KACo provides an excellent Cybersecurity Checklist developed in partnership with the Kentucky Office of Homeland Security (KOHS) and the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Let’s dive deeper into KACo’s Cybersecurity Checklist to gain an in-depth understanding.
- Using multifactor authentication: Multifactor authentication is more than just a password. MFA requires a password plus another authentication method. The most common forms of MFA include a passcode sent to your cellphone or software used on your cellphone to accept the login. MFA is a prevalent option for authentication security.
- Backing up critical information, testing backups: Data backups are essential for disaster recovery and business continuity. A crucial piece of the data backup process is testing your backups to verify they work. Make a plan to test your backups regularly.
- Updating operating systems: Patching operating systems and third-party software mitigates the risk of hackers attacking your network using known vulnerabilities. Utilize endpoint management software to automate the process.
- Staff training on pertinent cybersecurity issues: Educate your employees on social engineering. Utilize affordable options to create phishing tests that include training for those who click on phishing emails. Send out reminders of the importance of slowing down and verifying email senders.
- Accessing free cybersecurity services: Take advantage of free services offered by CISA. In addition to free services, smaller organizations may be eligible for free software.
- Incident response plan development/testing: Review your Incident Response Plan (IRP) annually to verify that the process has not changed. Create a tabletop exercise to confirm that your IRP still functions as designed.
- Disaster recovery plan development / testing: Disaster Recovery Plans (DRP) require review and testing just like an IRP. Develop a team to administer your DR and test your DRP regularly. Much like the IRP, you will benefit from creating a tabletop exercise to test your current plan.
- Monitoring activity across IT systems via logging: Logging software is necessary when identifying network issues. Think of logging as a receipt for every action within your network. In the event of an incident, logging will help identify issues quickly.
- How to prioritize cybersecurity throughout your organization: Talk to leadership and identify cybersecurity concerns. Work on a plan with shareholders and gain buy-in.
- Vulnerability assessments: Network scanning and external/internal pen tests assess the security of your network. Regular updates to systems reduce vulnerabilities. Upgrade the firmware on network equipment regularly.
- Development and implementation of a cybersecurity policy: A cybersecurity policy is a guide for the organization to follow to implement and maintain a cybersecurity program. Plan for different types of cyber events, such as malware and ransomware.
- Designation of internal employee for cybersecurity oversight: The cybersecurity policy and program require an internal employee or team to verify actions are being taken and that the organization is secure.
One takeaway from the provided information should be that cybersecurity is a continuous process.
Just like with any task, start with the basics and build a plan for success. Evaluate your network and process. Reach out to companies that offer evaluations and advice to secure your network. Once the process begins, you will quickly identify issues that need immediate attention and others that aren’t top priority.
