Tag Archive for: Managed Cloud Services

Posts

Sustainability: 1000 Trees and Growing

/in

ReforestationBack in January of this year, we announced that Cumulus Global was expanding its sustainability program. To help offset the carbon footprint of our offices and operations, we have strengthened our partnership with Evertreen and are committed to planting 100 trees per month.

Our forest has grown to over 1,000 trees across 7 countries and 3 continents. 

Over the next 30 years, the trees we have planted to date will remove over 300 tons of CO2 from the atmosphere. That is the equivalent of driving an average American car 750,000 miles. As we continue to plant, the amount of CO2 our forest cleans will continue to grow.

In addition to the climate benefits, our forest is producing food, reducing soil erosion, protecting watersheds, and providing local jobs.

As an IT firm, planting trees to offset our carbon footprint is part of an overall commitment to sustainability that includes using 100% renewable energy, reuse, and recycling.

We Can Help You Do More

One of the best ways to improve sustainability is to recycle electronic waste (e-waste). E-waste recycling has challenges, including but not limited to, finding reputable recyclers and cost.

Our Basic and Business Managed Cloud Services include lifecycle management for your computer with unlimited, no-cost, e-waste recycling.

For a small number of items, we provide a prepaid label. Just box up the items and drop them off at your local post office. If you are looking to clear the shelves or empty the closet of e-waste, we can have a recycling team show up to box, label, and ship everything for you. All for free!

As an added bonus, our IT asset disposal partners partner with Veritree to plant trees with every recycling order.

Call to Action:

For more information about our Managed Cloud Services, please contact us or schedule time with one of our Cloud Advisors. 

About the Author

Allen Falcon is the co-founder and CEO of Cumulus Global.  Allen co-founded Cumulus Global in 2006 to offer small businesses enterprise-grade email security and compliance using emerging cloud solutions. He has led the company’s growth into a managed cloud service provider with over 1,000 customers throughout North America. Starting his first business at age 12, Allen is a serial entrepreneur. He has launched strategic IT consulting, software, and service companies. An advocate for small and midsize businesses, Allen served on the board of the former Smaller Business Association of New England, local economic development committees, and industry advisory boards.

A Model for Business Resilience

/in

Aviate Navigate Communicate

The recent global systems outage, caused by CrowdStrike’s failed update, exposes a key flaw in how we view business resilience. When asked how we make our businesses resilient to failures, human acts or errors, disasters, and other disruptions, we tend to focus on the technologies and services we put in place to prevent/protect and restore/recover.

Business Resilience 

We define Business Resilience as your ability to get and keep your business up and running (even if it is running at a degraded level) until you can fully restore and recover.

Given the impact of the CrowdStrike failure on the airline industry, here is an aviation-themed model you can use as a guide.

Aviate

When an emergency happens in flight, the pilot’s first focus is to aviate – to ensure the plane keeps flying. If you can’t keep the plane in the air, your direction of travel does not really matter. 

The same is true for your business. If you cannot keep your business running at a minimally viable level, you can run out of time and/or money before you are able to restore and recover.

Navigate

Once the pilot knows that the plane will continue to fly, they can assess their current location and take the necessary direction and steps they need to land safely.

Once you know that you can continue to operate, even if only at a base level, you can step back and map out the potentially complex steps needed to restore, recover, and return to normal operations. You can then navigate the technical, operational, customer service, legal, and other processes needed for your safe landing.

Communicate

Once the pilot can safely navigate to a landing, they have the time and focus to communicate. Although, pilots do communicate during the aviate and navigate phases, they limit communications to only information air traffic control, ground operations, emergency responders, and others need in order to assist with the situation. Additional details and analysis come later.

The same is true for you and your business. While you are aviating and navigating, you will want and need to share necessary information with those who need it. These communications need to be “to the point” and focused. You will have the time and focus to share more detailed information as you approach, or after you make, your safe landing. You will have the time needed for review, analysis, and planning after your return to normal operations.

