Cybersecurity requires a working plan for assets, risk, access, monitoring and recovery. The source page lists 12 practices, although its title says 20 tips, so this revision keeps the 12 published practices and labels the discrepancy in the editorial note below.
- Identify every asset you need to protect, including hardware, software, data and network components. Classify each asset by its importance to the business.
- Assess the risks to those assets. Estimate the likelihood and impact of each threat so you can set priorities and resources.
- Write a cybersecurity policy that defines security goals, risk management and incident response.
- Train employees on security policies, safe browsing and secure password management.
- Use strong access controls, including two-factor authentication, and restrict access by job role.
- Segment the network into smaller sections to reduce the attack surface and limit the spread of malware after a breach.
- Encrypt sensitive data in transit and at rest, including passwords, credit card information and customer data.
- Run regular vulnerability assessments and address the weaknesses they find.
- Monitor and analyze network traffic with tools such as intrusion detection and prevention systems, firewalls and antivirus software.
- Write an incident response plan for detecting, analyzing, containing and mitigating security incidents.
- Back up data on a regular schedule so you can recover it after a breach or system failure.
- Run regular security audits to check that policies and procedures are followed and that systems and networks remain secure.