Thanks to visit codestin.com
Credit goes to www.scribd.com

Scribd
Upload
20 views2 pages

SMB Security Risk Management Guide

This document provides a checklist of questions for companies to consider regarding their information security preparedness. It addresses endpoints/servers, personnel security, physical security, network security, and asset security. For each category, it lists several questions about security measures and policies in place, such as whether antivirus software is used, credentials are strong, personnel are trained, physical locations are secure, firewalls are implemented, and devices are patched and accounted for. The checklist is intended to be used by companies to examine their security risks and ensure all relevant questions are considered.

Uploaded by

net13ops
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
20 views2 pages

SMB Security Risk Management Guide

This document provides a checklist of questions for companies to consider regarding their information security preparedness. It addresses endpoints/servers, personnel security, physical security, network security, and asset security. For each category, it lists several questions about security measures and policies in place, such as whether antivirus software is used, credentials are strong, personnel are trained, physical locations are secure, firewalls are implemented, and devices are patched and accounted for. The checklist is intended to be used by companies to examine their security risks and ensure all relevant questions are considered.

Uploaded by

net13ops
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 2

Information Security Preparedness

Checklist
You should always use your own risk assessment capabilities to examine the
security risks in your environment. During this course, you made a quick list of the
risks your company and industry face. As a further resource, here are some
questions to keep you going. You can treat this like a checklist, and make sure that
each question has been considered (if it is relevant to your company).

Endpoints/Servers:
● Do you have antivirus software?
● Is it centrally managed?
● Do the infections get automatically quarantined or are there
breakthroughs? (Consider better AV or behavior-based endpoint detection
and response [EDR]).
● Are all your default credentials changed?
● Are all your credentials strong and mandated to be strong?
● Are your end user credentials rotated at least annually?

Personnel Security:
● Have you trained your personnel?
● Do you test your personnel on that training?
● Do your people know what to do in the event of an information security
incident?
● Do you know who the common targets are—those who get phishing
attacks or malware the most?
● What if you train them and they continue to click bad links or reply to bad
emails? (You need a policy with teeth.)

Security Risk Management in a Small to Medium Business Environment


Information Security Preparedness
Checklist
Physical Security:
● How secure is your computing equipment physically from:
○ Theft?
○ Fire?
○ Flood?
○ Electrical outage (Short or long term)?
● How secure is your physical office location (if you still have one) from
theft, fires, floods, or electrical outages?
● How secure is your data center from unauthorized access? Do you have
cameras? Do you have multi-factor authentication on the door?
● Have you had a physical security penetration test?
● Do you train your employees on physical security?
● Does your worksite have safety issues? Is there a risk of further safety
issues?

Network Security (LAN/WAN):


● Do you have firewalls?
● Do you have lists of public vs private addresses?
● Do you audit that list regularly for changes?
● What is public? Is it secure? Has it been pen-tested?
● Do you check the access of your endpoints/public sites against known bad
actors?
● Do you monitor and control egress traffic (categorical blocking, allow/deny
lists, etc.)?
● Do you monitor and control ingress traffic (known bad actors, entire
geolocations, etc.)?

Asset Security (Devices):


● What devices do you have? (Look at purchase orders to get a source of
truth.)
● How many of each type?
● Who has them? (Cloud, office, someone’s home?)
● Who is supposed to have them? (Usually when conducting this audit,
you’ll find at least one item that is not where it’s supposed to be.)
● Have old devices been returned?
● Have old devices been securely destroyed? Is this necessary?
● Are your devices getting patches?
● Do your devices have vulnerabilities?

Security Risk Management in a Small to Medium Business Environment

You might also like