Call to Action:

If you are unsure or lack confidence in your business’s resilience to disruptions, we can help. Contact us or schedule time with one of our Cloud Advisors. 

About the Author

Allen Falcon is the co-founder and CEO of Cumulus Global.  Allen co-founded Cumulus Global in 2006 to offer small businesses enterprise-grade email security and compliance using emerging cloud solutions. He has led the company’s growth into a managed cloud service provider with over 1,000 customers throughout North America. Starting his first business at age 12, Allen is a serial entrepreneur. He has launched strategic IT consulting, software, and service companies. An advocate for small and midsize businesses, Allen served on the board of the former Smaller Business Association of New England, local economic development committees, and industry advisory boards.

Resilience, the CrowdStrike Failure, and the Real Impact on Your Business

/in

Resilience

We have not written or posted much about the CrowdStrike failure. CrowdStrike is designed and priced for large enterprises. We offer endpoint protection, detection, and response services that are better designed for the small and midsize organizations we serve. In large part, the CrowdStrike failure has not directly impacted our clients and other smaller businesses.

However, the CrowdStrike failure has, and will, indirectly impact you and your business.

Technical Impacts

The biggest technical impact will be the role of automatic updates. The CrowdStrike failure was due to a programming error in a software update that was sent and applied automatically. Customers did not have the ability to limit or test the update prior to deployment.

Going forward, expect vendors to rethink how and when they use automatic updates. What for expectations that you, the customer, should test and approve changes. This shift will transfer more of the responsibility from vendors to your IT team. If you do not have the resources to test and verify updates, you will be taking on more of the responsibility should issues arise.

If you have an IT provider or managed service provider, you may need to negotiate this additional work into your contracts.

Business Impact

The most significant impact of the CrowdStrike failure is on our understanding of “Resilience.” When we talk about endpoint protection services like CrowdStrike, backup/recovery solutions, advanced threat protections, encryption, and other services, we are talking about tools that help our businesses become and remain resilient to cyber attacks, improper user activity, disasters, and other disruptions. 

These technical solutions provide some of the “Prevent & Protect” and “Restore and Recover” components of our Security CPR® model and services. With the CrowdStrike failure, a tool intended to improve resilience exposed a weakness in our resilience: what happens when your solution becomes the problem?

Our understanding of resilience needs to change. We must move away from thinking about resilience as a function of IT. Resilience is a business-level function that encompasses all aspects of your organization.

Anecdotally, we learned that during the CrowdStrike failure: 

  • Airlines in Hong Kong wrote out boarding passes by hand and kept lists in notebooks to track manifests and seating assignments.
  • Lacking computers to centrally monitor infants and non-operational security doors in a California Hospital maternity ward, nurses were held over and stationed at each infant’s bedside, and security guards were tasked with guarding doors.
  • A small distributor wrote labels, bills of lading, and customs documents by hand for thousands of shipments.

The Big Question

Answer the following question for your business:

  • Can you run your business, even if it is in a degraded mode, without one or more of your key systems? If so, for how long?

Your answer is key to understanding how resilient your business is to disruption, the potential operational and business impact of a disruption, and your ability to recover and survive.

Call to Action:

If you are unsure or lack confidence in your business’s resilience to disruptions, we can help. Contact us or schedule time with one of our Cloud Advisors. 

About the Author

Allen Falcon is the co-founder and CEO of Cumulus Global.  Allen co-founded Cumulus Global in 2006 to offer small businesses enterprise-grade email security and compliance using emerging cloud solutions. He has led the company’s growth into a managed cloud service provider with over 1,000 customers throughout North America. Starting his first business at age 12, Allen is a serial entrepreneur. He has launched strategic IT consulting, software, and service companies. An advocate for small and midsize businesses, Allen served on the board of the former Smaller Business Association of New England, local economic development committees, and industry advisory boards.

