Business planning blog It gives you wings

This is the third in a series of twelve articles written by Orthus for the non-technical managers at small to medium sized companies who operate smaller networks and may lack a sophisticated in-house information technology department. Step 3 – Install & Miantim Anti-Virus Programs Cost: Low – Site licenses are available Technology skill level: Low to medium depending on selected approach Participants: Everyone using the network devices Why do it? Anti-virus programs are a low-cost means of protecting your systems and information from external threats. Viruses (malicious code embedded in files) exploit vulnerabilities within the technology environment, and the number of identified vulnerabilities has doubled annually since reporting was initiated in 1988.   Vulnerabilities exist in every aspect of the hardware and software available in today’s marketplace. The most widely publicized viruses are transmitted via e-mail attachments, and infection is initiated when they are opened. Viruses can infect a computer in many ways: through floppy disks, CDs, e-mail, websites, and downloaded files. When you insert a floppy disk, receive e-mail, or download a file, you need to check for viruses. Anti-virus (AV) programs look at the contents of each file, searching for specific characters that match a profile or pattern–called a virus signature–known to be harmful. For each file that matches a signature, an AV program typically provides several options, such as removing the offending pattern or destroying the file or e-mail attachment that contains the virus. When AV program vendors learn about a new virus, they provide an updated set of virus signatures, which must be loaded onto each machine to catch new problems. Automatic update options can be activated for individual machines. What Happens without Anti-Virus Protection? Intruders have the most success attacking any computer when they use viruses as the means for gaining access. Installing an AV program and keeping it up-to-date are among the best defenses. When a machine is infected, software can be disabled and data destroyed, and the affected machine will attempt to infect other machines, consuming available communication bandwidth, choking networks, and overloading servers. Protection is needed at each machine. Getting Started Install anti-virus software on every machine and keep the signature files current through automatic or manual updates at least weekly. Renew the automatic update capability annually as required to maintain a current virus signature file on every machine.   DO NOT connect to the Internet without first activating an AV program. Educate all computer users to remove or destroy infected files identified by the AV software. Make sure they know how to remove their machine from the network and who to call for help if they suspect an infection. Educate all e-mail users not to open e-mail attachments from unexpected and unknown sources (see Step 2) to avoid unleashing a new virus not yet blocked by the AV program. Additional Steps Enable the AV program to automatically check every file source on each machine when it is used (CD, floppy, etc. ). Require periodic AV examinations of all files on a regular basis, preferably weekly, to catch problems missed at other checkpoints.

Continue reading A 12 STEP PROGRAM TO SECURING YOUR SMALL-TO-MEDIUM SIZE BUSINESS: STEP 3

This is the fifth in a series of twelve articles written by Orthus for the non-technical managers at small to medium sized companies who operate smaller networks and may lack a sophisticated in-house information technology department. Step 5 Remove Unused Software and User Accounts; Clean Out Everything on Replaced Equipment Cost: Minimal – No additional investment Technology skill level: Low to medium Participants: Technical support Why do it? Computer systems are delivered with a myriad of options, many of which you may never use. Also, the installation process is designed for ease and not security, so functions that are major security problems are often activated, such as remote file sharing. Software that is no longer used will not be maintained and should be removed from the computer systems so that it cannot be used as a way for attackers to harm your systems. Every user of the computer system should have a unique account that limits access to the data and software they need to do their job (see Step 1).   When they leave or change functions, the access capabilities need to be terminated or adjusted to meet the new job.   Standard management techniques, such as separation of duties, need to carry into the electronic environment to limit the risk of one individual causing harm to the business. A tremendous volume of data can be stored on disk drives, and this information is not removed when the files are deleted. Additional data is stored in temporary files used by software on the computers.   Anyone can retrieve this information by accessing the disk through another computer.   For equipment that is removed and repurposed, discarded, given away or sold, the disk space must be overwritten to avoid sharing confidential and sensitive data. If it’s not in the way, can’t I just leave it alone? Unused software and user accounts are not like books gathering dust on the coffee table. Each has the potential for allowing an attacker to gain access to the system. With access the attacker can take confidential information such as credit cards and customer names and damage and destroy files and programs. Attackers can also use your systems as a base to attack others, and these victims can sue you if their losses are high. Control of computing access needs to be managed just as carefully as cash since the loss of important information can be as detrimental to a business as the loss of money. If unused accounts belonged to former employees, they can keep current on your business and steal or destroy confidential information by continuing to use their system access. As you upgrade equipment, the data stored on the replaced machinery does not go away. Utilities are available to retrieve deleted files and information from reformatted disks. Getting Started Remove accounts for terminated employees when they leave. When firing someone, remove the computer access before notifying them and arrange for a monitor while they are on premise. Establish a policy that unneeded software not be installed on company computers (i. e. games, free download software, music players, etc. ). Establish a process for removing data on all computers hard drives when equipment is repurposed, discarded, donated, and sold.   Use a utility program to remove all information by overwriting all available disk space. Additional Steps Uninstall software that is no longer in use and archive data files that are no longer used. The less clutter on the system the easier it will be to manage backups and keep software on the system at a current update level. While it may be convenient, it is very risky to rely on vendor defaults for your system. Default functions are attractive targets for attackers –the likelihood of availability is high since most installers will choose the default. Reduce your visibility as a target by explicitly selecting only the computer functions you need at installation. If you do not know what a function is, check the help information and make sure it is something you need before turning it on.   A little time at the start can save you from major trouble later.

Continue reading A 12 STEP PROGRAM TO SECURING YOUR SMALL-TO-MEDIUM SIZE BUSINESS: STEP 5