Ultimate it security checklist


Published on

Published in: Technology
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Ultimate it security checklist

  1. 1. Ultimate 10-Step IT Security Checklist for Protecting your Business from a Breach A Publication of
  2. 2. WWW.PARANET.COM SHARE EBOOK Ultimate 10-Step IT Security Checklist // 2 Paranet IT Consulting Services IT is complex, managing it shouldn’t be. IT Advisory Network & Convergence IT Due Diligence IT Security Virtualization Backup & DR http://info.paranet.com/security-vulnerability-assessment REQUEST A SECURITY ASSESSMENT
  3. 3. WWW.PARANET.COM SHARE EBOOK Ultimate 10-Step IT Security Checklist // 3 Ultimate 10-Step IT Security Checklist by Quinn Devery Quinn Devery is the Director of Marketing at Paranet Solutions as well as the founder of DFW IT Professionals. He is responsible for Paranet’s marketing efforts and channel strategy. Follow Quinn on Twitter @qdevery or on LinkedIn.
  4. 4. WWW.PARANET.COM SHARE EBOOK Ultimate 10-Step IT Security Checklist // 4 Introduction Enterprise security is a many tentacled beast. Each time a vulnerability is patched by an anti-virus firm or IT product vendor, hackers find a new hole to stay one step ahead of the most advanced IT security professionals. In addition to this constant war between security vendors and hackers, every security solution you add to your business has an impact on agility or productivity. For example, encrypting all of the data in the enterprise would prevent many breaches, but the cost in systems performance and business operations would cripple most organizations. All of this means there is never an end to the IT security battle, and there are no fool-proof ways to protect businesses from a breach. In most companies today, a lot rides on the data within networks, and fighting it without the right expertise is a constant challenge. To help keep your business safe from the threats that exist today, we’ve put together a 10-step IT security checklist to miti- gate the risk of a security breach. Hackers are like thieves constantly looking to slip through an unlocked door rather than assaulting you over 10-foot fences guarded by German shepherds. Have your IT support staff or managed IT services pro- vider use this checklist to help make your organization a harder target.
  5. 5. WWW.PARANET.COM SHARE EBOOK Ultimate 10-Step IT Security Checklist // 5 1. Train Your Employees Your IT security is only as strong as your weakest link. Train your employees to use strong passwords, to not open email from people they don’t recognize and to not click on suspicious attachments. Passwords are a big problem. In one recent study, a majority of hack attacks could have been prevented with better password practices. You need a password policy that, if it doesn’t require multi-factor authentication, at least requires users to switch it up on a regular basis. A recent experiment showed 85 percent of mobile users connected to Wi-Fi hotspots without checking. A security expert then captured login information from all users connected to the hotspot. Here are some other scary stats: 637,965,373 passwords were leaked globally in 2012. 76 percent of people who use public Wi-Fi don’t use any security mea sures.
  6. 6. WWW.PARANET.COM SHARE EBOOK Ultimate 10-Step IT Security Checklist // 6 2. Know where your data lives Do you know where all your confidential information is? You should. And, you should limit access to private or confidential data. That includes setting up tools that alert you when that data is accessed. 68 percent of businesses still use email as their main method to send and ex change large files and sensitive data. Only 17 percent of businesses take any steps to secure company data on personal devices. With stats like these you need to do the following checks: Make a list of where all you most sensitive & critical data lives for your user files, application data, and backups. Make a best effort to consolidate and centralize sensitive and critical data on file servers and in the data center Limit and/or block applications that are not approved by the enterprise and synchronize data to a 3rd party cloud or somewhere else outside the corporate network
  7. 7. WWW.PARANET.COM SHARE EBOOK Ultimate 10-Step IT Security Checklist // 7 3. Inventory your devices Tools are available that can identify and secure all devices your employees are using on your network, including BYODs. You need an inventory of everything from thumb drives to smartphones and tablets to laptops. Smart Phones Tablets Network Devices PCs Laptops Servers
