In order to find out which organizations need to strengthen the protection of important data or services and to regularly assess the security risks of external servers and IT services that are often overlooked, enterprises should also consider the scope of application of the assessment, Expand to supply chain partners.

After conducting the above activities, companies can enhance information security in three areas:

  1. Program Management: Businesses should limit the organization’s data and services exposed to the Internet and service partners. At the same time, the use of access control to tighten the permission granted, any software updates have to be tested before proceeding. Funds transfer control should also be strengthened to deal with business e-mail fraud;
  3. Technical controls: Enterprises should take measures to plug the system vulnerabilities, such as installing patches, enhanced security settings, disable unsafe services, etc., and control outside access to the organization, as well as intercept external malicious Web site visits. In addition, data should be regularly backed up and an offline copy stored to reduce the impact of ransomware attacks; and
  5. Raise security awareness and plug man-made loopholes: Organizations should regularly conduct safety awareness education and security drills and require employees to use other communication channels to verify the trading requirements of e-mails and adopt strong passwords and double authentication on sensitive services. Employees also need to beware of emails and websites of unknown origin and avoid the use of public Wi-Fi networks to transmit sensitive information.