Summer is a time for sun, swimming, and relaxation. But not everyone rests during summer – the summer season is a time when many attackers strike, as many businesses wind down for vacation time. Fewer employees are on site to keep an eye on the systems, there might be summer temps who do not have as much experience, and things might simply fall through the cracks during the summer months. We give you 5 tips and a simple checklist on how to keep security work going during the summer!
1. Have a security training course
Criminals do not only exploit technological flaws, but often rely on human weaknesses to access sensitive data. It is therefore very important to maintain and build a good security culture. It is vital to keep all employees up to date on what the most important security risks are and what they can do to reduce the risk of a breach.
Before summer, it can therefore be a good idea to offer security training tailored to your business and the risks you face. Also make sure to have an open climate during the training so that there is room for questions, perhaps specifically questions concerning the summer months and what routines will apply during the summer.
2. Create a clear checklist for incidents
During the summer months, many people are on vacation, which means that regular staff might not be on site and that others must handle their tasks. It is therefore particularly important that there are clear procedures around incidents and incident management, so that the risk of misunderstandings and mistakes is reduced. Review incident management checklists and procedures, so there is never any doubt about how to handle an incident if, and when, it happens. This of course applies to regular staff as well as to summer staff. To be able to find ambiguities and gaps in your incident management, it is always good to have exercises where this is tested!
3. Have an incident exercise
To test and anchor your routines and policies, it is a good idea to organise an incident exercise before the summer, in which everyone including the summer staff participates. By creating a scenario where an incident occurs, any deficiencies can be detected and corrected. An exercise can be carried out in different ways depending on how much you can allow ongoing operations to be affected. The least you should do is go through routines and checklists, but ideally you should simulate an incident and let the staff carry out the practical steps.
4. Review your staff’s access
It is a good time to review staff access before the holiday season. It is always important to ensure that the right people have the authorisation required for their tasks, but also no more than they need. To review this, one can, among other things, double-check the authorisations that exist – especially before the summer when some employees may need to be assigned more access than usual. Also make sure that this is timed and that this access is removed when there is no longer a need. Keep in mind that summer staff should not be given more access than they need to perform their work.
Take the opportunity to conduct a review of the user accounts that exist. If there are unused user accounts, they should be removed as they can be exploited by attackers. If you do not have the opportunity to go through all the accounts, it is recommended to either focus on the ones with the most access, or a random selection.
5. Review your remote access
During the summer, some employees might work remotely, for example from their summer house. This is why it is important to review your system for remote access before summer.
Many organisations depend on remote access via RDP, for example for suppliers to be able to carry out maintenance, or for operating personnel to be able to monitor a facility. Secure remote access solves many of the security risks that are otherwise associated with such solutions. Common to many remote connection systems is that they are universal and have adaptations and functions for everything from office work to system administration. This also means that there are risks for misconfiguration as well as implementation bugs.
Remote access can be made secure by using RDP and protecting sensitive systems with an explicit security solution. One such solution is SecuriCDS ZoneGuard for RDP. The connection from the user’s PC is made as usual with RDP to ZoneGuard. The user is authenticated, and it is ensured that the connection is made to an approved target system, and at a time that is allowed. ZoneGuard then ensures that only screenshot information is allowed to pass from the target system to the user. In the other direction, only keyboard commands and mouse movements are transmitted. It is even possible to restrict so that, for example, only certain keyboard combinations are allowed. No other information is allowed to pass, which eliminates the risks of, for example, general communication, misconfigurations in connected systems or their software. Likewise, access to peripheral devices that would otherwise have meant increased risk is prevented.
Simple security check list to stay secure during the summer
- Do not use the same password for everything – and preferably use two-factor identification when possible.
- Remember to use a good password and never give out the password to anyone else.
- Are you traveling? Then you must have a solution to securely work remotely, so do not forget to follow your organisation’s guidelines for connecting via public Wi-Fi networks as these can be exploited to access your information.
- Do not click on links in suspected phishing emails and report to the IT department as soon as you suspect you have been subjected to a phishing attempt.
- Try to have regular boost sessions where you talk about security and remind yourself about what security policies exist, where you also go through the contents of these.
- Have updated devices – i.e. carry out all updates. The reason is that these updates contain security enhancements that you should of course be aware of.
Do you want to know more about how you can protect yourself against cyberattacks? Read our know-how!
Is there something you are wondering about? Do not hesitate to contact us!
