Cybersecurity Essentials: Part 3

All organizations need to protect their systems and data from cyber-attacks, which means that all organizations need to implement a cybersecurity program. Our monthly blog, “Cybersecurity Essentials,” details the elements of a comprehensive program to ensure you are accounting for privacy concerns, compliance issues, and the policies and procedures critical to maintaining a secure organization and a culture of cybersecurity.

In Part 1 of our series, we addressed privacy concerns as they extend to employee records, client or customer records and communications, and the use of mobile devices.

In part 2, we shifted our focus to a discussion of a security program, which includes training, policies, and other steps required to protect your organization’s sensitive data.

Here in part 3, we’ll introduce some tools—applications and solutions—you can implement to safeguard your organization from hackers.

Secure WiFi/wireless network: Take these steps to implement a WiFi solution with the security to protect your data and critical business systems:

Secure email gateway: Install a gateway online in the corporate path between the public internet and the corporate email. Email is the most common means hackers use to gain access to private company data. The gateway provides another layer in your security poster to inspect email for malicious content before it reaches your corporate systems.

System auditing: On your firewall, ensure that logging is enabled and the information it collects is periodically reviewed by designated IT staff for indications of a network compromise or ongoing attach. Providers have added the capability for detailed analysis of what’s coming through. Implement a process where someone is actually looking at that data and addressing any anomalies or attacks.

Endpoint detect and respond (EDR): As the sophistication of attacks has increased, the shortcomings of antivirus solutions have become more apparent. A modern replacement for antivirus software, EDR will continuously monitor and respond to advanced threats and is a critical piece of your security posture. EDR monitors the network 24/7, then uses business intelligence and analytics to recognize threats that historically don’t get caught by antivirus software.

Security incident and event management (SIEM): The solution collects all security logs across all network devices, and provides the ability to correlate activity across multiple devices and perform analyses to search for malicious activity. A SIEM is a more in-depth tool for helping organizations detect, analyze, and respond to security threats that could harm operations.

If you have questions or concerns, our Vertilocity team can evaluate your cybersecurity strategy and discuss your options with you. Call us at 412-220-5744, or email me at jkrentz@vertilocity.com.

Cybersecurity Essentials: Part 1

All organizations need to protect their systems and data from cyber attacks, which means that all organizations need to implement a cybersecurity program. This five-part series titled Cybersecurity Essentials will address each element of a program to ensure you are accounting for privacy concerns, compliance issues, and the policies and procedures critical to maintaining a secure organization and a culture of cybersecurity.

The first item on your cybersecurity checklist is to create and document a privacy program that will include developing an internal privacy policy, training employees on that policy, and creating an internal policy for data retention.

Internal policy

Your internal privacy policy is an employee-centric policy that addresses leadership’s expectations around the use of email and internet, systems and access. Privacy concerns extend to employee records, client or customer records and communications, and the use of mobile devices.

Your privacy policy is written language, a document that can be shared with employees and new hires that clearly outlines your expectations related to privacy and the policies and guidelines you have developed to ensure your expectations are met.

Employee training

Once you have developed your policies and documented that they have been attested to by your employees, it is essential to conduct employee training on a regular basis, at least annually, to ensure employees not only are kept up to date, but that they understand your internal privacy policy and their ongoing obligations.

A training program will include:

Data retention policy

Data is the most important aspect or component of your privacy policy. You should develop a “retention policy” that details how long you retain different types of data. Your policy might be driven by industry regulations, for example, HIPPA regulations requiring healthcare providers to retain certain patient data for a specific period of time. Your policy will be driven by compliance requirements, but also by when data can and should be expunged. It should include protocols on how data should archived as well as how long it will be kept, and on how it should be expunged.

Delete data when you can to:

If you have questions or concerns, our Vertilocity team can evaluate your cybersecurity strategy and discuss your options with you. Call us at 412-220-5744, or email me at jkrentz@vertilocity.com.