Cyber Security

#37: Cyber Security Series Pt. 5 – Conducting Security Audits

In this episode of The Power Up Project, we cover:

>Part 5 of our five-part cyber security series – Conducting Security Audits

>What is a cyber security audit?

>A wrap up of our cyber security podcast series


In this episode, we talk about conducting security audits.

Welcome back to the Power Up Project. It’s fantastic to have you here as we round out the final episode in our five-part series on our top cybersecurity defences for your business. So far in this series we have spoken about intelligent firewalls. We’ve spoken about cyber insurance. We have spoken yet again about multi-factor authentication. And in our last episode, we spoke briefly about cybersecurity awareness training for your staff.

So in this episode we’re going to talk about security audits. Now, this is a very open-ended discussion. A security audit can be very simple, and cheap, and easy. A security audit can be very in-depth, and prolonged, and expensive. So it really is a bit of a piece of string here as to how you perceive the risk to your business, if you have any particular requirements for compliance with any particular regulations for example, or if you have a board who are concerned about this and need to be put at their ease.

So at the simple end of the process, there are a number of routine scheduled checks that you can conduct yourself if you like, every three months perhaps, maybe more, maybe less, and check on some of the most common areas that can be a threat to your business. For example, one of the really easy ones that we see is user accounts left in place for staff who have left the business.

So of course we all have a seamless process in place where our HR is tied into our IT department, so as soon as a staff member leaves the business, of course that automatically triggers down closure requests to the IT department to close down all the user accounts. We all have that, right? Of course we do. But sometimes a user account can slip through the cracks and be left in place when it shouldn’t be.

So it’s a very simple matter then to run some reports, to log onto your systems, to check the user accounts in place, and tick them off against maybe a payroll report or something similar to make sure there are no extraneous user accounts left by the by. Now, that is just one simple example of how you can run these routine checks yourself to pick up on some of the low hanging fruit I guess, the easier and most common areas that are worth checking with a bit of a routine audit.

As we climb up the scale in terms of sophistication and also, therefore, expense, we get into more technical audits, until we get to the high end of the scale when we’re talking about things like penetration testing, we’re talking about real-time monitoring of infrastructure with intrusion detection, we’re talking about a lot of these big words here. And when you get to that end of the scale, this is when we start talking, probably not to your generalist IT partner, but this is when we start talking to specialist cyber security firms who live and breathe this type of audit, and protection, and defence, and activity.

So, again, it depends what end of the scale you would like to take this, but at the very simple end, it’s pretty easy for you to put in place a little reminder in your calendar, and maybe every quarter you run through a list of checks, run some reports on some key systems, make sure the things are the way they are. And you would be surprised how effective these routine audits can be in order to tease out some of those gaps that we inadvertently leave in our security.

That brings us to the end of our five-part series on our top most effective cybersecurity defences. I do hope that everybody got some value out of this. It really is a constantly changing and rapidly evolving landscape though. So it is something that, as business people, business owners, business managers, we do need to be staying in touch with and well aware of at all times. This is not simply a matter that we can leave to the IT people. This is a business-level issue, and we need to make sure we understand it at a business level, and not simply just delegate it down.

Thanks for joining us at the Power Up Project over the past five episodes to talk about the important topic of cyber security. Have you got any questions? Please, make sure you pop over to the website or the Facebook page and send us a message. We’d love to hear from you.

Thanks for listening to this episode of the Power Up Project, brought to you by Grassroots IT and Digit IT. Please leave us a review wherever you get your podcasts, and until next time, keep powering up.

#35: Cyber Security Series Pt.3 – Multi-Factor Authentication

In this episode of The Power Up Project, we cover:

>Part 3 of our five-part cyber security series -MFA

>What is Multi-Factor Authentication (MFA)?

>Why is it very important that MFA is enabled?


In this episode, we talk about the next in our five-part series of most effective cyber security defenses which is Multi-Factor Authentication.

Welcome back to The Power Up Project. Great to have you here. Today we’re going to be talking about the next in our series of five top cyber security defenses for your business and this is one that we have spoken about a number of times before in this podcast. So, for those people who’ve heard this all before, I do apologise but, it is a very, very easy, cheap and important one that you will need to be taking very seriously. And that is Multi-Factor Authentication.

So far in this series we have touched on having an advanced, intelligent firewall in place, we’ve spoken about cyber security insurance, and now we’re going to talk about Multi-Factor Authentication. Now, Multi-Factor Authentication in most cases is free or at least very low cost, is very easy to implement and, in my opinion, is possibly the most effective way we have at the moment of protecting our user accounts from malicious actors.

So, what is Multi-Factor Authentication? Multi-Factor Authentication is something that we are all going to be familiar with in business. It’s when we need another form of authentication in addition to our normal username and password in order to log on to an account. For example, we should all be familiar with this, with our internet banking. We log on to our internet banking with a username and a password but then in order to take any action within that account such as transferring money out of the account, we must enter another code. In my case, I have a little keyring dongle with a six digit numerical code that changes every sixty seconds and I simply read that code off my keyring dongle and I type it into the internet banking and my transfer goes through. So, that is Multi-Factor Authentication.

Multi-Factor Authentication within Microsoft Office 365 is there, ready for us all to use. It’s very easy to turn on and you can receive that secret code in a number of ways. You can receive it by text message to your mobile phone or you can receive it using the Microsoft Authenticator app which is a little app you can put in your smartphone that even lets you not have to type in a code but, simply press another button which says “Yes, approve.” But the point is, it is another level of authentication and specifically it’s another level of authentication that is based on something that you have. You have your mobile phone that receives that code, you have the keyring dongle that presents the secret key.

