Staying safe if your IT security budget gets cut

As companies continue to struggle in today’s difficult economy, cutbacks affect all sectors of organizations. Unfortunately, IT security solutions are often not spared form the chopping block – a risky and shortsighted decision if you ask me, but perhaps that’s fodder for a future piece.

For now I’d like to focus on how IT groups – especially in small and mid-sized organizations – can remain secure with limited budgets.

This cheap and “low hanging fruit” of IT security includes:

1. Making sure that Windows Update is turned on and working on every machine, and that each system receives the latest updates every time. Automatic patch management is free. Consider any complaints you receive about machines rebooting to be the cost of security. And don’t forget to tell users to shut down their Outlook before they leave for the night so that their email won’t be corrupted by a reboot.

2. Keeping anti-virus software signatures up to date. Use the highest update frequency possible. This may mean checking for updates every 10 minutes. Malware is always evolving.

3. Educating users about:

• Opening email from hostile entities. Cover phishing, spear phishing, attachments, etc.
• Social engineering – so that access is not granted to those with a silver tongue
• Going to “interesting web sites” and downloading “fun” content that’s actually hostile malware
• Bringing in their own USB sticks or phones, and inserting these devices into their machines and potentially infecting the network
• Letting other people, such as family members, use company notebooks at home to surf the web or access email
• Key loggers – what they are, why they’re a threat, etc.

4. Making IT and the Help Desk paranoid about the network. Have them on the lookout for users who complain about slow machines, update services that no longer work or strange pop-ups, and take action IMMEDIATELY. Infections are no longer a mere annoyance that can be ignored; they’re now real business threats that can get out of control in minutes.

5. Managing passwords. Change passwords frequently, use complex credentials, and eliminate shared passwords.

Now, assuming cuts will have to be made, which aspects of IT security should you fight for and insist be spared at all costs?

• Never stop educating users (this actually is expensive because it takes time away from other work).
• End-users are the weak link.
• Don’t stop paying for anti-spam/malware/virus software running on your servers, but consider switching vendors or using a multivendor solution to improve the net.
• Never stop scanning your network for signs of an attack. Look for malware, key loggers, remote control software, and unusual network activity.

And, finally, if you are forced to cut down on security staff and products, and worry how these changes will affect your security posture, here are a few hints that will tell you if you’re in trouble:

• If your Internet bandwidth spikes at odd times when there are no employees working and no updates are happening.
• If there are a lot of outbound network connections to individual home systems and strange countries where you don’t do business.
• If users complain about slow performance, pop-ups or web pages that don’t load.

And remember, if you deal with credit cards or online banking, you’re a target. Good luck.