Earlier this year, the FBI unveiled Operation Winter SHIELD, a collection of the 10 most impactful actions organizations can take to protect themselves against cyberattacks. October is National Cybersecurity Awareness Month, so it's a great time to review them.
Many of these will sound familiar. There's a reason the FBI identified them as the most effective steps in cybersecurity: they work. Use this list as a checkup for your own business.
1. Adopt Phishing-Resistant Authentication
Why it matters: Most breaches start with stolen passwords. Phishing-resistant authentication makes it much harder for hackers to use those passwords.
What to do: Move to FIDO2-compliant security keys or device-bound passkeys, starting with your most critical accounts.
2. Implement a Risk-Based Vulnerability Management Program
Why it matters: Hackers frequently exploit known vulnerabilities that were left unpatched because of negligence or low priority.
What to do: Keep a complete list of your digital assets and their potential risks. Set a regular update schedule, and patch the highest-risk items first.
3. Track and Retire End-of-Life (EOL) Technology
Why it matters: Hardware and software that have reached EOL no longer receive security updates. Any vulnerability discovered after EOL stays there for good.
What to do: Regularly check that everything you use is still supported, and replace anything that isn't as soon as you can.
4. Manage Third-Party Risk
Why it matters: Your security is only as strong as your weakest point of access. Third parties with access to your network can become an easy, unintended way in.
What to do: Monitor third-party access and its security implications like any other digital asset. You can't control the security measures your vendors use, but you can enforce security requirements when they connect to your network.
5. Protect and Preserve Security Logs
Why it matters: Reliable logs help you spot intrusions quickly. They show what normal operations look like, so unusual behavior that could signal a hacker stands out.
What to do: Make sure your logs are collected, protected from tampering, and kept long enough to be useful.
6. Maintain Offline, Immutable Backups and Test Restoration
Why it matters: Hackers often hold data for ransom, and they will try to compromise your backups to do it.
What to do: Follow the 3-2-1 rule:
- 3 copies of critical data
- 2 copies on different media types
- 1 copy stored offline and immutable
Then test your ability to restore data and systems from those backups. A backup you haven't tested is only a hope.
7. Identify, Inventory, and Protect Internet-Facing Systems and Services
Why it matters: Unnecessary access points are low-effort entry points for attackers.
What to do: Keep track of every internet-connected point in your network, and deactivate any you don't need.
8. Strengthen Email Authentication and Malicious Content Protections
Why it matters: Email remains a favored attack vector for hackers.
What to do:
- Train your team to recognize and report phishing attempts.
- Enforce DMARC, SPF, and DKIM on your email domain to help prevent scammers from spoofing it.
9. Reduce Accounts with Administrator Privileges
Why it matters: The more privileges an account has, the more damage it can do if it's compromised. Fewer all-powerful accounts means less risk.
What to do: Review who really needs admin access, remove the rest, and give the remaining admin accounts your strongest protections.
10. Exercise Your Incident Response Plan
Why it matters: An incident response plan is vital for recovering quickly and completely after an attack. But a plan that sits in a drawer is only half the job. Organizations that practice their plans respond faster, contain damage more effectively, and reduce their overall impact.
What to do: Run regular tabletop exercises so your team knows its role before a real incident.
Where Do You Start?
You don't need to tackle all 10 at once. Pick the two or three gaps that worry you most, and build from there. If you're not sure where you stand, that's where we come in.
Lighthouse IT Solutions helps small businesses keep their technology secure and their operations running smoothly. Our Harmony team can review your current security posture against these 10 actions and help you build a plan.
Contact Lighthouse IT Solutions to schedule a security review!