I was invited to make a presentation on the topic of “technology” at the annual Not-For-Profit Leadership Summit conference on May 10, 2010.  This conference, sponsored in part by our good friends (and client) the United Way of Westchester and Putnam, brings together leaders in the not-for profit sector. 

My Challenge
I’m certainly comfortable presenting solutions that will improve the IT security and reliability of a company—but usually these are solutions that cost money.  Money that is usually paid to Pragmatix.  After all, that is how we stay in business.  Given the state of the economy, and the extra pressure that brings to not-for-profit organizations, I was asked to present solutions that don’t cost money.

My Approach to the Problem
Realizing I might be facing an audience with diverse needs, and diverse technology platforms as well, I looked to focus on the most common—and serious—problems that organizations are facing, and then identify no-cost ways to address those problems.

My starting point was a recent study that was published by the non-profit SANS institute (see http://www.sans.org/top-cyber-security-risks/), a pre-eminent computer security training , certification, and research organization.   In their report, they identify the top 3 cyber security threats. The report, by the way, was based on attack data from six thousand organizations, and vulnerability data from nine million systems.  So these risks are not theoretical, they reflect what is actually happening in the world. The three biggest risks are:

  • Client side software that remains un-patched
  • Internet facing websites that are vulnerable
  • Rising zero-day vulnerabilities

My Solutions
Having identified the key, real-world risks, I then set about finding no-cost solutions that would reduce or eliminate these risks.  I came up with Ten Things to Improve IT Security and Reliability that don’t Cost Money:

1. Log in as a Local User, Not as Administrator

2. Apply Patches and Updates Promptly

3. Run Vulnerability Scans on your Website

4. Use Anti-virus Software and Keep it Up-to-date

5. Use a Firewall and Make Sure it is Working Properly

6. Run Backups and Take Them Offsite and Test the Recovery Process

7. Keep Servers in a Locked Area with Limited Access

8. Use Passwords or Encryption to Protect Laptop Computers

9. Use a Password on Your Mobile Phone

10. Don’t Leave Your Password on a Sticky Note!