Top systems security tips

Most businesses today rely heavily on their IT infrastructure and the internet to keep their operation up and running. It is no wonder then that concerns about IT security come high on the list of key issues for many firms; Nicholas Jeffery, UK managing director of IT infrastructure provider PSINet Europe, outlines his top 10 tips for keeping systems secure.

1. Never take security for granted

The truth of the matter is that if any part of your business is online, then there is a risk that people may attack your systems. The global nature of the internet means that the risks are present at all times and no matter what level of protection your systems have, it is never safe to assume that your business is 100% secure. Unfortunately, like many other forms of insurance, security is something that companies feel they need to invest in only after they have been compromised.

2. Understand the risks

There are many potential dangers facing businesses online and every single system that you have connected, even indirectly or via a client, is at some level of risk. This means that the data and information you store on these systems, as well as their functioning is at risk. Could your business survive such a loss? Different businesses rely to different extents on IT, and some systems are more business-critical than others, so you must decide what level of risk is acceptable for you.

3. Don't panic

Although the consequences of a security breach can be very serious, it is important that you don't blow the dangers out of proportion. Examine the risks and balance this with what you can invest. Allocate your budget to where it is most needed rather than panic-buying a 'blanket' security solution for the entire business.

4. Know the enemy

It is much easier to take a level-headed approach to security if you know what you are up against. Different risks call for different measures and by assessing exactly what the threats are, you will be able to implement the most effective solution for your business. Professional hackers operate in a very different way to the army of opportunist amateur hackers you attract. Therefore the dangers you face, will depend largely on the type of business you run.

5. Don't forget the internal threats

Unfortunately it's a fact of life that more than 50% of successful attacks come from inside businesses' own networks. Improved knowledge of IT systems means that 'grudge' attacks and possible thefts by former employees or existing members of staff are becoming more frequent. Unpleasant as it may be, you must not forget to include these in any risk assessment. Simple measures like removing user accounts when someone leaves the company and keeping a security audit trail into your key systems can help prevent this major cause of damage.

6. Physical security is still important

Even in this era of virtual communications, the physical security of your network is still vital for your business. Controlled areas should be made accessible only to support personnel, and back-ups must be kept of all essential data in case of physical damage to the system. Choose an Internet Service Provider that takes physical security as seriously as logical security, and encourage staff to change network passwords regularly. Don't forget that a major security breach could be as simple as losing a laptop.

7. Take independent advice

Where possible, augment your internal knowledge with the advice from objective professionals. As long as they are made familiar with the purpose and workings of your business they will be able to give expert advice on the types of threats you are facing and the most suitable methods to combat them. Vulnerability assessments will be able to pinpoint the areas where your systems are weakest and will highlight the type of dangers that you are most likely to attract. They will also be able to explain the different types of security measures available and help you select those that suit your requirements and budget.

8. Make security manageable

As important as a good security strategy is, it shouldn't impact on your business. With the right infrastructure and external partners, your security processes should move just as fast as any other part of your business, underpinning rather than undermining the company's aims and objectives. The most successful IT security strategies are those that run throughout the whole business, acting as a foundation for the actions of every employee and department. By taking a holistic approach towards security implementation, processes that ensure your business' security can be seamlessly incorporated into the company's way of life.

9. Learn from your mistakes

If, despite the measures your business has in place, you suffer a security breach of some kind, it is essential that the incident be thoroughly investigated in order to prevent any similar problems in the future. Intrusion detection firms will identify any attacks on your network, even 'harmless' probes, and will assist in sealing the gaps that have allowed the hackers to get through. Any incident will provide you with valuable information on where your security is weakest, giving you the opportunity to strengthen the boundary before it can happen again.

10. Remain vigilant

The threats faced by your business will change on a daily basis. No matter how much confidence you have in your security solution, don't make the mistake of becoming complacent about the risks. All key systems and security processes should have a regular 'health check' to ensure that they are still functioning at the level required. IT managers need to remain up-to-speed on the latest threats and system vulnerabilities and have the power to take immediate action against them. Neglect will undermine everything that you have done and can instantly wipe out years of effort.