(upbeat music)
- Hello, and welcome back to another video.
I'm Marcus from InfoSEC Governance.
And in today's video, we're going to be talking about
how you can protect your business
through using cybersecurity.
Now, first up is antivirus.
This is always a bit of a controversial one
depending upon who you are and who you speak with.
But I always recommend that you instal antivirus software
on your computer, make sure it's all licenced
and it's across all devices that you can have.
Now, when it comes to what type of antivirus you have
how long's a piece of string and everything else.
If you're running windows systems,
Windows Defender is just as good as anything else,
but personally I'd prefer
something that you can centrally manage across all systems.
Something that's maybe got a cloud portal
or something like that.
And you can manage all the machines from one bit.
With windows defender, you're pretty much stuck with
managing on each individual machines.
So if you look at a system that actually locks
and manages all your systems on one place then that's great.
Now with antivirus as well that can also help you protect
against ransomware and malware attacks.
So its always good just to have
a couple of layers of defence within your environment.
Now, number two is implementing appropriate email security.
If you don't have any email security in place
you're opening yourself up to phishing attacks,
malicious emails or anything like that
coming into your environment.
By actually adding that extra layer of protection
into your system at the border
before you actually get into your environment
and actually receive those emails,
you can actually give yourself a bit more security
reducing the threat of anything getting in.
Making sure that customers or your staff
don't actually go and click on things, open up a link
and it goes off and downloads some something malicious.
Okay, number three, next up is web security.
Web security can help you protect your users
from accidentally clicking on malicious links
or visit malicious websites.
Now this kind of goes hand in hand with the email one
that we just discussed.
But pretty much with the web one,
you could have some kind of system in place
that actually monitors and filters any malicious content
that you actually browse.
So if a member of stuff clicks on a link
or tries to visit a website
is deemed inappropriate for your business,
or it has been known to be malicious
or contain something like that,
something that's not good for you.
Then you can actually get blocked.
You can get warned or anything about that.
And it just helps you actually protect your environment
by not actually visiting administers websites.
Now, most of the time it's actually easier
to actually deploy email.
And web security is part of the same package you can get it.
Sometimes it can be independent through your email solution,
but sometimes it's easy just to deploy
and manage everything all in one go.
So if you can put your email
and your packaging in one place
then it just makes it easier for you.
For purchasing, and for renewing,
for supporting and everything else.
Okay, number four, password management.
Obviously make sure that all your users
are using secure complex passwords.
Minimum password of eight characters or more,
upper case, lower case, numbers, throw everything in it.
Now, ideally I prefer using password managers.
So you've got a dedicated password for every single site
and every single system that you use,
which obviously can go up to hundreds of different passwords
but a few years of password managers
such as the LastPass, 1password, KeePass
all those sort of things.
There's hundreds around, have a look at
and see what's the best one for yourself.
But if you use a password manager
you can ensure that you've got a nice, complicated
and secure password that you can use against all systems.
So if that password ever gets compromised
for whatever reason
it's only that say that's going to be compromised.
You're not going to be using that same password
reused across multiple different areas,
multiple different systems
and then open up a massive kind of worms.
Okay, and number five, two factor authentication.
Two factor authentication should be used
where it's available.
Obviously it's not supported everywhere.
But it also helps add that extra layer of security
and gives you a bit more safety for your account.
For example, if someone manages to guess
or grab your username and password in a service,
or some kind of website, having that extra layer of security
for your two factor authentication
will help you to stop them getting a foothold into it.
So yes, they might know your credentials to log into it
but without that additional prompt
and that additional authentication actually to let them in,
they can't get anywhere.
So what you might notice is
someone's trying to get into your account,
you'd get a message popping up on your phone
and saying, " Someone has requested access to this.
What is your code?
Or what is your authentication token to login?"
Obviously, if you get that
then change your details as soon as possible.
And number six, software patching.
All I've got to say is patch, patch, patch, and patch again.
And make sure that everything is kept up to date.
Not only operating systems,
but also make sure that your third-party applications
your firmware, your drivers, everything is up to date.
