What Cyber Security Checks Should Businesses Carry Out This Autumn?

Autumn is a useful time for businesses to review their cyber security. As projects pick up pace and planning begins for the final quarter of the year, it is worth checking that your systems, devices and security processes are still protecting the business effectively.

A practical autumn cyber security review should cover software updates, user access, passwords and multi-factor authentication, endpoint protection, backups, employee awareness and your wider IT infrastructure.

Check that software and devices are up to date

Outdated software can leave known security vulnerabilities unaddressed. Businesses should check that operating systems, applications, servers, firewalls and other network-connected devices are receiving appropriate updates and security patches.

This is particularly important for devices that may have been left unused while employees were away over the summer.

An IT services provider can help businesses identify devices or software that have fallen behind and make sure updates are managed consistently rather than relying on individual employees to remember them.

Review who has access to your systems

Staff changes, new starters and changes in responsibilities can all affect access permissions. Review which employees can access sensitive information, applications, shared folders and administrative accounts. 

Someone who has changed roles may no longer need the same level of access, while former employees should have their accounts disabled promptly.

The principle of least privilege is useful here: employees should generally have access to the systems and information they need to perform their role, rather than unrestricted access to everything. This can reduce the potential impact if an account is compromised.

Check passwords and multi-factor authentication

Autumn is also a good opportunity to review how your business manages authentication. Encourage employees to use strong, unique passwords and consider whether password managers could help. 

More importantly, make sure multi-factor authentication (MFA) is enabled wherever appropriate, particularly for important business systems and administrator accounts.

MFA adds an additional verification step, meaning that a stolen password alone may not be enough for an attacker to access an account.

Review endpoint security

Laptops, desktops and mobile devices can all provide potential routes into a business network. Check that company devices have appropriate endpoint protection installed, correctly configured and kept up to date. 

Businesses should also consider what happens when employees work remotely or use devices away from the office.

Modern endpoint security can do more than simply detect traditional viruses. It can help identify suspicious activity and potentially malicious behaviour, providing another layer of protection for business systems.

Test your backups

A backup is only useful if you can restore your data when you need it. Businesses should check that important data is being backed up regularly and that backups are protected from unauthorised access. It is also important to test whether files can actually be restored.

Consider what would happen if your business suddenly lost access to its files following a cyber incident. How quickly could essential systems be recovered? Which information would need to be restored first?

These questions form an important part of business continuity planning.

Refresh employee cyber security awareness

Technology is only one part of cyber security. Employees also play an important role in protecting an organisation.

A new season provides a natural opportunity to refresh staff awareness around phishing emails, suspicious links, malicious attachments, password security and social engineering.

Training should be practical: staff should understand what suspicious messages can look like, what they should do if something seems unusual and who they should contact if they think they have made a mistake.

Creating a culture where employees report potential incidents quickly can be particularly valuable. Early reporting may give your IT team more opportunity to contain a problem.

Review your firewall and network security

Your firewall and wider network infrastructure should also form part of a regular security review. Check that security rules and configurations remain appropriate for the way your business operates. 

Unnecessary services, outdated configurations or poorly secured network devices can create avoidable risks.

Businesses should also consider whether their security requirements have changed. New cloud applications, remote workers, additional offices or new connected devices may mean that the IT environment is very different from it was a year ago.

An autumn cyber security check involves asking some straightforward questions: Are our systems up to date? Who has access? Are our devices protected? Can we recover our data? And would our employees know what to do if something suspicious happened?

A specialist IT support service can assess your existing infrastructure, identify potential weaknesses and help put practical security measures in place.