Graduate from "Only the person in charge knows." Move toward security that doesn't rely on individuals with SECURITY ACTION "Two Stars."

In the previous article, we talked about the first step of SECURITY ACTION, "One Star (Five Principles of Information Security)."

"Updating the OS"
"Installing antivirus software"
—actions like these are, so to speak, individual defense techniques.
However, to take a step forward as a company, the next step is necessary.

That is "SECURITY ACTION Two Stars."
In a nutshell, it is the stage of changing security from "individual awareness" to "company systems." stage.

After "One Star," do you have any of these lingering concerns?

"I installed antivirus software for now. But..." In the workplace, these kinds of voices are often heard.

• Who did the settings again? (The person in charge is absent, so no one knows)

• Password management methods are inconsistent (Stuck on sticky notes, saved in browsers, etc.)

• When a new person joins, it's not decided what to tell them

This is actually a very dangerous state.
Because if that person leaves, or if that person forgets, the measures will stop.

Two Stars is not about fancy regulations, but "shared understanding"

To obtain "Two Stars," you are required to establish an "Information Security Basic Policy" and document your rules.

Hearing this, you might brace yourself, thinking, "We aren't a large corporation, so we can't create such a thick manual."
However, there is absolutely no need to raise the bar.

What Two Stars is asking for is not to create impressive documents, but
for example, writing down and sharing these "common-sense agreements" on paper.

• Only use USB memory sticks that have been approved by the company

• Delete the accounts of people who have resigned within the same day

• Do not reuse passwords. When sharing, follow the rule of XX

You might think, "Is that all?" but just by deciding on these "that's all" as rules, the confusion in the workplace will decrease surprisingly.

Why is "systematization" necessary now?

Looking at recent news about cyber damage, cases caused by "slight gaps in operation" are increasing much more than those caused by advanced hacking techniques.

• Old accounts were left unattended

• Thinking you were taking backups, but no one was checking them

These are not differences in technology, but operational issues where "who, when, and what to do" were not decided.

Working toward Two Stars is the process of setting up a barrier to protect your company from such "oversights" and "leaving things to others."

3 steps to start "small and sustainably"

It is impossible to create perfect rules all at once.
Why not start here first?

1. Write down "what you are doing now"
   (e.g., PC is set to automatic updates, etc.)

2. Decide on 3 prohibited items that "you definitely want them to follow"

3. Summarize that on one A4 sheet as "our company's basic policy"

The important thing is not to create a fancy file and let it sleep on a shelf.
It is to create a guide so that employees don't get lost when they look at it.

IT Work Lab will become your company's "external IT department"

However,
"what rules are necessary for your company right now"
and "is this way of writing correct"
are difficult to judge.

At IT Work Lab, we support small and medium-sized enterprises that do not have IT staff by providing the following support.

• Security "inventory" (What can you do now, and what is missing?)

• Design of sustainable "internal rules" (We create rules that the workplace can follow)

• Support for SECURITY ACTION Two Stars declaration

"I want to graduate from ad-hoc measures soon"
"I want my employees to work with peace of mind"

If you feel that way, please let us hear from you.

Security is not something you do once and finish.
Let's create a form that can be continued sustainably forever together.

Contact us here:IT Work Lab Official Website