October is Cyber Security Awareness Month and the theme this year is “Don’t Make It Easy For Them”. It got us thinking about some of the security fundamentals organisations can still struggle with. With so much attention on AI, increasingly sophisticated attacks and emerging threats, getting the basics right remains one of the most effective ways to make life harder for attackers.
In Part 2, we’re discussing asset visibility, admin / privileged accounts, backups and incident response plans.
No visibility of the assets in your environment
How many endpoints are in your environment right now? For many organisations, the answer isn’t as straightforward as it sounds.
Devices join and leave the network, employees work remotely, software changes and cloud services continue to expand the technology estate. Knowing approximately what you have isn’t the same as knowing what is there, who owns it, what is running on it and whether it’s compliant.
Asset visibility is also fundamental to effective vulnerability management. The NCSC specifically recommends understanding what systems and software exist within the technical estate, who is responsible for them and what vulnerabilities are present.
PointWire recommends: Maintain an accurate and current view of your technology estate. Asset visibility creates the foundation for effective vulnerability management, patching, compliance and incident response.
Not reviewing your admin/privileged accounts
Administrator accounts are essential for managing systems, but they also come with greater access and therefore greater risk if they are compromised or misused.
Over time, employees can accumulate elevated permissions that are no longer required, particularly when responsibilities or roles change. Privileged access should therefore be treated differently from everyday user access.
PointWire recommends: Regularly review privileged and administrator accounts and ensure elevated access is only provided where there is a genuine business requirement. Where possible, employees should use separate standard accounts for everyday activity and privileged accounts only when elevated access is required.
Having backups but not testing restores
Having backups in place is important, but a backup is only useful if you can successfully recover from it when you need to.
Backup processes can fail, configurations can change and the data being protected can evolve. If recovery isn’t regularly tested, organisations may not discover a problem until they’re dealing with an incident and need their backups most.
PointWire recommends: Don’t stop at checking that backups have completed. Regularly test your recovery process so you understand what can be restored, how recovery works and whether your organisation can access the information it needs following an incident.
Having an incident response plan that isn't accessible
Having a documented incident response plan is a good start but think about where that plan is stored and whether you’ll actually be able to access it during a cyber incident.
If your normal IT environment is unavailable or compromised, a response plan stored solely within that environment may not be much help. People also need to understand their responsibilities before an incident occurs, rather than reading the plan for the first time while responding to one.
PointWire recommends: Keep an accessible alternative copy of your incident response plan and regularly review it. Make sure key people know their responsibilities, important contact details are available, and the plan can still be accessed if your normal systems are unavailable.
If you’re not sure where to start with your cyber security, give PointWire a call and we can assess your current environment, make recommendations for improvement and support along the way.