Everything we’re about to mention, we can offer flexibly as part of our IT security package. Every business is unique with differing IT security needs, but there are some fundamentals we absolutely wouldn’t recommend being without, whatever your industry.
IT Policy
What is an IT policy?
Everyone needs one of these. It can include things like password length and sets the standard for IT rules across your whole business, for everyone from directors to apprentices. Think of it like a health and safety policy, but for your IT security. It’s especially important when onboarding new members of staff and setting out company-wide expectations.
Microsoft 365 Auditing
For anyone using Microsoft 365 (formerly Office 365), enabling auditing allows you to gain insights into the company’s overall security, produce a report on admin permissions to highlight any vulnerabilities such as multi-factor authentication (MFA) being turned off, it details what license you have, who can access whose mailbox, highlights hacking vulnerability and email forwarding rules etc.
It allows us to spot the early stages of hacks, where tell-tale signs include the creation of new admin accounts, and odd email forwarding rules being set up.
Monitoring changes in Microsoft 365
Your account can be set up so that emails can only be accessed from within the UK – this greatly reduces the opportunity for international hackers to gain access to your company emails and spoof them to carry out fraud.
It can also be set so that new admin profiles and email forwarder conditions have to be approved by us, your IT provider. That makes it super easy to spot hacking attempts before they even start.
Microsoft 365 monthly security report
Encryption is for all hard drives, not just laptops
Bitlocker is great. It works well, and it’s part of the Microsoft system. By encrypting drives, you’re ensuring that if they’re stolen they can’t be accessed, and data is secure. Most people consider encrypting laptops, but forget about PCs that hold just as much vital data!
Antivirus, anti-malware and firewall
These are all essentials, and really the last line of defence in tech solutions when it comes to IT security. Make sure whatever you have, you’re using decent paid-for versions. Free versions seem like a good deal, but it only scans once a virus is already on the machine. It doesn’t scan incoming data such as emails, file downloads, or dodgy website links before it’s too late. This means that more intelligent viruses could easily bypass free security software.
Staff training and simulated phishing attacks
By sending staff simulated phishing attacks, you can receive reports on who clicks what. This will give you an insight into any weak points in your security arsenal, and pinpoint exactly where training is needed. As well as improving security, this can also save you money – you know where training resources are needed most and so training time can be spent incredibly productively.
We’ve actually written recently about how a real case where a multi-million-pound security system was rendered worthless, without staff having security training too.
DNS protection for all endpoints
DNS protection is an often overlooked layer of IT security. It provides additional protection for employees when accessing the internet by blacklisting dangerous sites and filtering content. This reduces the chances of someone being subject to a malicious attack by clicking on a dodgy link.
Internal anti-spoofing protection
This protects users from external agents sending emails pretending to be colleagues. It’s another layer of protection against a common hack – we’ve seen clients lose money, due to fake emails asking for changes to bank details on invoices etc.
Password management system
This allows for unique and strong passwords to be created for every login, then stored securely. It also allows you to send people the ability to log into something, without them actually seeing your login credentials. Perfect if you’re working with third parties, such as virtual assistants.
We use a system called MYKI, which we rate incredibly highly. In fact, so high that we’ve given it its own article that you can read here.
Dark web monitoring
We can scan your email addresses to see if they’re on any lists of data being sold. We’ll also be able to see if any associated information has been shared such as passwords, addresses, or credit card details.
Enhanced anti-spam filtering
Microsoft 365 gives you basic spam filtering as standard, but we provide an enhanced version – simply because it’s better! A bit like we said for antiviruses, this paid-for version is self-learning and it pays for itself in the protection it provides against spam email, which is not only annoying – it can be dangerous!
Mobile device management (MDM)
If you use mobile devices such as phones and tablets, this is essential for peace of mind and is a great security feature. If one of your business devices is lost or stolen, we can wipe it remotely for you to keep your business data safe.
If people are using their own devices, then we can install the business app on their phone, and their access to work apps is through this. This means that you can withdraw their access at any time if needed without needing the physical device, for instance in cases of instant dismissal.
You need a bring your own device (BYOD) policy
We have a template for standards within the business, and it can be used for staff and contractors – including freelancers. It’s just a great way of making sure that everyone is on the same page when it comes to mobile device security.
If this story has resonated with you, and you’d like us to take a look at your current backups, or your disaster recovery plan to check that it’s up to scratch and suitable for what your business might need, please get in touch. Just give us a call on 01373 768024 or book a call in the calendar below:
