PICA Group

Information security (InfoSec, cyber, or IT security) is a critical component of any business. Confidentiality, integrity, and availability of IT assets are paramount in the modern digitised and technologycentric world. In Australia, medium businesses and enterprises (with 20 to 400 employees) face the same typical IT security threats as larger corporations – big end of town. In this article, we'll look at the various aspects of IT security for such businesses.

Understanding the Challenges

Challenge-wise, despite being mediumsized, these businesses still mostly lack dedicated or have limited IT and IT security staff. Coupled with a limited budget, this reflects that lean businesses have a primary focus on business aspects to survive in their competitive areas. Respectively, IT and IT Security functions usually have less recognition and support from senior management as compared to the main business, resulting in the depreciation of respective IT Security risks and threats.

Slowly, business leaders start to realise how heavily their operations depend on IT, and how severe could be the outcomes of IT Security risks. Therefore – let us look at the typical threats.

Despite the challenges, the threat landscape for medium businesses and enterprises in Australia remains the same as for large corporations – no discounts for size or smaller budgets and resources.

Daily business threats consist of malicious emails and phishing attacks, signalling the need for staff security awareness knowledge and practice of cyber security hygiene. Ransomware attacks are also very common, sided with threats of data breaches. Accidental or intentional, insider threats are likewise present in everyday routines.

IT infrastructure operations either on-premises or in a cloud, deal with threats of misconfigurations, unpatched or outdated software, third-party & IT supply chains, zero–day vulnerabilities, and legacy systems. Limited IT security staff often struggles to maintain upto-date policies, procedures, and working documentation.

Ease for regular business users to access Software-as-aService resources (shadow IT), the abundance of remote access, and staff working from anywhere – these are not new but more and more present threats from modern business practices. So how to face them?

Remediation controls to counter the threats relate to either technology, process, or people. They can be further classified by criticality – essential, recommended, or advanced controls (in order of criticality).

Delving into Essential Controls

Essential technology controls could start with the Australian (which would benefit any business worldwide) Cyber Security Centre's Essential 8 controls, even at Maturity Level Zero. These include application control, application patching, application hardening, MS Office macro settings, restricting admin privileges, patching operating systems, configuring multi-factor authentication, and backup data.

Other technology essentials are endpoint protection (EPP), network firewalls, secure email gateway (SEG), and virtual private networks (VPN) with remote access management. Disaster Recovery (DR) configuration, strategy, and procedure as well as a well-planned backup strategy are other strong points for businesses, especially with noticeable on-premises IT assets.

In terms of processes, it is vital to formalise IT Security policies, work procedures, and guidelines. This will require respective user education, focusing on people's IT security awareness training, ideally with tests and simulations. Approval of IT security policies by the CEO will also engage executive leadership support and get more compliance from all users.

"It Security Is Not A Point In Time Static State, But A Journey, Constantly Reviewing All Abovementioned Threats, Controls, And Challenges"

It is hard to imagine any medium business surviving against the modern threat landscape without having these above essential controls implemented. Even if some of them are not in place or don't cover 100 percent of IT assets and users, it is pretty much a matter of time before a cybersecurity incident happens.

Using Recommended Controls

Besides essentials, it is also recommended to invest in data leak prevention (DLP), secure web gateway (SWG), cloud access security broker (CASB), and vulnerability management (VM) controls. Processes could benefit from a formalised incident response (IR) plan, periodic IT Security penetration tests, and third-party security assessments. Access to a professional virtual Chief Information Security Manager (vCISO) is also a prudent measure.

These controls help to address more sophisticated threats or decrease the severity of incidents if they happen.

Advanced Controls

In case a business is a high-value and has low-risk tolerance, more advanced IT Security controls would include security information and event management (SIEM), managed detection and response (MDR) delivered by a managed security services provider (MSSP), Encryption of data at rest, cloud access posture management (CAPM), especially for cloud-hosted IT Assets.

An independent IT security assessment conducted by a professional assessor could help to highlight weak spots or define IT Security strategy. Businesses can assess their IT Security posture against the most popular cyber security frameworks, like ISO 27001 standard (Information Security Management System) or the National Institute of Standards and Technology (NIST - U.S. Department of Commerce).

If a business invests in the development of its business applications, these efforts should be respectively covered by its application security controls. Though this aspect is outside of the scope of this article.

As the closing remarks, IT Security is not a point-in-time static state, but a journey, constantly reviewing all the above-mentioned threats, controls, and challenges.

Once implemented, many of these controls require daily, monthly, quarterly, or annual operations, maintenance, or reviews. Delivered either by in-house staff, or outsourced to contracted MSSP, IT Security is an aspect of survival for many modern businesses, and this trend is only increasing.

The adversaries need to succeed only once out of endless attempts when security measures should always be on top. And as technologies are now used by every business user, likewise, IT security is everyone's responsibility.

Stay safe!