E19 - Low-Cost, High-Impact Cybersecurity Investments

Off the Wire: A Play by Play on Cybersecurity and Technology Issues

Podcast Outline: "Off the Wire" Episode

Intro:

• Welcome back to "Off the Wire," the podcast helping you curb cybersecurity risks and tackle technology challenges.
• Hosts: Tanner and Anthony, IT executives with a combined 35 years of experience in IT and cybersecurity.
• Teaser for Episode 20: Upcoming giveaway in two weeks—details to come.

Main Topic: Low-Cost, High-Impact Cybersecurity Investments

1. Introduction to the Topic

   • Discuss the challenges faced by small to medium-sized businesses in allocating budgets for cybersecurity.
   • The importance of prioritizing cybersecurity efforts even with limited resources.

2. Understanding Budget Constraints and Other Challenges

   • Budget limitations and other constraints like legacy applications and organizational resistance to change.
   • The need to prioritize cybersecurity based on the greatest risk and potential impact.

3. Cybersecurity Prioritization Strategies

   • Utilizing free or low-cost open-source tools when possible.
   • Considerations for choosing between free tools and paid solutions based on staff availability and skill level.

4. Cybersecurity Frameworks and Assessment

   • Importance of assessing the current state of cybersecurity.
   • Recommendations for using the CIS framework or similar tools for benchmarking and setting priorities.
   • The value of starting with a basic maturity level and progressively advancing.

5. Key Focus Areas for Low-Cost Cybersecurity Measures

   • Asset Management:
     • Importance of knowing what's on your network.
     • Free and low-cost tools like Snipe-IT and Spiceworks for asset management.
   • Strong Passwords and Multi-Factor Authentication (MFA):
     • Using free tools like Microsoft Authenticator or Google Authenticator.
     • Implementing password managers for better security and efficiency.
   • Regular Updates and Patching:
     • The critical role of updates in preventing security breaches.
     • Options for automated patch management solutions.
   • Incident Response and Business Continuity Planning:
     • Developing and maintaining security plans and policies.
     • Storing physical copies of these plans for accessibility during crises.

6. Additional Low-Cost Solutions

   • Threat Intelligence:
     • Leveraging free industry-specific threat intelligence resources and communities.
     • Utilizing platforms like Reddit for real-time information on vulnerabilities and threats.
   • Email Security:
     • Importance of investing in additional layers of email security.
     • Mention of tools like Avanan and Microsoft Defender.
   • Optimizing Existing Investments:
     • Making full use of existing tools and software, especially in environments like Microsoft 365.
   • EDR Solutions:
     • The importance of Endpoint Detection and Response (EDR) in mitigating breaches.
     • Notable EDR solutions and their benefits.

7. Backups and Disaster Recovery

   • The necessity of regular and tested backups.
   • Considering both free and paid backup solutions.
   • The importance of documenting and testing backup processes.

8. Creating a Cyber Go-Bag

   • The concept and contents of a cyber go-bag for emergency response.
   • Recommendations for setting up a go-bag, including tools and documentation.

9. Connecting Cybersecurity to Business Objectives

   • Emphasizing the alignment of cybersecurity goals with overall business objectives.
   • Importance of communicating cybersecurity successes and needs to leadership.

Conclusion:

• Recap of key points and encouragement to implement the discussed strategies.
• Reminder about the upcoming Episode 20 giveaway.
• Call to action: Subscribe, share the podcast, and reach out with episode ideas or feedback.

Closing Remarks:

• Next episode preview and sign-off.