Buying new devices for your office can be expensive: not only is there the initial cost of the new hardware, but also the additional expense involved in setting up new equipment and integrating it with your existing workflow. Having expended all that money, the last thing you need is for your brand-new hardware to be the cause of a costly security breach.
The impact of data loss on businesses is staggering ─ with up to 60% of businesses that suffer a large data loss shutting down within a year. By being mindful of security when selecting new hardware, and by practicing good security with all the hardware used by your business, you can go a long way toward ensuring that your company is not among that number.
Here are our top tips for selecting, integrating and working with secure hardware.
Buy appropriate secure hardware
Hardware security isn’t just about the equipment that you use; even top-of-the-line hardware can become a security risk if not used correctly or if security best practices aren’t followed. That said, selecting appropriate secure hardware for your office is an important factor in security.
When selecting secure hardware, you should have a clear idea of the kind of sensitive information you’ll be handling. Any device you purchase for your business must have sufficient processing power to handle the encryption and decryption of this amount of data. Ensure also that any new devices are compatible with existing apps or systems, or that you have a plan to replace these apps and systems after adopting the new devices.
Hardware considerations don’t end with choosing the most secure hardware. You must also consider how the security of your hardware extends to today’s on-the-move workforce. Access need by employees to your corporate systems makes it critical to review your mobile device management as part of your total device management policy.
Appropriate policies can safeguard your systems against breaches coming from mobile connectivity to internal systems. For ease of use, many businesses opt for ready-to-use “off-the-shelf” equipment that supports encryption and is configured to facilitate regular backups and software updates.
Don’t neglect physical security
With as many as one-fifth of all attacks on data centers originating from within the centers themselves, it’s clear that even the most secure network can be physically vulnerable. Imagine your office is burgled ─ how costly will it be if a thief makes off with a laptop computer? How about a hard drive on which you store a backup of all your customer details?
To prevent this kind of disaster you should invest in a degree of physical protection for your secure hardware. Storing your backups in a secure off-site facility is a sensible move, as this will keep them safe from fire, flood or other disasters in addition to physical attack. Consider issuing cable locks for laptop computers too; this is an inexpensive measure, but one which could avert a very costly loss.
Physical security also extends to the protocols followed by your employees. Establish guidelines for the handling of sensitive information. Storing customer data on an unencrypted USB drive, for example, shouldn’t be acceptable. Provide hardware that has the ability to encrypt data and ─ if possible ─ a remote wipe facility to avoid the risk of a ransom attack should a device be lost or stolen.
Keep on top of hardware security
You’ve acquired hardware that meets the needs of your company. You’ve installed it and made sure that it isn’t vulnerable to physical attack. Excellent. The next step is to institute protocols that ensure your secure hardware remains secure into the future.
This means keeping software up to date, addressing issues as they emerge, and having a device management policy. Your IT department should be proactive in getting familiar with the new hardware and should work to stay ahead of any issues, rather than adopting a fix-it-when-it-breaks mentality.
Don’t forget to consider how you dispose of your old hardware as well as how you integrate your new equipment. Even hardware that has been wiped can still be used to attack your business if it is disposed of in an irresponsible way. Dispose of all hardware securely, thoroughly and in compliance with company policies.
Train your people
Many data breaches happen as a result of social engineering attacks ─ as reported by TechRepublic,
more than 40% of security breaches can be put down to employee negligence. These attacks target the human and aim to trick employees into divulging information, providing passwords, or otherwise compromising the security of sensitive data held by their company. If you’ve recently acquired new secure hardware, you may be particularly vulnerable to social engineering attacks, as employees may not yet be familiar with their devices.
To combat this risk, it’s crucial to train employees. Make sure they know how to take advantage of the security capabilities of their devices, and that they understand the importance of complying with your device management policy. By providing appropriate training, you can avoid the nightmare scenario of an unsecured device being lost or stolen.
Selecting secure hardware that is appropriate for your business is a key first step in having a secure hardware environment. It’s also vital, however, to back that up with effective security policies, training for employees, and a proactive approach to IT… as well as functional physical security. With all this in place, your office will be a safe, secure place to do business.