How many businesses patch and keep up to date their switches
their routers, their firewalls, even their printers.
When was the last time you double checked
everything was kept up to date?
Yes, you might think it's not very secure,
it's not required to be patched to anything like that,
but just make sure everything's patch kept up to date.
It's not only for security vulnerabilities things like that,
but sometimes you get new features
and bug fixes and stuff like that.
So you can just make it a lot easier.
And obviously if you're patching,
you're reducing that threat, and that security stance that
someone might actually get in via for whatever means.
Okay, number seven, physical security.
When you talk about cyber security
a lot of people think it's all about computers,
devices mobile phones.
But what about your physical security?
What about, how are your servers kept secure?
Is the office kept secure?
What happens when everyone leaves the office?
Yes it doesn't really matter too much at the moment
because everyone's in lock down here in the UK.
But what about working from home with your computers?
If you're working from home
and you've got an office laptop.
Is it locked when you leave away from it?
Do you keep the laptop in a secure area?
How do you do all that?
How do you manage that?
Number eight is encryption.
Ensuring that you've got full disc encryption
enabled on all your devices is great.
Especially if you've got mobile phones or laptops.
If you take in your business data
outside of the main corporate environment
and you've got it anywhere in the public environment.
Ensuring that you've got encryption in place is paramount.
Windows comes with full disc encryption.
Mac comes with encryption,
mobile phones come with encryption.
So there's absolutely no reason
why you shouldn't actually be enabling it and turning it on.
These days, it doesn't really slow down your machine
like it used to in the olden days,
devices are quick enough
to actually encrypt your information
and keep everything nice and secure.
The last thing you want to do is get your laptop next,
or get your phone stolen, anything like that.
If it is then nine times out of 10
that your information is going to be kept nice and secure.
It potentially could be very unlucky where
your device has kept unlocked it's been stolen,
and they've actually managed to get into it.
Then that's another issue.
But nine times out of 10
if you've got your device locked, it's encrypted,
you're not going to get that information back
unless you know, that actual keys
and keys to get into it and things like that.
Okay, number nine is staff training.
This one in my eyes is an important one.
Ensuring that your staff are kept trained, kept up to date.
You've got that knowledge and awareness being built up.
Yes, you could do training just for how to use the business,
what their job is and things like that.
But what about actually identifying security risks?
Do people understand or know
how to actually identify a malicious link?
Do they know what to look out for,
for phishing attacks within emails?
Do they know that if you hover your mouse over
the URL within an email or a webpage or anything like that,
you can actually show what the proper link is and things?
Getting people trained up, and making sure they're aware
of actually how to spot potentially fraudulent emails
or malicious emails or dodgy your website,
just making sure they're all trained in how to do that.
And making sure
that people know how to save the files in the right places.
So for example, making sure that
they're actually saved on the file server if you've got them
or on the cloud environment not just locally on the machine
which may not get backed up.
And then if that machine gets broken or stolen,
or anything like that,
then they've lost all that information.
Okay, the last one number 10,
is when was the last time you actually backed up?
As we've just said, back up, back up and everything else.
If you don't back up, if you don't check your backups,
then you're opening yourself to a world of hurt.
Yes a lot of people can back stuff up.
But have you actually verified that everything that you use,
everything that you save is actually backed up.
We was last time we did note, and double check
that everything that was in your business
is getting kept up to date and backed up?
And then once you backed it up
when was the last time you actually tested a restore?
Was it a year ago or was it two years ago?
Have you never done it?
How would you know that when it comes to that time
when you actually need to recover
and restore something, it'll work?
You should really be trying recovery tests
every month at least.
And then you've got that peace of mind
and that knowledge that if something does break
or someone does delete something,
you can go to that email you can recover it
and it's going to work just like that.
And those are my 10 top tips
for cyber security within your business.
I hope you enjoyed this email, this email.
I hope you enjoyed this video, and go from there.
And like the video, subscribe to the channel
if you want to start listening
to more videos about cybersecurity in your business
cyber essentials, information security, anything like that.
Yeah, Look forward to the next one probably next week.
Thanks.
(upbeat music)