{"id":55047,"date":"2023-10-16T12:18:00","date_gmt":"2023-10-16T16:18:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=55047"},"modified":"2024-11-05T17:51:20","modified_gmt":"2024-11-05T22:51:20","slug":"5-ways-you-can-succeed-in-cybersecurity","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/5-ways-you-can-succeed-in-cybersecurity","title":{"rendered":"5 Ways You Can \u201cKnow Enough to be Dangerous\u201d in Cybersecurity"},"content":{"rendered":"\n

October is Cybersecurity Awareness Month, and the U.S. Cybersecurity & Infrastructure Security Agency (CISA) is calling on all of us to \u201cSecure Our World,\u201d with a simple message that calls everyone to action \u201cto adopt ongoing cybersecurity habits and improved online safety behaviors.\u201d This month, the JumpCloud blog will focus on helping you empower everyone in your organization to do their part regarding cybersecurity. Tune in throughout the month for more cybersecurity content written specifically for IT professionals.<\/em><\/p>\n\n\n\n

\n\n\n\n

IT admins are tasked with becoming security analysts in response to today\u2019s hostile threat environment. That can be a difficult adjustment if it\u2019s new to them and they don\u2019t know where to begin. The onus (and the blame) is on them to act, despite potentially never having received training for or awareness of security best practices to develop a program that will satisfy management and protect the organization.<\/p>\n\n\n\n

A formal cybersecurity program is multifaceted and structured to control risks, but there\u2019s a few crucial concepts you should be aware of that will help you get to a place where you know enough to be dangerous. Armed with these core concepts, you can swiftly reduce your organization\u2019s exposure, or, at the very least, have informed discussions with an MSP partner to handle it. There are five main pillars small to medium-sized enterprises (SMEs) should focus on:<\/p>\n\n\n\n

    \n
  1. Know your assets <\/li>\n\n\n\n
  2. Patching<\/li>\n\n\n\n
  3. Least privilege computing<\/li>\n\n\n\n
  4. Email security<\/li>\n\n\n\n
  5. Backups<\/li>\n<\/ol>\n\n\n\n

    This article examines how to bring those concepts into action.<\/p>\n\n\n\n

    This advice isn\u2019t an exhaustive checklist: it\u2019s part of a series of articles that provide additional guidance to formalize a security program<\/a>. There are also resources<\/a> for SMEs available from government entities to help guide you as you get started. IT admins should also consider training and education by pursuing certifications such as ECSS, GSEC, Security+, and SSCP to obtain baseline knowledge. I encourage you to check out my journey<\/a> for more perspective.\u00a0<\/p>\n\n\n\n

    Now, let\u2019s get real for a moment: SMEs don\u2019t necessarily have the capacity to establish a formal program and the typical mandate is always to do more with less. I\u2019ve encountered firms that would shock you when you glimpse behind the corporate veil; don\u2019t be one of them, have a plan, and be more proactive. <\/p>\n\n\n\n

    That\u2019s where you come in. Be an effective change agent by focusing on the foundational concepts outlined above.<\/p>\n\n\n\n

    Know Your Assets<\/h2>\n\n\n\n

    You can begin by creating a register of your IT assets, which is where a risk assessment begins. Start by identifying who \u201cowns\u201d the system or data and ask them about their departmental workflows. Then, ask questions about how these assets are configured, managed, and secured. They should at the very least be able to tell you what software and hardware they use, as well as where those records are stored. The outline below will help guide you. It\u2019s populated with real-world examples and notations from my work as a security practitioner working with SMEs.<\/p>\n\n\n\n

    Below you\u2019ll notice that assets are categorized in three ways: technical, physical, and administrative. Those align with the categories of controls that are used to address the problem(s) uncovered when you list and evaluate your assets. This outline is useful when you move on to the next step of evaluating risks and the type of controls that are required to correct them. You may also encounter some examples that you can live with and eat the cost.<\/p>\n\n\n\n

    Technical<\/a>
    \n