Multi-Factor Authentication is available in almost all modern cloud applications that we’re going to be using within our business. It’s available in all of the Microsoft Office 365 Suite, in Xero Cloud Accounting, in things like Confluence, it’s available for your social media application such as Facebook.

So, my homework for you today, given I’m not going to go on ad nauseam about Multi-factor Authentication yet again. My homework for you today is to write down a list of all of the applications and systems that you use in your business especially those ones that have something to do with the internet such as your email, such as your internet banking, your financial package, social media, those things. And then, I need you to Google each of those apps with the words Multi-Factor Authentication after it and check and make sure that that application does indeed support Multi-Factor Authentication and I can tell you in almost all cases the answer is going to be Yes. And then, I need you to have a look at your user accounts within that platform and make sure that Multi-Factor Authentication is actually turned on and enabled for all users. And it really does need to be all users. We certainly see some people who only like to enable Multi-Factor Authentication for those user accounts that they think are riskier targets or high profile targets. The unfortunate thing though about cyber security is that it often comes down to the weakest link. And the weakest link in terms of your network security maybe that one user account that you didn’t think really needed to have Multi-Factor Authentication turned on. So write the list, do a little bit of Googling and then go and have a look at all the user accounts in those systems and make sure that Multi-Factor Authentication is actually turned on. Of course, if you need any help, your IT people are there to help with this as well.

Thanks for listening to this episode of the Power Up Project, brought to you by Grassroots IT and Digit IT. Please leave us a review where ever you get your podcasts and, until next time, keep powering up.

#33: Cyber Security Series Pt. 1 – Firewalls

In this episode of The Power Up Project, we cover:

>Part 1 of our five-part cyber security series -Firewalls

>Why every business needs to set up an intelligent firewall


In this episode of the Power Up Project, we’ll be talking about the top five most effective cyber security defences for your business.

Hello and welcome back to the Power Up Project. Great to have you here. Today we’re going to be kicking off the first of a five part series where we talk about the top five most effective cybersecurity defences for your business. Now we all know that cyber security really is the hot topic at the moment. It is the hot topic at the moment for a very good reason. This is not just companies, IT, vendors etc., trying to push the new thing for the sake of it. Cyber security is a very real risk to all of us at the moment. We are seeing a lot of cybersecurity breaches on a very, very regular basis. Some of them are very high profile, others are less high profile, but certainly just as risky with potentially huge disruption to the businesses that have been compromised.

The terrible thing too is that in a lot of the cases where a business is compromised, it is not necessarily because they’ve done anything wrong. This really is a bit of an arms race between the hackers, the malicious actors, if you will, the security vendors out there who are producing defensive products for the rest of us to deploy in our businesses and also us, as business owners, and IT people to make sure that we are continually assessing our cybersecurity stance to make sure we’re doing everything that’s reasonably fair within our powers, and our budgets of course, to to protect our businesses. So today we’re going to talk about number one on the list of our top five most effective cyber security defences. And I’m going to talk now about firewalls. Now that is a term that everybody, I’m sure will have heard at some point, but there is a little bit of subtlety in understanding what we’re talking about here.

So essentially when an Internet connection connects into your business, there is a point of contact there at which the public internet, the public facing Internet there, hits what needs to be a secure line of defence and demarcation between that public internet and the internal network of your business. Now, in a lot of cases, what we see playing that role there is not really so much a firewall device, but it is more a routing device. So for example, at home you may have an Internet router, right? It might be ADSL router. It might be something that’s been provided to you by your NBN provider and that provides the point of demarcation there. But those devices are very simple devices. They do provide a level of firewalling security and protection for you. But it really is a very basic level.

In a business, given the current threat landscape, it’s becoming very important that we all look at what we have in place in our business in that position and make sure that we don’t just have a simple router, a simple firewall, but make sure that we do have an advanced firewall, an intelligent unified threat management firewall. Now this device plays the same role as the router, but more. It intelligently scans the Internet traffic that is passing between your internal business network and the Internet, back and forth. It filters that, it scans that, it looks for potentially malicious activity. It helps protect your users, your staff from browsing to websites that may be particularly threatening. It can also help in other ways such as helping to enforce internal policies, for example, to stop staff from browsing to inappropriate websites, not necessarily a site that may be a security threat, but maybe a website that is just not the type of content that’s appropriate in the workplace.

So how do you know if you have an intelligent firewall in place? Well, the best way to find out really is just to ask your IT people. But there are some more common brand names that we are seeing in Australia in these devices. There are names such as, Sophos, names such as Meraki, Sonicwall, WatchGuard. These are all the names of intelligent firewall appliances, intelligent firewall vendors, that do an extremely good job of protecting your business from that external threat, but also protecting it from those internal risks as well, as I touched on. Now an intelligent firewall is going to cost you more than a basic router or basic firewall. They usually also come with, an ongoing subscription cost because these devices are constantly in touch with their vendor platforms. So for example, the Sophos XG firewalls are constantly talking back to Sophos headquarters if you will, and updating their rules, their intelligence, their patterns, their knowledge of what is a threat and what is not.

So you do pay for that privilege. So there is an ongoing subscription cost that comes with these appliances. But again, this is just becoming the cost of doing business with connectivity to the Internet these days. So that’s number one on our list of the top five most effective cyber security defences for your business. So my homework for you for this week, find out whether you do indeed have an intelligent firewall appliance in place within your business there. And secondly, find out and make sure that it is actually in place with an active subscription. The devices will sit there, even if you don’t have an active subscription, but they’re not going to do a whole lot of good. So that second question you might have to ask your IT person about, but they’re the two things you need to be looking at for this week’s homework.

Thanks for listening to this episode of the Power Up Project, brought to you by Grassroots IT and Digit IT. Please leave us a review where ever you get your podcasts and until next time, keep powering up.