Staff certification: Would you fly on a jet airliner piloted by an individual who
only had flown a single-engine propeller airplane a couple of years ago? Who
would do that? You expect the pilots to maintain their commercial pilot certifica-
tions, which includes the requisite qualification training, physical and mental
wellness, continuing education, simulator currency training, and actual flight
time, to maintain their proficiency. You should expect the same from your IT
staff. The IT industry has numerous professional certification programs to
ensure that your IT staff has the current level of expertise and talent to perform
at the high levels your business needs and deserves. If you have IT personnel
who do not have or do not maintain their professional certifications, they may
not be capable of adequately defending your information against increasingly
sophisticated threats. As such, you may expose yourself and your company to
cybersecurity risks. Moreover, like an airline that has an accident at the hands of
a pilot who lacks certification, if your network is managed by technicians who
don’t have proper certification and qualifications, you may expose yourself and
your company to litigation in the event that your network is breached. Our rec-
ommendation is that whether your IT staff is comprised of direct employees or
contracted personnel, you need to ensure they have the right qualifications and
certifications to do their jobs properly. This will reduce your risk of having
networks and systems that are not professionally and properly configured and
operated. Moreover, it will reduce your liabilities in the event your system or
that of one of your customers is compromised.
• Software currency: Did you know that Microsoft releases security patches the
second Tuesday of every month? Known as “Patch Tuesday,” it has been a great
help to IT staffs around the world and significantly helps improve the security of
Microsoft products. Companies like Microsoft routinely issue patches to their
code to improve their products and harden them against vulnerabilities that have
been discovered in their code. Unfortunately, it takes time for the software devel-
opers to create patches to counter vulnerabilities, so the time between detection
of the vulnerability and fielding of the patch is when you are most vulnerable.
Therefore, when a certified and tested patch emerges from the vendor, it is in your
best interest to patch your system quickly to reduce your risk exposure. Likewise,
newer versions of software repeatedly have been found to be better constructed
and more secure. Maintaining current software configurations and patches is an
IT best practice that minimizes your cybersecurity risk.
• Storage in the cloud: The jury is still out when it comes to cloud storage and secu-
rity. Cloud storage involves storing data on multiple servers often connected to the
Internet and generally is hosted by third parties. Because your data is being han-
dled on devices managed by someone else, likely will traverse across the Internet,
and is hosted on “virtual” servers on platforms that host information that belongs
to other entities, what could go wrong? We contend that cloud computing presents