best cybersecurity practices

The Modern Office and End User Support: What it is and how it can help your business

February 21, 2019 by securewebsite

End-user support is an information technology (IT) term that is often used in business yet many people don’t understand what all it entails. Furthermore, business leaders don’t know how end user support can improve the productivity of their company. Here we take a look at what end-user support is and how it can keep your business moving forward.

What is an End User?
First, we must tackle what an end user is. Anyone who uses a particular product or program, typically your employees, is an end user. Think about the desktops, laptops, tablets, software, and even cell phones used by your employees to conduct business and fulfill their duties. They are the end users of your business IT.

Why Might End Users Need Support?
Whenever a new employee is onboarded, they need to be made a user so they can access the hardware, programs, and information within a company so they may perform their work. This means they need to be set up with a company email, account access, file access, and cybersecurity training that is specific to your organization.

In addition, employees will sometimes have trouble using the hardware and programs your business has purchased in order to operate. That can mean a computer with a virus, a laptop attacked by malware, or simply a program missing a necessary patch or update. While your employees may be great at what they do, not everyone is an IT expert. They may need help addressing issues from configuration to spam filtering in their business email.

Whether you have a small company without an IT department of its own or your business is a large one with an IT department is overwhelmed, these issues all must be addressed. When new employees are waiting to be onboarded or existing employees have hit the proverbial IT wall, they cannot work until these issues are resolved. That means downtime and a loss of productivity which negatively impacts your organization’s bottom line. That’s where outsourcing to IT specialists like those at ORAM can really assist your company.

What Does End User Support Look Like?
End-user support is about providing immediate, ongoing assistance whenever your employees need IT help. Think about having all email, account access, and training ready for new employees the minute they walk in the door on their first day. Imagine running into a snag with your email and being able to simply pick up the phone to fix the problem right away. Consider never having to worry about program updates or patches because they are applied automatically before you even get to the office. All of these very real IT issues are covered by end-user support.

The goal of end-user support is to provide businesses with the “modern office.” That means keeping end users productive and moving at all times. The question then becomes how does end-user support keep your business moving? In football terms, end-user support is like a lineman running in front of a running back to keep him protected and clear the path so he can do his job of advancing the ball. End-user support ensures issues with security, network connectivity, and active threats are held at bay. It also ensures your network is as reliable as possible, keeps up with patches, and hardware needs are covered.

With end-user support, your employees will have the tools to be continuously productive with little to no downtime. In addition, you will have the security of knowing those tools are also being used in a responsible, compliant, and efficient manner. Regardless of the size of your business, end-user support can help you manage your ongoing IT needs without sacrificing uptime, connectivity, or cost. Depending on which IT company you work with, your end user support may include:

• Antivirus Management and Support
• Configuration Services
• Hardware and O/S Maintenance
• Performance Monitoring
• Mobile Device Support
• Patch and Update Management
• Onsite Desktop and Laptop Support Services
• Incident Management and Resolution
• Priority Response Level and Problem Management
• Self-Service Knowledge Base
• User Account Administration
• Policy Management
• Email Content and Spam Filtering
• Encryption Services

Who Offers End User Support?
End-user support can be handled internally by your IT employee(s) if you have them and they aren’t completely overwhelmed themselves. The other option is to outsource your IT needs to a company like ORAM Corporate Advisors. Such IT professionals can work in tandem with your existing IT employees or can work in place of hiring your own IT staff.

Without the cost of hiring internal IT staff or additional staff, your network can be secure and running efficiently at all times through end user support. You won’t have to pay for support until you need it and help requests can be managed and resolved quickly and easily. Your business will also have all of the tools it needs to be continuously productive while achieving regulatory compliance.

If you need more information about end-user support, please contact ORAM anytime at (617) 933-5060. We can even schedule a free initial consultation to review your end user support needs. Our IT specialists are always available to answer your questions and help you when your business needs it most.

Major components of a solid cybersecurity plan for businesses

January 15, 2019 by securewebsite

It happens every day. Businesses of all sizes experience data breaches which can lead to the loss of proprietary or private client data, damage a company’s reputation, or even unleash lawsuits. The consequences can be so damaging, in fact, that an organization may face closure as a result.

