Protecting your business from cyber threats

In this technological age, the need to protect your business from cyber threats is a given. But how do you do that? Amy Foulks, Chief Information Officer for First Utah Bank, offers some concrete steps you can take to protect your money and your data. One of the first questions to ask is this: Who has access to your money and sensitive information about your business?

Employees

Consider the level of access for each employee. Adopt the principle of least privilege, meaning that you give an employee only as much access as he or she needs to do that particular job.

• What does the employee need access to in each software program?
• What files does the employee need access to on your network?
• What hours should they have access to it?
• What physical access should they have to your building(s)?
• Will the employee be allowed to work remotely, and what data will be accessible from outside your building?
• To prevent internal fraud, implement a separation of duties, frequently reconcile bank accounts and have that reconciliation reviewed by management, provide oversight on employee expense reimbursement, and safeguard and reconcile petty cash.

Vendors

How are your vendors — payroll companies, medical benefits administrators, CPA firms, consultants, marketing agencies, legal counsel and more — managing, storing and ensuring the safety of your information? Ask the question and make sure the answers satisfy the standards you’ve set for security. Investigate before granting any vendor request to change an account number, routing number or address.

Consider a layered information security approach

Creating a security-aware culture involves more than installing a firewall. It requires a plan. A solid plan should address each of these:

Management Oversight

• Audits
• Regular management discussions

Threat Intelligence & Collaboration

• Vendor communication
• Trade associations

External Dependency Management

• Vendors with access to your systems
• Employees working outside of your network

Incident Management

• Incident Response
• Table Top Exercises

Controls to protect assets