There never will be a perfect computer or network defense. Computer security is a constantly elevating game of cat-and-mouse. As quickly as you address the latest threat, attackers have already developed a new technique to access your network and compromise your PCs. But if you focus on the fundamentals, you can minimize your risk and defend against most attacks.

Small companies have limited IT resources, and can’t possibly defend against every possible exploit or attack. How do you know what to prioritize? Start with the 20 Critical Security Controls report, written by the Center for Internet Security (CIS), the SANS Institute, and the National Security Agency (NSA). To help businesses and governments, they have defined the security controls that block the most frequent attacks.

Speaking recently at the RSA Security conference, Philippe Courtot, chairman and CEO of Qualys, cautioned against mistaking compliance for security. He stressed that security should facilitate rather than impede business goals, naming the report as a valuable starting point.

John Pescatore, director of the SANS Institute, drew a comparison to the Pareto principle. The axiom commonly referred to as the “80/20 rule” says essentially that 20 percent of the effort or input results in 80 percent of the output.

To read this article in full or to leave a comment, please click here