In addition to the aforementioned concerns, small to medium-sized businesses face additional challenges that larger businesses often don’t; a lack of IT personnel, funding for strong IT, and knowledge for developing a cybersecurity plan, for example. With that said, there are several major components every business owner and leader should consider when creating a solid cybersecurity plan that will serve to best protect their organization.

IT Audit
The first step in creating a cybersecurity plan for your business is to conduct an IT audit. An IT audit is when your company’s information technology (IT) infrastructure, policies, and operations are examined and evaluated for security purposes and to see if they measure up to best practices. This will help determine where your security is strong and where it needs improvement.

Information technology audits allow businesses of all sizes to determine if the controls (hardware, software, practices, and policies) they have in place protect the company’s assets, ensure the integrity of data, and align with the organization’s overall goals. These audits are typically conducted by IT auditors who examine the physical security of your business in addition to the security of your information systems ranging from financial controls to your company’s overall business policies.

Some IT organizations such as Oram Corporate Advisors offer free technology assessments to get you started. These free technology assessments can assist in strategically evaluating whether your IT infrastructure is ready to grow, identify areas of opportunity for improvement, and can “red flag” areas that require deeper analysis and adjustments. Just remember that all technology assessments are not created equal and you often get what you pay for.

When it comes to IT audits, they can be expensive, but businesses need to have them to secure their organizational data, assure clients that their information is safe, and to protect their reputation. Additionally, many industries are now required by their state and/or federal government to participate in regular audits among other IT regulations. Be sure to check with your state and federal government to determine if your business is affected by such IT regulations. Your IT auditor should be able to answer these questions for you as well and assist your business with regulatory compliance requirements.

The cost of an IT audit can be prohibitive for many small to medium businesses. As a matter of fact, they can run into the thousands depending on how much work has to be completed to conduct the audit. Fees are typically charged on an hourly basis and can range from IT company to IT company. Most IT auditors should be willing to give you a free estimate, however, so you know what your investment will be.

Employee Training
The next step in developing a solid cybersecurity plan for your business is to train your employees. After all, your employees can be your strongest line of defense or your weakest link. Information technology best practices require regular IT training for all employees.

Every employee should know certain IT rules such as not opening emails or attachments from unknown or untrusted sources. Phishing scams are one of the most common ways hackers attempt to infiltrate business networks using email. Other items employees should be trained on include spear-phishing, executive whaling, and malware. Training should also include specific company IT policies and procedures that support better data security. Employees should also be trained in a myriad of other topics such as the proper disposal of confidential data (both digital and hard copy), how to handle requests for information, and how to report a suspected breach.

A blog by Forbes magazine online offers small and medium businesses five tips on how to train employees. While these are general training guidelines for any type of employee education, they can also be applied to IT training. In addition to hosting your own educational meetings, most IT companies offer employee training for best IT practices as well. The cost for such training will depend on which company you hire, how frequently you wish to schedule training, and how many employees you have.

Your WISP
The third component of your business cybersecurity plan should be your written information security plan or WISP. This encompasses many items and includes several steps in and of itself. You will need to sit down with an IT specialist and outline a WISP that is specific to your business and the information it holds. Your WISP will need to include the following at a minimum:

Objective– Outlines your WISP including the creation of effective administrative, technical, and physical safeguards for the protection of personal and proprietary information.

Purpose– Outlines what your WISP will do such as ensuring the security and confidentiality of personal information, protect against any anticipated security threats, and protect against unauthorized access or use of information.

Scope– In formulation and implementing your WISP, outline the scope of the plan including reasonably foreseeable internal and external risks, the potential and likelihood of damage caused by such risks, evaluate the sufficiency of your existing IT policies, and design and implement a WISP that puts safeguards into place to protect data. In addition, regular monitoring of the effectiveness of those safeguards should also be included.

