06/03/2024
11 Signs your organisation might be getting complacent with IT security:
1) Compromised accounts
End-users can often be the weakest point of security. They make mistakes. This is a numbers game. Even to the most security aware person - it only takes a momentary lapse and details can be compromised. Every organisation should have systems in place to minimise the risk. If this is a recurring problem, then it is a clear sign that security needs to be improved.
2) Unsure of the security that is in place.
Security doesn't happen by accident. Knowing what is in place is critical. How can you be confident in your systems if you don't know what is in place, and what protections are there?
3) No plan for further security improvements.
Security isn't a thing that you finish. It is always moving, evolving over time. There is always another step that can be taken. While you can't do everything at once, it is important to have a plan for what you are doing to improve security this year. Like many things in life, if you aren't moving forward you are actually going backwards.
4) Surprise when there is a security incident
No matter how secure your system is, there will be incidents. This shouldn't come as a surprise, and might indicate that a fundamental shift in security perspective is required. The world is knocking at your door. Time get on the front foot!
5) No plans of how to respond in the event of a problem
Something is going to happen, what are you going to do? You need to be prepared. Who are you going to notify for help. Who do you need to notify if 3rd party data is impacted. When do you need to notify them? How is your organisation going to continue to function?
6) Lack of cyber insurance
You have insurance for all the important parts of your business. Are you IT systems critical to you? If your systems were turned off right now and you had to start again without your data – what would the impact be? If this would have a significant impact, then it is worth having insurance to assist you.
7) Not aware of what the Essential 8 is, and how you compare to it
This is a suggested minimal/standard security requirements as advised by the Australian Federal Government. This list changes over time as the threat landscape changes. It is a great free and impartial reference point. Knowing where your organisation sits against these standards can give you valuable insights.
8) Staff are able to install software on their work computers
This is a big no-no, and is an easy avenue for infections or negative consequences. It is critical that any additional software to be installed is vetted and managed by your organisation, and not your team members.
9) IT Security is viewed purely as an expense to be avoided
Efficiency is key. Under-investment in IT security can be very expensive. A well secured and managed IT environment should bring you a “Security Dividend”. These are direct and indirect savings that can be made by having a secure and stabile environment. There are multiple layers of costs to consider:
* The interruption to your work-flow
* The cost paid to consultants to fix the issue
* Potential legal costs in the event of a data-breach
* Potential loss of future earnings due to reputation damages
With the full cost in mind, prevention will almost always be cheaper than the cure.
10) High levels of reactive support requests to fix issues
Hardware breaks, software has bugs, systems have outages, users need training. These statements are true – however – as a general statement the actual volume of troubleshooting should be minimal. If your organisation has a heavy need for IT support and assistance, there is a chance that you might benefit from proactive changes that further reduce risk.
11) No recent security reviews
You can’t know where you are going if you don’t know where you are. It can be very easy to over estimate your security posture. In a fast moving environment, an old review is almost worthless. Security needs to be reviewed and considered on a rolling (and regular!) basis.
We are an Australian owned and operated business. Helping other like-minded Australian organisations improve their cyber security posture.
Reach out to us if you organisation needs help getting on the front foot when it comes to cyber security.