7 IT Blind Spots Small Businesses Miss the Most

/in

IT Blind Spots

Your small business depends on your IT services to run effectively and efficiently. Even so, like many small business leaders, you likely have one or more “IT Blind Spots”. The blind spots are not “all or nothing.” They evolve from decisions about what IT services are needed, wanted, and worthy of spending on at a particular point in time. Over time, internal and external factors change. If we do not take a fresh look, our IT services will not keep up. 

While not intentional, these blind spots create unnecessary risks and expenses. Here are the seven (7) blind spots we see the most.

1Security and Privacy

As small business owners and leaders, we understand the need for security – especially in today’s environment. We wonder, however, how much security is enough and what we should prioritize. We see small businesses with antivirus protection on their computers, strong passwords, and basic backup/recovery. While these services were the benchmark for basic security, they are now insufficient.

Check your IT blind spots for other core security services, including multi- or two-factor authentication (MFA/2FA), advanced threat protection (ATP) for email, advanced endpoint protection and response, encryption, and immutable backup/recovery services.

If you do not have these in place, your security is likely insufficient to protect your business.

2Duplicate Services

It has never been easier to sign up for new services. With a few clicks, payment information, and a quick setup, your new, cloud-based application or service is up and running. The convenience is great when you need something specific or a new solution. The low barrier to entry, however, makes it easier to sign up for apps and services that duplicate others you already have in place.

Check your IT blind spots for these duplicate services. We most often see companies paying for Zoom or GoTo, even though they have Microsoft Teams or Google Meet for online meetings and presentations. Some spend on Slack and other tools instead of using Teams or Google Chat services that are already in place. Rather than managing permissions to share files from Microsoft 365 or Google Workspace, small businesses often spend more on Dropbox and other services. While these are the most common duplicate services, we often see others across a wide range of apps and functions.

3Shadow IT

We used to define Shadow IT as any IT service in use without proper vetting or authorization. Today, we expand the definition to include consumer-grade hardware, software, and services. Team members using unauthorized IT services typically create security risks, increase costs, reduce control of company information, violate information privacy rules, and put data at risk. While less costly up-front, consumer-grade equipment, software, and services typically lack the security and integration needed for business use.

Check your IT blind spots and survey your environment for Shadow IT. Team members often go rogue for personal preference, convenience, or because they do not understand how to use features and functions already in place.

4Latent Apps and Services

When was the last time you looked to see if you were paying for IT services that you no longer use or need? With the low barrier to entry for cloud services, we often see companies that have signed up for an app or service, only to later decide that it is not the right solution or to see usage decline over time. Without a set process for on/off-boarding IT services, these often remain idle, incurring monthly or annual fees.

Check your IT blind spots for applications and services. Review company and staff personal credit cards for recurring payments. Scan Microsoft 365 and Google Workspace accounts for apps and services with federated logins.

5Business Continuity

While almost all small businesses like yours have backup/recovery in place for most of their systems and data, most still lack a business continuity solution. Even without a big disaster, the loss of a single, key system can be crippling.

Check your IT blind spots for business resilience. Can you run your business without your IT systems and services? For how long? Which systems and services can you live without for a short period of time and which are critical to your business? The answer to these questions dictates the types and extent of business continuity services you need. Focus on what you need to reasonably run your business while you make repairs and complete larger recovery efforts.

6Cyber Insurance

Most small businesses know that they should have cyber insurance in place, and many do. Too often, however, we see small businesses signing on to policies with inadequate or inappropriate coverage. We also see many businesses overpaying for cyber insurance to cover risks that could easily be reduced with incremental security services.

Check your IT blind spots for appropriate cyber insurance coverage and rates. If your policy was not purchased through a specialized agent or broker, an independent review may be worthwhile. If you do not yet have a policy, check out our resources and ask about our cyber insurance readiness assessment.

