Many businesses could use good guidelines for security in their digital everyday life. Good routines and practices often get deprioritised in a hectic workday. Unfortunately, the cost if an accident happens can be far greater than the time it takes to review this internally in advance. Here is some good advice.
Many businesses could use good guidelines for security in their digital everyday life. Good routines and practices often get deprioritised in a hectic workday. Unfortunately, the cost if an accident happens can be far greater than the time it takes to review this internally in advance. Here is some good advice.
IT security within the company
Deploi looks after infrastructure for a number of Norwegian businesses, and talks regularly with those businesses about security. In this article we look at how companies should handle security internally.
Employees who take security seriously
Everyone who works in a company must care about security. Employees who do not take security seriously will always be one of the biggest security threats.
Good practices
There are a number of good practices most people in the industry agree on:
Do not click unknown links in email or SMS. You should always be able to find a supplier’s service via their website.
So-called «phishing» means posing as a customer or employee. It is important to be careful to verify that the people you are in contact with, especially by phone or email, are actually entitled to the access or information they are asking for.
Get familiar with how your internal systems normally «look» and behave. That makes it easier to identify abnormal behaviour. Anything out of the ordinary should always be investigated.
Security when transferring sensitive information
Sometimes you have to transfer sensitive information, such as passwords, encryption keys, private keys or personal data. Always transfer this encrypted, and communicate passwords in a separate channel. For example, if you send encrypted data by email, send the password by SMS or agree on a password at a physical meeting.
Communication channels like email, SMS and phone are not encrypted. That means someone in between could listen in on the information. Emails and text messages are often stored in the inbox after they have been read.
Strong passwords and login keys
Even if all software is up to date, an uninvited guest can still get into IT systems by guessing or obtaining passwords and login keys. It is important to have good, strong passwords and login keys. These should be stored safely – encrypted, or physically inaccessible to unauthorised people.
The right access levels
It is important that only those who really need access to something have it. This applies to employees, external parties and former employees. Keep a register of who should have which access rights, and check it regularly against changes in staff and external parties. Remove or limit access when a person no longer needs it.
It is equally important that software only has the access it needs. The buzzword here is «zero trust». Just as for people, a register should be kept of what access software has, and it should be checked regularly against what is still necessary.
