Posts

IT isn’t just about filling seats

No matter the size of your business, no matter what the product or service, your company is at least partially reliant on technology to survive and function in today’s marketplace. It is just unavoidable. A significant portion of everyone’s business is online in some fashion or other. And internal operations and administration are dependent on databases, servers on-line access, etc. A large and diversified company has the depth of staffing to fully support all of its IT infrastructure needs. Unfortunately, this is not the case with small- to medium-sized businesses, and it is absolutely not the case for recent startups struggling to get a foothold in the market. SMBs are generally forced to focus all of their resources on the operations that drive revenues. For example, how many small firms have a trained human resource practitioner on board, even though the lack of one can leave them vulnerable to a number of legal and staffing issues? Very few. They just don’t have the resources to devote to anything that isn’t sales or a critical line operation. The same tends to be true for an IT infrastructure support staff and the personnel “required” to support it 24/7.

The question then arises, how does an SMB begin to bring on the necessary resources to support their IT needs? A common solution is to bring on a generalist who will act as the IT director/manager and then that person will bring on additional, more specialized staff as revenue growth permits.

This is a pretty standard model for addressing IT support needs for a growing SMB. But does that really make the most sense? The issue with this model is that it follows a typical, hierarchical company org chart, but doesn’t necessarily meet the needs of a SMB. The IT demands of a typical company are very diverse, and one individual doesn’t have the depth and breadth of experience to significantly support every corner of your IT infrastructure. When resources for IT staffing are limited, creating the IT department that covers everything can be unrealistic. Building out this traditional model takes time and resources to make sure you have the IT support that possesses all the diverse skills needed to meet the many requirements of a sound IT infrastructure. As a result, this model may not truly meet the immediate/urgent needs of a developing or transforming organization. The alternative IT support is not from an organizational chart approach but from a risk management one.

What do we mean by a risk management perspective? For any business, but especially a smaller one without deep pockets, the consequences of some disaster may mean the end of the business. As a result, risk evaluation becomes critical. There are an endless variety of events, from mishaps to major disasters that challenge your viability. Risk management inventories all of the possible risks that could befall the organization and places them in a hierarchy of significance. At the top are single points of failure disasters or extreme events that would shut down the business, at least temporarily. Risk management then works to channel limited resources toward mitigating the most serious risks. How does this reflect on how you bring on IT support in your business? You bring on the support, either through hiring or an MSP on the basis of where your IT infrastructure is most vulnerable, not on the basis on “positions’” to be filled. This is a different approach and more appropriate for a SMB that has limited resources.

/by

Thing to do this week to start protecting your customer data

You have client or customer data in your possession. It is part of running your business in a digital marketplace. If that data is breached, it could permanently damage your reputation. We talked in an earlier blog about types of malware. There are many steps that you can take to protect your systems and data. Here are a few suggestions to protect your business from malware.

Consider a Managed Service Provider – Cybercriminals are very sophisticated and every day are releasing new, cutting-edge tools to attack businesses and individuals. Small- and medium-sized businesses do not have the resources to staff an IT department sufficiently to be aware of all the newest tools and technologies needed to protect a business. For example, a business owner cannot possibly keep up with the changes and details of tax laws. Doing it themselves, they would likely overlook important tax advantages or inadvertently break some IRS rule. As a result, tax preparation and accounting above the level of basic bookkeeping is outsourced to an outside accounting firm. You should consider looking at IT in the same way.

Updates – Always update your software. There will always be vulnerabilities in every bit of software that you use. Creators of software are constantly upgrading to close holes that could be exploited. Being attacked by malware because you are behind in upgrades is an avoidable error. That said, given the sheer volume of software applications accessing your network, you should consider outsourcing the administration and enforcement of this process.

Multi-factor authentication – Everyone is increasingly encountering MFA. This tool requires a second level of authentication in order to access an account or use a program. Generally, it involves entering a password then following up with a token you might be sent via text or email, or using a biometric measure, such as a fingerprint. An MSP can provide applications that can set up MFA to protect your data.
Access Control – You don’t give out keys to your house to everyone you know. Why allow all employees or vendors to access all of your databases or programs? Instead, follow the Principle of Least Privilege. That is, each individual only has the access to accounts, databases etc. that are absolutely necessary for them to do their assigned tasks.

Backups – Everyone knows they need to do backups, but handling these is more than just downloading data to a hard drive every evening. An MSP can provide you with the tools needed to handle backups appropriate to the needs of a business operation.

Employee education-This one cannot be emphasized enough. The individuals in your organization are your first and most critical line of defense against malware. As mentioned above, many types of malware need user action to get into your systems.

Here are some areas where training can help.

Phishing emails. These are mails that appear to come from legitimate sources, but are faked. Because the reader trusts the sender, they naively open a link that might be attacked which then downloads some forms of malware.

“Lost” USB. – Too often, individuals will find a USB drive left near a desk or dropped somewhere. The temptation to insert it into their computer to see what’s on it can be very hard to resist. ( This was part of what caused the Target data breach)

Password etiquette – Define standards within your organization about acceptable passwords. An MSP can help you set up programs that require employees to create passwords that meet your defined criteria. Also, consider fostering a culture that makes the sharing of passwords a performance issue that will be addressed by an individual’s supervisor.

Endpoint Detection and Response ( EDR): This is a solution an MSP can provide you with. At its basic level, EDR is a proactive approach to anti-malware software. EDR constantly looks at all of the endpoints in your network, tracks behaviors and identifies anything out of the ordinary. For an individual, anti-malware software may be sufficient. For a business that has multiple endpoints, this is not sufficient. ( Think dozens of employees connecting remotely via their own computer or smartphone). In a sophisticated business’s IT infrastructure, there are many endpoints which need to be evaluated.

In summary, there are many ways that an SMB can approach defending itself against malware. Some of these, such as employee training, can easily be done in-house. Others require a depth of experience that only your MSP can offer.

/by