7Utilization

Multiple services tell us that most small businesses use about 15% of the capabilities in their Microsoft 365 or Google Workspace services. Your investment in Microsoft 365 or Google Workspace includes a rich set of features and functions – major and minor – that help your team collaborate and work more efficiently, individually and as a team.

Check your IT blind spots to understand how well your team is using the tools available to them. A little bit of education, training, and guidance can boost productivity within Microsoft 365 and Google Workspace by up to 60%.

Call to Action:

If you suspect, or just wonder, what is in your IT blind spot, we can help. We can help you check your blind spots and assess what, if any, changes are necessary or recommended. Once decided, we can help you plan and execute those changes. Contact us or schedule time with one of our Cloud Advisors. 

About the Author

Allen Falcon is the co-founder and CEO of Cumulus Global.  Allen co-founded Cumulus Global in 2006 to offer small businesses enterprise-grade email security and compliance using emerging cloud solutions. He has led the company’s growth into a managed cloud service provider with over 1,000 customers throughout North America. Starting his first business at age 12, Allen is a serial entrepreneur. He has launched strategic IT consulting, software, and service companies. An advocate for small and midsize businesses, Allen served on the board of the former Smaller Business Association of New England, local economic development committees, and industry advisory boards.

Leadership Thoughts: Noteworthy Blog Posts – Jun ’24

/in , ,

As small business owners and leaders, you carry the responsibility for the direction and success of your business.  And while Cumulus Global provide managed cloud services that help you thrive and grow, we understand your responsibilities are broader than just IT. As a way to share some leadership thoughts, here is a curated list of blog posts from trusted experts that we hope will inform and inspire.

Human Factors

Legal and Compliance

Management

Marketing

Productivity

Strategy and Leadership

Wellness

  • 7 Tips for a Successful Workplace Wellness Program
    • In today’s fast-paced world of hybrid work, finding a balance between work and wellness is more important than ever. Prioritizing wellness at work is not only essential for individual health and happiness but fosters a positive and productive work environment with less absenteeism and lower healthcare costs.
    • Michell Grasso, Synergy Wellness Center

Our IT Ideas That Still Hold True

A few of our past IT leadership thoughts that remain true and relevant today.

  • Cyber Security Will Change Companies
    • IT change management is a structured process for evaluating proposed IT system or service changes. This procedure is carried out prior to implementing the requested change on an organization’s network, reducing or eliminating network outages.
    • Cumulus Global Blog, June 2022
  • What is a MCSP?
    • The need to monitor and maintain equipment and infrastructure drops off while your need to monitor and manage services, apps, and data increases.
    • Cumulus Global Blog, November 2017

Help us keep the ideas flowing. If you have any blog posts that are leadership thoughts you want to share, please let us know.

Cybersecurity in the Whitespace

/in ,

Cybersecurity White Space

A recent online post pointed out that the whitespace in the FedEx logo, between the “E” and “x”, creates an arrow. 

FedEx Logo

Once you see the arrow, you cannot miss it. You will see it every time you look at the logo.

The subtle, almost subliminal, arrow symbolizes a sense of forward motion and subconsciously reinforces the FedEx brand message of on-time delivery.

The power of the logo is not just the name, it is in the symbolism. The same is true for your cybersecurity.

The power of your cybersecurity is not just in the overt actions, success is in the whitespace.

Focus

Our cybersecurity efforts often focus on the concrete measures we can take to protect ourselves and prevent attacks. We deploy hardware, install software, and configure settings to both passively and actively protect our systems, data, and people. These actions are tangible and visible. 

