. Kind of like the LoJack system for cars. “It’s now possible to offer small businesses something that rivals what larger companies have,” Geiger says.
2. Standardize your operating system.
It’s simpler to manage your desktops and servers if they all have the same basic profile and software, rather than trying to keep up with a hodge-podge of different versions.
Zaltsman says it’s less important to have the latest operating system, but it is vitally important that the operating system being run by a small business be supported by the manufacturer. “For small businesses, as a matter of practicality, Windows is really the easiest thing to maintain and secure. Having a qualified person work on it is really the best way to secure it,” he says.
3. Invest in ongoing patch management procedures.
Of course, widely used operating systems are also those targeted most often by hackers who want to compromise your data security, infect your systems with all manner of malware such as viruses or spyware programs that capture information, or barrage your company with spam. Windows XP and Vista, by virtue of their installed base, are probably the most widely targeted operating systems.
No doubt, Windows 7 will be an attractive target for hackers. But Microsoft went to great effort to build security features into the new operating system.The company also offers a range of tools to protect your computers and network against the latest security threats.
4. Consider using “hosted” applications.
Although this option isn’t necessarily for everyone, some small businesses are exploring the notion of making data storage-and by extension data security-someone else’s problem by using application services and keeping software off their desktops. One example is e-mail. About 44 percent of small- and mid-size businesses handle messaging via a service, rather than their own server. Likewise, about 40 percent use a software service for customer relationship management, according to statistics from Forrester Research.
More software vendors, including Microsoft, now offer their applications as subscription services rather than packages you load onto your computer. “By opting for a service, you are offloading some of the risks,” says Geiger. “In theory, these services have all the right stuff on the back end to be hosted securely.”
5. Adopt an integrated approach to security technology instead of trying to plug holes one at a time.
Even if you can’t invest in security products you’d like, it’s best to consider individual components that work together well-from firewalls, encryption software and antivirus services to spam filters. That way, as you add different features over time, they won’t mess up what’s already installed. Those in the IT industry refer to this philosophy as unified-threat management. “When we recommend security products, we talk about a platform approach and we try to recommend things that work together,” says Figueiredo.
One example is data encryption, which can be handled at many different junctures: in e-mail, on servers, on desktop and laptop hard drives. If a company invests in different point solutions to handle each piece, its overall protection will likely be less effective than if it had considered technology that addressed these problems in an integrated fashion.
To learn more, contact us today.
