Next year’s security plan: one thing a month
Big security programmes stall. Twelve small, finished improvements beat one big plan that never starts.
Every January I see big security plans. By March most have stalled. Here’s a plan that small teams actually finish: one improvement a month, done properly.
- January: MFA on every account that supports it.
- February: a password manager for everyone.
- March: list your assets: devices, servers, cloud services, domains.
- April: automatic updates everywhere; a plan for what can’t update.
- May: backups with one copy that can’t be deleted; test a restore.
- June: remove admin rights from daily accounts.
- July: close anything exposed to the internet that doesn’t need to be.
- August: central logs, kept for at least 90 days.
- September: SPF, DKIM and DMARC on your email domain.
- October: a one-page incident plan, and who to call.
- November: review who has access to what; remove the extras.
- December: a small test, such as a phishing exercise or an outside scan, and next year’s list.
Finished small things add up. Happy new year.