Cybersecurity Whitespace

Equally important, if not more so, are the less visible cybersecurity efforts– your cybersecurity whitespace. Ask yourself these questions:

  • Is cybersecurity awareness a deliberate part of your culture?
    • Do you educate your team on their role in cybersecurity?
    • Do employees and contractors understand which behaviors help security and which can harm it?
    • Does your team understand how to recognize, report, and respond to security risks and attacks?
  • Do you have policies and procedures in place that set expectations for maintaining appropriate cybersecurity?
    • Do these policies and procedures include guidance and limits on human behaviors and actions that can pose or elevate risks?
    • Do you have consequences for negligent or deliberate non-compliance?
  • Do you understand the risks should a cyber attacker gain access to your systems?
    • Do you understand the protections you need in place to limit attacker access to identities and sensitive information?
    • Can you isolate attacks and prevent them from spreading across your environment?
  • Do you have plans in place to not only restore damaged or lost data, but to recover your business from a successful cyber attack?
    • Do you have cyber insurance?
    • Do you have clear action plans for how your business will respond to a successful cyber attack?
    • Will you be able to run your business while you recover your systems and data (and/or while computers are held as evidence)?
    • Do you have plans and resources in place to:
      • Comply with state and regulatory reporting requirements?
      • Communicate effectively with customers, vendors, and partners?
      • Manage your legal and financial liability?

Model for Success

Successful cybersecurity includes the visible and the whitespace. Our Security CPR® model and managed security services include all three best-practice pillars:

  • Communication and education
    • Security awareness focused on human behaviors, risk recognition, and responding to suspicious acts.
    • Policies and procedures that guide and protect your business in line with compliance requirements.
  • Prevention and protection
    • Expertise, tools, and services to prevent cyberattacks and protect your business, data, and team.
    • Compliance assessment and management services to benchmark and certify to appropriate industry and regulatory standards.
  • Recovery and response
    • Business continuity services to keep your business running during forensic investigations and data/system recovery and restoration efforts.
    • Data restoration and disaster recovery plans and resources to return your business to normal operations as quickly and effectively as possible.
    • Cyber insurance brokerage partnerships to ensure your business is properly covered within your budget.

Call to Action

If you have not done so recently, now is a great time to step back and assess your IT services and solutions. Our Cloud Advisors are ready to help and assist with any questions or concerns. Start with a complimentary Rapid Security Assessment, contact us, or schedule time with one of our Cloud Advisors. 

About the Author

Allen Falcon is the co-founder and CEO of Cumulus Global.  Allen co-founded Cumulus Global in 2006 to offer small businesses enterprise-grade email security and compliance using emerging cloud solutions. He has led the company’s growth into a managed cloud service provider with over 1,000 customers throughout North America. Starting his first business at age 12, Allen is a serial entrepreneur. He has launched strategic IT consulting, software, and service companies. An advocate for small and midsize businesses, Allen served on the board of the former Smaller Business Association of New England, local economic development committees, and industry advisory boards.

Improve Your IT Atmosphere

/in

AtmosphereFor those of us who have played video games over the years, even though we are not hard-core gamers, the experience has changed. The technology has certainly advanced over time. More importantly, the user experience – the IT atmosphere – has improved.

Back in the day, video game sound provided basic contextual clues to guide your gameplay. Listen to a few seconds of the Atari Combat game soundtrack from 1977. With only 8 bits to work with, and speakers that could only play one note at a time, the beeps and buzzes react to player actions and provide a basic context for the game. 

Now listen to a minute of the Gusty Garden Galaxy Theme from Super Mario Galaxy from 2007. Even without seeing the game in action, you can hear and feel the motion of the game. The more than 80-piece orchestra does more than reflect player actions, it creates an atmosphere and sets a mood.

IT Atmosphere

The same evolution is true for your IT services. Historically, your IT services were there to help you complete tasks – send messages, write documents, and create spreadsheets. Today, your IT services should create a rich atmosphere that empowers your team and enables your business

From simple tools to feature-rich, integrated productivity suites, you and your team have access to features that save time and effort, foster collaboration, and save money.

And yet studies show that, on average, small businesses underutilize the tools they have. Studies show, for example, that small businesses only use 15% of their Microsoft 365 services. Oftentimes, lack of awareness (or education) results in adding other services and tools that duplicate existing features and capabilities.

