As a structure in routine and ordered way many companies need to put in place clear processes and rules that will help significantly to the overall performance and quality of the services.
By the governance aspect there are some recommendations that can help to arrange our processes and environment.
○ Board to validate projects from a security perspective
This aspect can include a group of people like CSO, CISO or other leading board members that will take a crucial decision on company’s infatuation and implementation. All people in this boarding team is planning strategically and make their decisions based on security considerations as hardening the systems, network, reducing the attack surface and many other points needed in the organization.
○ Rules about what is allowed and not allowed
To be able to secure better ourselves in one organization it’s needed to adopt solutions as password management, password policy and for example also background checks while hiring process. Password management can include some products as key pass, passbolt or similar products where we can save and keep our passwords in safe vault protected by secure master password. Password policy can include variety of domain policies that can be applied and enforced so that way our password to meet specific conditions and to be compliant with them. For example, these policies could be a specific password length, minimum password age, restriction of repeating the same passwords, requirements for strong passwords and many others. The background checks can include internal systems for additional detailed checks of the candidates for a new job and these checks can include data on different levels.
○ Security audits and validations and the following rules
In every company the audit is a vital part of the proper function and monitoring of possible security incidents. This tracking activities are so important because only if we have logs and any trace, we can make a full picture and to construct what was done and what was happened earlier. Security audits can also find a specific IP or group of IPs from where the attack is origin that is really important in our documentation and next following actions. Normally in the large environments there are functional audit systems as SIEM or similar products that can monitor in real time a broad amount of activities and store their logs for accountability purposes.
○ Setup security program to make all the organizations aware of the security good practices
By security awareness point of view is really important to train our employees regarding the good practices in our security program. It’s needed to conduct regularly trainings to improve their security knowledge – for example what actions have to be taken in case of stolen computer, virus infection or how to keep clean desk policy. This simple tip looks sometime negligent but in fact a small thing as regularly changing our passwords can avoid significant breaches or potential threats. Attacks like social engineering and phishing can also impact our business if we can’t recognize them or not able to react them properly due to ignorance or lack of knowledge.
This kind of projects are wide and need support of all the organizations. For better categorization and order they can be grouped mainly in the following sectors:
○ Communication – in many cases is needed to communicate on the “same language” with the Customer, to expose our point of view and advises in understandable manner and to be sure that the people understand our message. The communication and good skills in this area are one of the most important things in the business at all because that way could be avoided some misunderstanding or worse misleading. In the dynamic world of huge amount of information and attacks in every second worldwide literally the proper understanding and communication are in the hearth of our success helping us to make the proper decisions.
○ Legal – in our daily work in many cases it’s needed to work with suppliers and some third parties.
For that goal one of the most important things is to sign a contact management with this suppliers or partners. This is needed if in the process of work there are any conflict situations and with this signed by both sides contract it’s possible to prove if we are right in some specific situation. So called compliance rules are also part of this documentation and are some type of reference point, like a base line that one partnership has to meet.
○ Technical & non-technical staff
There is a need to audit and our resources in the company that include technical and non-technical stuff. Every year at least once is good to be performed inventory to know our assets if they are on place and how they are. The other side is non-technical or services and human side – how many people we have in the company, which they are? Also, what services are installed on the office computers and what applications or programs are running on the hardware. With the proper audit of the both resources we can keep the integrity of our company as well as and better understanding of what is going on inside
Technical & non-technical staff
There is a need to audit and our resources in the company that include technical and non-technical stuff. Every year at least once is good to be performed inventory to know our assets if they are on place and how they are. The other side is non-technical or services and human side – how many people we have in the company, which they are? Also, what services are installed on the office computers and what applications or programs are running on the hardware. With the proper audit of the both resources we can keep the integrity of our company as well as and better understanding of what is going on inside.
Contact us to help you today to guide or help you with specific solution.
Our contact details are:
e-mail: contact@l-a.lu | phone number: +352 26 39 34 98
