New Zealand organisations face an ongoing risk of ransomware and cyber intrusion. The following checklist outlines the baseline security measures companies should adopt to protect themselves — from firewalls and patching through to multi-factor authentication, incident response planning, and supplier assurance. Work through each item to strengthen your defences.
Engage a technical support specialist for your organization
Install and configure a firewall
Install anti-virus software on all organization devices
Automatically install tested and approved software updates and patches on all organization devices
Ensure strong password hygiene is maintained
Implement a backup and recovery strategy for important digital assets
Conduct cybersecurity awareness training for all employees
Install TLS certificates on all public internet facing websites
Ensure all servers are updated and patched
Ensure employee accounts do not have administrative privileges
Ensure employees have individual user accounts
Implement a password manager system
Multi-factor authentication (MFA) on all employee email accounts
Email Authentication and Anti-Spoofing
Confidentiality agreement for all employees, contractors and third parties
Implement a policy with procedures to manage Invoice Fraud
Implement a visitor register
Implement Endpoint Detection and Response (EDR)
MFA on all business applications and social media accounts
Ensure Remote Desktop Protocol (RDP) occurs only over Virtual Private Network (VPN) connections
Purchase and maintain business or cyber insurance
Implement a cybersecurity policy
Implement a response plan for cyber related incidents
Utilize secure methods of physical document destruction
Ensure all computer devices that store sensitive, private, and/or confidential information are disposed of securely
Implement and maintain a digital asset register
Implement a policy for the responsible and secure use of AI technology
Ensure all public internet facing resources are regularly scanned for vulnerabilities
Management of remote access cloud credentials
MFA where important digital data is stored
MFA on VPN connections
MFA on RDP connections
Ensure important digital data is encrypted at rest
Implement application control
Disable untrusted Microsoft Office macros
Conduct penetration, vulnerability and social engineering testing
Implement a digital trust program with your suppliers
Conduct police vetting on employees and contractors
Conduct training to test the incident response plan