Making Improvements

Creating an effective IT atmosphere involves more than having tools and services in place. An effective atmosphere is an environment that fosters communication, collaboration, and productivity for individuals and teams.

Know What You Have

Catalog the IT services and capabilities you have in place. Understand how your team is using the services and identify underutilized features and functions. Identify those that could be beneficial. 

Eliminate Duplicity

Remove duplicate and overlapping services from your environment. Ensure your team is using the same tools and resources. Create commonality and encourage sharing of best practices.

Educate, Train, and Support Your Team

Ensure your team is aware and understands how to take full advantage of the capabilities within their current workflows or as part of improved workflows. Guide team learning to align with their roles and responsibilities; keep it timely, relevant, and in digestible chunks. 

Manage Your Shadow IT

Shadow IT, the individual use of non-sanctioned tools, can trigger significant problems for your business. Beyond security and information privacy risks, shadow IT isolates information and people. Listen to why your team is using tools and work to ensure that those capabilities are within your ecosystem. Remove objections to using company systems while enforcing your policies.

Call to Action:

If you have not done so recently, now is a great time to step back and assess your IT services and solutions. Our Cloud Advisors are ready to help and assist with any questions or concerns. Contact us or schedule time with one of our Cloud Advisors. 

About the Author

Allen Falcon is the co-founder and CEO of Cumulus Global.  Allen co-founded Cumulus Global in 2006 to offer small businesses enterprise-grade email security and compliance using emerging cloud solutions. He has led the company’s growth into a managed cloud service provider with over 1,000 customers throughout North America. Starting his first business at age 12, Allen is a serial entrepreneur. He has launched strategic IT consulting, software, and service companies. An advocate for small and midsize businesses, Allen served on the board of the former Smaller Business Association of New England, local economic development committees, and industry advisory boards.

Best Practice – The Lowest Price May Not Save You Money

/in

Small businesses face many challenges as they start up, grow, and thrive. Technology and IT services are one such challenge. While small businesses can find the technology and IT services they need, and want, IT costs often poses a barrier to entry. The range of competing solutions, evolving security requirements, the need for cyber insurance, and the lack of specialized advice combine to create additional complexity and stress.

Faced with budget constraints, and uncertain of the choices before them, small businesses often focus on price. More specifically, they look for the lowest-priced technology and services that they believe will meet their needs. Unfortunately, price-first decisions can lead to significantly greater costs over time.

What to Avoid

Free Services
  • Vendors market free services to consumers. These services usually lack features, security, and support necessary for effective business use. Using these features often violates industry or legal standards for protecting information. The result: you face increased risk and liabilities.
Consumer Tech
  • Manufacturers often price laptops and other consumer devices lower than their business model counterparts. And while feature differences may be minimal, business models typically offer longer warranties (1 year versus 30 to 90 days) and include certified repairs and warranty services. Often, these services include, or can be upgraded to include, on-site service on the next business day.
  • The impact is longer repair and service times, resulting in more business disruptions and downtime.
Good Enough
  • Many businesses choose less expensive solutions because they are “good enough.” These solutions may provide anywhere from 60% to 80% of what you need or want.
  • Although this may work in the beginning, businesses will often end up adding another low-cost solution when they need the additional features.
  • You end up with multiple tools with overlapping features and silos of data and information. The result is reduced efficiency and productivity.
Skimping on Security
  • Small businesses feel like a small target for cyber attacks. In reality, small businesses are easier targets because they are generally more vulnerable.
  • And while your business may not be a specific target, you are more likely to get caught by broad-based attacks, such as ransomware.
  • We have blogged quite a bit on the increasing security demands. Stepping back from security reduces costs, but will result in business disruption, financial and legal liability, and higher recovery costs.
  • Most small businesses fail within six months of a successful cyberattack.

Focus on Value

When making technology and IT service decisions, focus on value, not cost. Value includes consideration of factors such as efficiency, enablement, overhead, flexibility, and expandability.

