Security Center

Business Checklist

While all of the Consumer Checklist items can still apply for businesses, be aware of these items unique to businesses.

r Protect your computers from malicious programs by using anti-virus and anti-spyware software, as well as a firewall. Keep these programs up to date. If your company has one or more Internet sites, it is recommended that you incorporate intrusion detection and vulnerability management.

r Ensure that your employees cannot override or circumvent security software.

r Implement a policy of updating your operating system and security software on all computers, and assign someone the responsibility for seeing that this is done on a regular basis.

r Turn off and remove services that are not needed on computers. Do any of your employees need to use CDs, DVDs, or USB devices? If not, disable these unprotected conduits into and out of your computer system.

r Proxy your internet traffic to limit user access to malicious sites and to potentially block malicious software from communicating with a Trojan controller should malware make its way onto one of your company's computers.

r Make sure employee computer profiles have the least privilege possible. Very few of your employees should need 'Administrator access.'

r If you have employees who use laptops, consider implementing software that will determine if mobile devices have been infected before allowing them back onto your network.

r Review your account balance online on a daily basis to identify fraudulent transactions as soon as possible.

r Use a mail service that blocks or removes email file attachments that are commonly used to spread viruses, such as files that end in .VBS, .BAT, .EXE, .PIF, or .SCR.

r Install a pop-up blocker on your system.

r Establish a procedure that can be used by any employee if they think their computer may be infected. Make sure employees understand this procedure and the importance of using it.

r Ensure that only approved company applications are deployed on your computers and be sure to keep them updated (patched).

r Set rules about employee use of the Internet.

r Never enter personal or customer-specific information (e.g., account numbers, social security numbers, passwords, user IDs, other login credentials, etc.) into a public computer (those located in hotels, airports, libraries, etc.).

r Make sure all employees use good security habits. Develop a security awareness program that addresses the risks specific to your business and/or to the specific functions within your company. Update it to include any new risks that have developed and review it with your employees on a regular basis.

Return to Security Center Main Page