Data Security Coordinator– Designate a data security coordinator in your WISP that will implement, supervise, and maintain your written plan. They will head the initial implementation of your plan, train employees, and regularly test the safeguards outlined in the WISP. The security coordinator will also evaluate the ability of each third-party service provider to supply appropriate security measures for information to which they have access. They will also review the scope of the security measures in the WISP and conduct annual training for all employees including the owners, managers, and independent contractors as well as temporary employees who have access to personal information.

Internal Risks– Identify probable internal risks to security, confidentiality, and/or integrity of electronic, paper, or other records containing personal or proprietary information. Also evaluate how to limit such risks and implement necessary measures for reducing them.

External Risks– Identify probable external risks to security, confidentiality, and/or integrity of electronic, paper, or other records containing personal or proprietary information. Also evaluate how to limit such risks and implement necessary measures for reducing them.

Implement Your Plan
Implementing your business’s cybersecurity plan is the next step. This includes adding data security features you have opted to employ in addition to making employee training a reality, integrating new software such as updated anti-virus and/or firewall programs on your network, and updating patches to existing software.
Other layers of your cybersecurity plan should include:

Social Media Education– Hackers can find personal information online from social media sites such as Facebook, Instagram, and LinkedIn that they can use to manipulate employees of companies, getting them to disclose personal or sensitive information. Train employees about social media best practices as well as the use of different passwords for each site, software, or application they use. Emphasize your company’s security protocols as well as IT best practices such as the use of least privilege.

Let’s Get Physical, Security– While you may think your building is secure enough to protect your sensitive data, good hackers know how to penetrate this type of security. Be sure not to leave computers exposed and destroy all hard drives using professional services. Physical security breaches can be avoided by encrypting hard drives, leveraging cloud backups, and enclosing hardware ports exposed to the public. Employing theft recovery software, checking door locks and cameras, and properly disposing of shredded paper also help.

Wi-Fi Protection– Wireless internet can also pose a threat. Wi-Fi signals can extend beyond office walls. A bad actor can connect to your signal from far away and infiltrate your network where they can steal files containing proprietary or personal information. Businesses should employ WPA2 (Wi-Fi Protected Access 2) protocols as they are safer than the old WEP (Wired Equivalency Privacy) or WPA (Wi-Fi Protected Access) protocols. Ensure your router has a strong, unique password that is not easily guessed.

Password Protocols– Passwords should be changed often and kept private. Train employees on this and teach them that the strongest passwords include uppercase and lowercase letters, numerals, and special characters. Additionally, passwords need to be different across all accounts. The best way to remember passwords is to use a password manager. There are some free password managers available but the most secure ones typically charge a small annual or monthly fee. Most also allow businesses to sign up for a membership that covers all employees.

Two-Factor Authentication– Even with difficult, unique passwords on every account, seasoned hackers can often penetrate security. As a backup, it’s best to employ multifactor authentication wherever possible. Most large companies use it including Apple, Google, and Dropbox. Using a mobile number and/or email account, multi-factor authentication provides an added level of security. Your business can also implement it with other applications and services as well. New technology such as facial recognition, fingerprints, and/or ultrasonic sounds are on the near horizon and companies should prepare to employ more secure technologies as soon as they are commercially available.

Email Security– This is the most necessary asset for your business to protect. Once in your email, hackers can reset passwords and wreak all types of havoc so be sure to prioritize protecting company email. Never click links in emails or attachments from untrusted or unknown sources as these could take you to a phishing site that looks like a real website. Using Google Gmail and Google Apps is recommended given they have the best spam, virus, and phishing protections available in addition to multifactor authentication already built in.

Anti-Virus– Keep your anti-virus updated at all times. While this helps protect your email and other sensitive information, new malicious viruses are always being created. That means anti-virus companies are always updating their software to address the threats on their “blacklists.” Consider using a service that employs a “whitelist,” which only allows software and programs that are pre-approved to be downloaded adding extra security to your network.

If you need assistance with conducting an IT audit, crafting an IT plan or WISP, or implementing your plan, contact Oram Corporate Advisors today at (617) 933-5060. You can also reach out to us online. Our professionals are always here to support your business with superior IT and IT services.