Cyber security: an essential checklist for companies

Company IT security is a universal issue which every good entrepreneur should take into serious consideration. Attacks by cyber criminals can, in fact, cause enormous damage to a business, both in terms of production and finance.

In today’s digital era, with so much information travelling via the web, it is of crucial importance that companies defend themselves in the best possible way. The most efficient method of doing this is to make sure they have excellent cyber security. By following a specific checklist, it is possible to identify any ‘holes’ in the company network and, consequently, to fix them immediately.

The fifteen IT security points to check

Below is a list of checks to be carried out, so as to quickly identify whether a company’s IT security is well-protected or if intervention is required to repair potential ‘holes’ and vulnerabilities (the checks are grouped according to theme, to make them easier to follow).

Inventory of devices and software:

1. The first step is to create an inventory of systems, devices, software and services, so as to be fully aware of all potential vulnerabilities;
2. A good method of prevention from cyber attacks is to minimise exposure on social networks and reduce the number of services requested from third parties as much as possible;
3. Keeping a list of the most critical information, data and systems helps to monitor those areas needing greater protection;
4. Allocating responsibility for monitoring cyber security to a specialised person or company helps minimise risks.

Governance:

5. A good understanding of relevant legislation relating to IT security and following it to the letter is an essential element.

Protection from malware:

6. Malware is malicious software which can compromise the normal functioning of a computer, as well as allowing access to sensitive data. To ensure a secure system, it is therefore advisable to install antimalware software on all company devices.

Management of passwords and accounts:

7. The use of long passwords, which include numbers, letters and special characters, reduces the risk of decryption. Do not use the same password for different accounts;
8. Access to systems must only be carried out via personal accounts, avoiding the sharing of information with other users;
9. Account privileges must be appropriate for the role in the company, so as to limit access to sensitive data and to crucial areas of the software.

Training and awareness:

10. Company personnel must be correctly trained and informed regarding IT security regulations. The basic rules for a safe and well-informed use of online devices must also be observed.

Data protection:

11. Devices must be configured by cyber security experts, especially new ones;
12. A policy for data recovery should be introduced, in case of any problems (constant backup is still a very useful safeguard strategy).

Network protection:

13. Protecting internal networks is one of the minimum requirements towards guaranteeing company IT security. The use of appropriate devices and software is obligatory.

Prevention and mitigation:

14. In case of accidents or security violations, it is imperative that all those in charge of cyber security are informed immediately, so that they can limit and resolve the issue;
15. As a precaution, it is a good idea to keep hardware and software updated. Carry out patches and upgrades regularly to make sure that the level of security is further increased.

By following these simple guidelines to maintain the company IT security, unpleasant surprises can be avoided. Companies who handle sensitive data should, in addition, set up an internal department to deal exclusively with cyber security.

Translated by Joanne Beckwith