Ultimate it security checklist

Ultimate 10-Step IT Security Checklist for
Protecting your Business from a
Breach
A Publication of

WWW.PARANET.COM SHARE EBOOK
Ultimate 10-Step IT Security Checklist // 2
Paranet IT Consulting Services
IT is complex,
managing it shouldn’t be.
IT Advisory
Network &
Convergence
IT Due Diligence IT Security
Virtualization Backup & DR
http://info.paranet.com/security-vulnerability-assessment
REQUEST A SECURITY
ASSESSMENT

Ultimate 10-Step IT Security Checklist
by Quinn Devery
Quinn Devery is the Director of Marketing at Paranet Solutions as
well as the founder of DFW IT Professionals. He is responsible for
Paranet’s marketing efforts and channel strategy. Follow Quinn on
Twitter @qdevery or on LinkedIn.

Introduction
Enterprise security is a many tentacled beast. Each time a vulnerability is patched by an anti-virus firm or IT product
vendor, hackers find a new hole to stay one step ahead of the most advanced IT security professionals. In addition to this
constant war between security vendors and hackers, every security solution you add to your business has an impact on
agility or productivity. For example, encrypting all of the data in the enterprise would prevent many breaches, but the cost
in systems performance and business operations would cripple most organizations.
All of this means there is never an end to the IT security battle, and there are no fool-proof ways to protect businesses
from a breach. In most companies today, a lot rides on the data within networks, and fighting it without the right expertise
is a constant challenge.
To help keep your business safe from the threats that exist today, we’ve put together a 10-step IT security checklist to miti-
gate the risk of a security breach. Hackers are like thieves constantly looking to slip through an unlocked door rather than
assaulting you over 10-foot fences guarded by German shepherds. Have your IT support staff or managed IT services pro-
vider use this checklist to help make your organization a harder target.

1. Train Your Employees
Your IT security is only as strong as your weakest link. Train your employees
to use strong passwords, to not open email from people they don’t recognize
and to not click on suspicious attachments. Passwords are a big problem. In
one recent study, a majority of hack attacks could have been prevented with
better password practices. You need a password policy that, if it doesn’t require
multi-factor authentication, at least requires users to switch it up on a regular
basis.
A recent experiment showed 85 percent of mobile users connected to Wi-Fi
hotspots without checking. A security expert then captured login information
from all users connected to the hotspot. Here are some other scary stats:
637,965,373 passwords were leaked globally in 2012.
76 percent of people who use public Wi-Fi don’t use any security mea
sures.

2. Know where your data lives
Do you know where all your confidential information is? You should. And, you
should limit access to private or confidential data. That includes setting up tools that
alert you when that data is accessed.
68 percent of businesses still use email as their main method to send and ex
change large files and sensitive data.
Only 17 percent of businesses take any steps to secure company data on
personal devices.
With stats like these you need to do the following checks:
Make a list of where all you most sensitive & critical data lives for your
user files, application data, and backups.
Make a best effort to consolidate and centralize sensitive and critical
data on file servers and in the data center
Limit and/or block applications that are not approved by the enterprise and
synchronize data to a 3rd party cloud or somewhere else outside the corporate
network

3. Inventory your devices
Tools are available that can identify and secure all devices
your employees are using on your network, including BYODs.
You need an inventory of everything from thumb drives to
smartphones and tablets to laptops.
Smart Phones
Tablets
Network Devices
PCs
Laptops
Servers

4. Protect your network
You need to be using virtual private networks (VPNs) and firewalls to pro-
tect your network. Today’s users want access from anywhere, at any time,
on any device. That means all kinds of new security risks. With the right
protocols, your employees can enjoy both flexibility and security.
Only 53 percent of IT leaders are confident their SaaS applications
are secure.
35 percent of SaaS apps are not evaluated for security prior to de
ployment.
Only 49 percent of businesses evaluate a IaaS provider’s security
prior to deployment.

5. Secure physical devices
Your business may have an open-door policy, but not when it
comes to IT security. Your servers and unused devices should
be kept behind locked doors with limited access.
Limit the number of employees who have physical ac
cess to your infrastructure and devices
Keep track of lost keys and quickly replace physical
security
Vet your managed it services provider for security poli
cies and protocols
Choose a datacenter provider that meets SAS 70 II and/
or SSAE 16 requirements

6. Keep your facilities safe
You probably have given thought to security access to pro-
tect your personnel. The same principle applies for your IT.
You don’t want strangers wandering your halls. Limit physi-
cal access to areas where your IT hardware exists.
Know your office building’s security policies
Invest in key card access for employees to keep
strangers out
Invest in video surveillance for your office in the case
something does go wrong

7. Protect your website & ensure safe browsing
Protect yourself and employees with strong anti-malware and reassure
customers by using trustmarks on your website. You might be sur-
prised how many more clicks you get when you reassure customers
your site is safe.
Centralize anti-virus deployment, management, and policies
Deploy IPS/IDS systems for logging and threat analysis
Evaluate web-application firewalls for additional protection
Perform an annual 3rd party security assessment that includes
penetration testing and external scanning

8. Create clear IT security policies
Research indicates half of businesses have experienced an increase in malware at-
tacks because of employees’ use of social media. Look at these stats on
53 percent of public Wi-Fi users log onto social networking sites. Are they
doing so with a work-provided computer?
32 percent of public Wi-Fi users were not aware of the risks; 13 percent were
concerned with the risks; only 17 percent of users knew the risks.
You’re not going to end the use of social media – your business might depend on it.
However, you can set clear, written policies on how your devices may be used, and
on the use and disposal of confidential documents.

9. Properly dispose of end-of-life devices & documents
Management and disposal of retired IT assets is a critical element
in both keeping yourself in compliance with a growing number
of laws and holding data thieves at bay. You should be “digitally
shredding” data from old machines and discarding those ma-
chines properly. Follow recommended procedures when hiring
an asset retirement vendor and work with the company selling
you new technology to see if they can help take the old stuff off
your hands safely.
Identify assets that hold potentially sensitive data
Wipe all end-of-life devices
Use a 3rd party for hard drive destruction of sensitive
customer data
Reconcile end-of-life device disposal with asset inventory

10. Screen employees thoroughly
You should be conducting background checks on the people you
hire, particularly those you are entrusting with your secure IT. You
also should be limiting access to administrative IT accounts and
setting up alerts whenever those accounts are used to access sensi-
tive information.
Employ a third-party screening company for back
ground checks and drug testing.
Make checking employee references a policy.
Develop a standard set of interview questions that
hiring managers must use.

CONCLUSION
A successful IT security department isn’t one that can defend any attack from any attacker. A good IT security profession-
al will make their organization less of a target and focus their efforts on defending their most critical assets such as client
data, Intellectual property and trade secrets.
Follow this checklist and you’ll be well prepared to protect your organization from malicious people and organizations
both internal and external.
Thanks for Reading

Ultimate it security checklist

Recommended

Recommended

More Related Content

Recently uploaded

Recently uploaded (20)

Featured

Featured (20)

Ultimate it security checklist