Of course you would buy this if you had a million dollars in your IT security budget: A Million-Dollar Robot Suit Is Available On Amazon Japan. Who wouldn’t?
For those of us more constrained financially and with perhaps less signing authority than a million bucks, the reality of how to maximize your IT security budget looms at us in 2015. More to the point, a broad spectrum of companies fall into the category of “What IT security budget?”.
So, for those of us that need to push our giant robot suit back to the 2016/2017 budget, here are four ideas that will help you make the small pile of cash you may have target some of the more pressing security concerns your business may have.
1/ We could be doing a better job of backup
Although not nearly as exciting as the pop of fresh Styrofoam and bubble wrap as you open up you new fancy Firewall, backup remains the vital ground for IT security stress reduction and your business resiliency. As part of the CIA (Confidentiality, Integrity and Availability) triangle it would appear that because Availability comes last; it too often gets neglected.
In 2015 what is better than a backup? Answer: two backups.
Ideally, you need both on-premise and cloud-based backup. Best practice guidelines require off site, encrypted storage and cloud-based backups are way better than taking tapes offsite on a daily basis. On-site encrypted backup is useful for quick restores of the occasional file that gets corrupted, overwritten or goes missing.
2/ Buy and read a book or two
• Nmap Cookbook: The Fat-free Guide to Network Scanning
• Wireshark 101: Essential Skills for Network Analysis
If you want to do any work in IT security and understand the basics of securing a network and infrastructure you need to download, install and learn Nmap and Wireshark (these books will be your bibles). The software is free to download, but knowledge is, as they say, priceless. Having a managed switch to mirror ports and dumping the information into a machine running Wireshark becomes the number one way to identify security and other network problems on the infrastructure.
Malware will always betray itself at the network layer. Learning how to spot Command & Control communications from your machines lets you hunt down the bad guys in your network and kick them out.
3/ Implement an RMM tool
Full disclosure where it’s due: I work for one of the top RMM platforms. However, I am not kidding about this. If you really want to make improvements in your security and your budget is microscopic then you need to look at SaaS tools that provide a bundle of security basics, such as:
• Patch management
Patches correct security and functionality problems in software. From a security perspective, patches address vulnerabilities that are exploited by malware. Applying patches to eliminate these vulnerabilities significantly reduces the opportunities for exploitation.
• Managed Antivirus
Antivirus protects the workstation or server from being compromised. New viruses are coming out all the time and it’s the job of the antivirus software to keep up with the latest threats.
• Web Protection
There is nothing more effective than using a web filter to prevent network compromise by an accidental website visit. Web Protection constantly updates an ever-changing list of dangerously infected or known Command and Control websites.
4/ Invest in yourself and your users
Education and training for you as the Admin and for your users can go a long way in building your organization’s security culture.
For example, want to introduce 16-character passwords in 2015? Tell your users to use their eight-character passwords twice. Maybe also think about rewarding your more security-aware users with gift cards or coffee; hopefully that will encourage the others to be more security conscious.
For yourself, a SANS SEC505: Securing Windows with the Critical Security Controls
or EC-Council CAST 616 Securing Windows Infrastructure training course are great places to start. You will be very surprised at how many security features and free tools there are to roll out a “Harder to Hack” system for 2015.
As you can see from this list, security investment from 2015 does not need to be expensive, or completely based on technology. Incremental security improvements can be achieved with investment in yourself, users and low cost tools.
Ian Thornton-Trump, CSA+, CD, CEH, CNDA, CPM, BA is CTO at Octopi Managed Services Inc. Ian is an ITIL certified Information Technology (IT) consultant with more than 20 years of experience in IT security and information technology. He enjoys and maintains a strong commitment to the security community. From 1989 to 1992, Ian served with the Canadian Forces (CF), Military Intelligence Branch; in 2002, he joined the CF Military Police Reserves and retired as a Public Affairs Officer in 2013.
You can follow Ian on Twitter® at @phat_hobbit.