Here are some other value considerations:

  • Understand the Demands on your Business. Regulatory requirements and industry standards will impose features and limitations on the technologies and services you choose. 
  • Evaluate Current and Future Needs. Avoid lower-cost solutions that will need future upgrades or replacements. These changes can cost more than the initial savings and can disrupt, or require, significant changes to workflows and business operations.
  • Consider Scalability. Many cloud services offer subscription options you can upgrade as your requirements evolve. While you should not avoid necessary security features, you can scale other capabilities to your current needs.
  • Focus on Best Fit. Assess how well the technologies and services you are considering will fit together. You lose the savings on lower-cost services if you need to manually move data or add third-party data sync tools.

Call to Action:

If you have not done so recently, now is a great time to step back and assess your IT services and solutions. Our Cloud Advisors are ready to help and assist with any questions or concerns. Contact us or schedule time with one of our Cloud Advisors. 

About the Author

Bill is a Senior Cloud Advisor responsible for helping small and midsize organizations with cloud forward solutions that meet their business needs, priorities, and budgets. Bill works with executives, leaders, and team members to understand workflows, identify strategic goals and tactical requirements, and design solutions and implementation phases. Having helped over 200 organizations successfully adopt cloud solutions, his expertise and working style ensure a comfortable experience effective change management. hBill Seybolt bio picture

 

Pragmatic Security: Balancing Security Measures for Small Businesses

/in ,

Security vs UsabilityWhile on vacation recently, I did something that I did not think has been possible since July 1970. I boarded a commercial airline flight without having to go through security. No ID check. No metal detectors. The gate agent scanned the barcode on my ticket and I walked on board. The experience was, at first, confusing as I went from curb to gate with no security checks. I asked the gate agent why there was no security check; the answer was pragmatic security.

Pragmatic Security in Action

Airport security intends to prevent hijackings. I was traveling in New Zealand, which you know is an island country.  The nearest country, Australia, is at least a 3½  hour flight by jet. My plane was a dual engine turboprop with about 70 seats with and a range of 930 miles. It is impossible for the plane to leave the country.

Hijacking a regional flight in New Zealand is pointless, as you cannot escape the country. The security risk is miniscule.

In New Zealand, flights on regional planes do not have (or need) security checks. To board a jet, however, you will board at a “jet gate” having passed through all of the common security and ID checks.

Pragmatic Security for Your Small Business

The concept of pragmatic security also applies to IT and cybersecurity. Not every business needs every security measure. We can, and should, scale our IT and cyber security to meet our needs and priorities.

That said, the baseline has changed. In New Zealand, the baseline security for flights is that the customer has a ticket.  For smaller businesses, the historical baseline has been “a secure firewall/router, antivirus software, and email filters for spam.”

As we have discussed in other Security Update Series blog posts, we face new security demands from customers, insurance providers, and regulators. As cybersecurity risks increase, so do the solutions we need to implement.

Pragmatically: How Much Security is Enough?

While the answer varies based on your business needs, risks, and priorities, our Security CPR® managed security model and services provide a solid baseline. We are also proponents of understanding risks. As we discussed in this blog post, focusing on the most prevalent risks and the most damaging risks is the best place to start.  Designing your security solutions from these two angles provides a solid baseline of protections. Additional measures can be added as needed to meet industry or regulatory requirements.

Call to Action:

If you have not done so already, a baseline security assessment is a good place to start. Our Rapid Security Assessment provides a quick review of core security services. And our Cloud Advisors are ready to assist with any questions or concerns.

Contact us or schedule time with one of our Cloud Advisors. 

About the Author

Allen Falcon is the co-founder and CEO of Cumulus Global.  Allen co-founded Cumulus Global in 2006 to offer small businesses enterprise-grade email security and compliance using emerging cloud solutions. He has led the company’s growth into a managed cloud service provider with over 1,000 customers throughout North America. Starting his first business at age 12, Allen is a serial entrepreneur. He has launched strategic IT consulting, software, and service companies. An advocate for small and midsize businesses, Allen served on the board of the former Smaller Business Association of New England, local economic development committees, and industry advisory boards.