  8. 8. WWW.PARANET.COM SHARE EBOOK Ultimate 10-Step IT Security Checklist // 8 4. Protect your network You need to be using virtual private networks (VPNs) and firewalls to pro- tect your network. Today’s users want access from anywhere, at any time, on any device. That means all kinds of new security risks. With the right protocols, your employees can enjoy both flexibility and security. Only 53 percent of IT leaders are confident their SaaS applications are secure. 35 percent of SaaS apps are not evaluated for security prior to de ployment. Only 49 percent of businesses evaluate a IaaS provider’s security prior to deployment.
  9. 9. WWW.PARANET.COM SHARE EBOOK Ultimate 10-Step IT Security Checklist // 9 5. Secure physical devices Your business may have an open-door policy, but not when it comes to IT security. Your servers and unused devices should be kept behind locked doors with limited access. Limit the number of employees who have physical ac cess to your infrastructure and devices Keep track of lost keys and quickly replace physical security Vet your managed it services provider for security poli cies and protocols Choose a datacenter provider that meets SAS 70 II and/ or SSAE 16 requirements
  10. 10. WWW.PARANET.COM SHARE EBOOK Ultimate 10-Step IT Security Checklist // 10 6. Keep your facilities safe You probably have given thought to security access to pro- tect your personnel. The same principle applies for your IT. You don’t want strangers wandering your halls. Limit physi- cal access to areas where your IT hardware exists. Know your office building’s security policies Invest in key card access for employees to keep strangers out Invest in video surveillance for your office in the case something does go wrong
  11. 11. WWW.PARANET.COM SHARE EBOOK Ultimate 10-Step IT Security Checklist // 11 7. Protect your website & ensure safe browsing Protect yourself and employees with strong anti-malware and reassure customers by using trustmarks on your website. You might be sur- prised how many more clicks you get when you reassure customers your site is safe. Centralize anti-virus deployment, management, and policies Deploy IPS/IDS systems for logging and threat analysis Evaluate web-application firewalls for additional protection Perform an annual 3rd party security assessment that includes penetration testing and external scanning
  12. 12. WWW.PARANET.COM SHARE EBOOK Ultimate 10-Step IT Security Checklist // 12 8. Create clear IT security policies Research indicates half of businesses have experienced an increase in malware at- tacks because of employees’ use of social media. Look at these stats on 53 percent of public Wi-Fi users log onto social networking sites. Are they doing so with a work-provided computer? 32 percent of public Wi-Fi users were not aware of the risks; 13 percent were concerned with the risks; only 17 percent of users knew the risks. You’re not going to end the use of social media – your business might depend on it. However, you can set clear, written policies on how your devices may be used, and on the use and disposal of confidential documents.
  13. 13. WWW.PARANET.COM SHARE EBOOK Ultimate 10-Step IT Security Checklist // 13 9. Properly dispose of end-of-life devices & documents Management and disposal of retired IT assets is a critical element in both keeping yourself in compliance with a growing number of laws and holding data thieves at bay. You should be “digitally shredding” data from old machines and discarding those ma- chines properly. Follow recommended procedures when hiring an asset retirement vendor and work with the company selling you new technology to see if they can help take the old stuff off your hands safely. Identify assets that hold potentially sensitive data Wipe all end-of-life devices Use a 3rd party for hard drive destruction of sensitive customer data Reconcile end-of-life device disposal with asset inventory
  14. 14. WWW.PARANET.COM SHARE EBOOK Ultimate 10-Step IT Security Checklist // 14 10. Screen employees thoroughly You should be conducting background checks on the people you hire, particularly those you are entrusting with your secure IT. You also should be limiting access to administrative IT accounts and setting up alerts whenever those accounts are used to access sensi- tive information. Employ a third-party screening company for back ground checks and drug testing. Make checking employee references a policy. Develop a standard set of interview questions that hiring managers must use.
  15. 15. WWW.PARANET.COM SHARE EBOOK Ultimate 10-Step IT Security Checklist // 15 CONCLUSION A successful IT security department isn’t one that can defend any attack from any attacker. A good IT security profession- al will make their organization less of a target and focus their efforts on defending their most critical assets such as client data, Intellectual property and trade secrets. Follow this checklist and you’ll be well prepared to protect your organization from malicious people and organizations both internal and external. Thanks for Reading