Best Practice – Completing Security Surveys and Questionnaires

/in

Data Protection & Security

In our recent Security Update Series blog post, New Security Demands & Requirements for Small and Midsize Businesses, we discussed three drivers for increased business security. We noted that expectations will often be expressed in security surveys and questionnaires you are asked to complete. Providing incorrect, incomplete, or misleading answers, whether intentional or not, can impact premiums and your available coverage.

To minimize the risks and potential pitfalls, here are five best practices to follow:

1 Know the Process

Before starting your response, have the broker or agent walk you through the process in detail. What role do the security surveys or questionnaires play in the underwriting process? While some carriers only use a single survey, others will ask for follow-up information and/or request evidence supporting your answers.

Understanding the process will guide how you answer questions and the nature and amount of information you provide.

2 Follow the Rule of Absolutes

Following the “Rule of Absolutes,” answering “yes” or “no” to a question means “yes” or “no” everywhere and in every instance. 

For example, if you answer “yes” to the question, “Do you require multi-factor authentication for user login?”, you are stating that MFA is in place for every possible user login for every system or service. Answering “yes” if this is not the case will be considered a misleading or deceptive response.

The better approach is to answer with commentary that accurately responds to the intended questions without absolutes. Using the above example, provide a list of systems for which MFA is required, optional but recommended, and/or not available. In addition to being a more accurate response, the information will better inform the underwriting risk assessment.

3 Understand the Questions

Not all questions may be clear. Some questions will focus on technology. Others will focus on policies, processes, and procedures. Still others will focus on outcomes.

For example, these three questions:

  1. What security incident and event management (SIEM) system is in place?
  2. Do you have security incident and event management?
  3. Do you monitor, save, and analyze security event logs to identify alerts and conditions that require responsive action?

Question 1 appears to be asking about specific software or tools. The second Question asks about capability; the software tools and operational resources may be implied or assumed with a “yes” answer. Question 3 probes procedures, possibly independent of the supporting technology and/or existence or use of a security operations center (SOC).

If you are not sure how to best answer the questions, consult with the broker or agent for guidance.

4 Pause and Implement

In reviewing the security surveys or questionnaires, you may notice an emphasis on certain aspects of your security systems, solutions, policies, and processes. 

If your answers appear to indicate weakness in these areas, consult with the broker or agent for guidance. You may benefit from pausing the effort until you can update or implement expected services and solutions.

In some cases, indicating that an improvement is in process may be sufficient to move forward.

5 Get Legal Advice

You own and are legally bound by the survey and questionnaire responses you provided. This holds true even if IT providers, vendors, and others have drafted portions of your response.

Before submitting your responses, review the surveys or questionnaires and your responses with qualified legal counsel familiar with cyber security. Understand if answers provided by third parties may create issues or liabilities. Understand any and all commitments expressed and implied in your responses.

What to Do:

The best course of action is to assess and, if appropriate, adjust your security services before you face a survey, questionnaire, or audit. Our Rapid Security Assessment provides a quick review of core security services. Our Cloud Advisors are ready to assist with any questions or concerns.

Contact us or schedule time with one of our Cloud Advisors. 

About the Author

Bill Seybolt bio pictureBill is a Senior Cloud Advisor responsible for helping small and midsize organizations with cloud forward solutions that meet their business needs, priorities, and budgets. Bill works with executives, leaders, and team members to understand workflows, identify strategic goals and tactical requirements, and design solutions and implementation phases. Having helped over 200 organizations successfully adopt cloud solutions, his expertise and working style ensure a comfortable experience effective change management. 

 

library

Nothing Found

Sorry, no posts matched your criteria

Webcasts

Nothing Found

Sorry, no posts matched your criteria