Business security

[НСК-СБ]

Business security

Business security - This is a set of measures and measures aimed at comprehensive protection of business from various types of threats (information, legal, physical, economic and organizational and personnel). All decisions regarding the comprehensive protection of the business and the measures taken are vested in the security service, the heads of the relevant departments and the director of the organization.



Types of problems in business security and ways to solve them

There is always room for risk in any kind of business. At the same time, a good leader will not wait for problems - he will take timely measures to protect against the most probable problems in the business sphere. These include:

- corporate turmoil - disputes and conflicts between shareholders of the company, conflicts between top managers or the complexity of the relationship between the owners of the company and the heads of departments;

- external hazards - threats from criminal organizations, conflicts with law enforcement and government agencies, raider raids and so on;

- financial losses - fraudulent actions of personnel (customers), theft, unscrupulous intermediaries or suppliers, inappropriate use of company resources, receiving bribes for certain activities against the interests of the company;

- information hazards - leakage of company secret information (its concealment or destruction), gaining unauthorized access to confidential data, disclosure of trade secrets and the like;

- security "holes" - theft of material and technical values by unauthorized persons, unauthorized entry into the territory of the company, violation of labor discipline;

- reputation problems - the presence in the structure of workers with a bad reputation, cooperation with people (contractors) who have a bad reputation.

To solve all these business problems, the following types of protection are required:

- physical - security systems, security, surveillance cameras and so on;
- economic - counterparty verification, client bank protection, tax optimization;
- organizational and personnel - verification of personnel entering the work, control of existing employees;
- informational - protection against intrusions, protection of files and documents, optimization and protection 1C, single authentication, protection against information leaks and so on;
- legal - examination of transactions, verification of draft documents, subscription services and so on.

[DLMURL="https://utmagazine.ru/posts/10279-informacionnaya-bezopasnost"] Information security [/ DLMURL] business

According to statistics, more than half of all business problems arise due to “gaps” in information security. Leaking information to competitors, losing data, transferring company secret information into the wrong hands - all this carries a great risk to the business. In such a situation, the company's IT managers are taking a number of effective measures that provide comprehensive protection for the company.
In the first place is the protection of financial data, in the second - protection against leaks, and in the third - protection against DdoS attacks. And if the first two points have long been in the top three, then the problem with attacks has appeared only recently. The reason for this interest is the increased number of DdoS attacks on small and medium-sized companies.

Among the main measures that Russian companies have taken in the field of security can be identified - protection against malware, update management, application control, network structure, solutions for protecting financial transfers, monitoring the use of external devices, protecting mobile phones and so on.

The main methods of information protection of a business are as follows:

1. Intrusion Protection - installation of programs or equipment necessary to control traffic on the network. When the first danger (intrusion) appears, the system reacts and blocks access. At the same time, notification of the responsible employee occurs.

The protection system is implemented in one of two ways:

- IPS system. Its task is to block any network activity that causes suspicion, and effectively filter out "excess" traffic. The plus of the system is the ability to not only detect, but also to prevent intrusion. Minus - a high percentage of false positives, which leads to a constant distraction of employees from the case and idle computer network for the duration of the scan;

- IDS system - monitors the current abnormal activity, upon the appearance of which a signal is given to the administrator. Positive features - an effective fight against intrusion, transfer of the right to make decisions to the administrator. The downside is that the responsible employee may not have time to take action and the system will be irreparably damaged.

An ideal intrusion protection system is as follows:


2. Leakage protection - a set of measures to prevent confidential information from falling into unauthorized hands. Leakage can occur in two ways:

- by malicious theft (espionage, raiders, insiders);
- due to staff oversight (loss of media, sending a password by mail, switching to a page with a virus, lack of responsible people for transferring rights to access data, and so on).

In case of malicious theft, the protection methods are as follows - restriction of the access regime to [DLMURL="https://utmagazine.ru/posts/13541-predpriyatie"] enterprise [/ DLMURL], installation of surveillance cameras, installation of data destruction tools on servers, information encryption, data storage on foreign servers.

The following methods can be called effective for protection against personnel errors: minimization of access rights to confidential information, individual responsibility of employees, use of secure channels, creation of a work schedule for employees with important documents, introduction of responsibility for storage media transferred to employees.

In addition, to protect against accidental errors, it is important to organize - recording telephone conversations, monitoring traffic and employee work on a PC, encrypting USB cards, using RMS, implementing DLP systems and so on.


3. File protection implies the safety of all the most important information that is stored on computers and servers within the company. It is implemented as follows:

- encryption of file systems (data) - the use of EFS, Qnap, CryptoPro and so on;

- encryption of laptops (netbooks), storage media, mobile devices - software solutions (Kasperskiy, SecretDisk, Endpoint Encryption) or encryption modules from Sony, Asus and other companies;

- [DLMURL="https://utmagazine.ru/posts/9798-zaschita-informacii"] information protection [/ DLMURL] from the system administrator , for example, using TrueCrypt;

- mobile registration on trackers of monitoring systems (using Kaspersky or Prey);

- prohibition (restriction) of access to various electronic files (one of the best options is Active Directory Rights Management Services).

- single authentication. You can use two schemes - on domain authorization (equipment is tied to a domain structure), using the E-token electronic key or using SMS alerts.

Unified authentication technology is implemented as follows:

In the case of using a USB key (token), the interaction scheme looks different:



User interaction in the case of SMS alerts:


4.Optimization and protection 1C requires the implementation of the following measures:

- when working with base 1C - disk encryption, restriction of access rights, installation of a system for protecting data exchange processes and files;

- when working with DBMS base 1C - restriction of administrator rights for users, the use of encryption systems, the implementation of measures to limit remote or physical access to servers, and so on;

- protection of confidential data x

In addition to the measures listed above, methods of ensuring information security include:

- protection of corporate communications;
- quick deletion of information from the server;
- control over the work of employees;
- ensuring fault tolerance and stability of all [DLMURL="https://utmagazine.ru/posts/8559-biznes"] business [/ DLMURL] processes.

Business economic security

To ensure economic security, the following measures are required:

1. Verification of the counterparty company. There is no clause in the law of the Russian Federation that would oblige an inspection of a future partner. On the other hand, the organization should exercise caution in this matter and not make transactions with suspicious structures. Otherwise, you can get a number of problems:

- counterparty defaults;
- loss of investor confidence;
- fall in business activity;
- danger of financial losses;
- problems with law enforcement agencies.

Before starting cooperation it is important to check:

- tax identification number;
- extract from the register;
- The exact name of the company;
- the general director;
- company sustainability;
- the presence of real registration at the specified address;
- the presence of the balance sheet.


2. Tax optimization allows you to reduce [DLMURL="https://utmagazine.ru/posts/9240-zatraty"] costs [/ DLMURL] enterprises and possible problems with the tax authorities. Outsourcing may be the best solution. With his help:

- More advanced tax planning methods are being introduced;
- company funds are saved by attracting qualified specialists from outside;
- “erupt” all errors in the functioning of the company;
- increased reliability, quality and most importantly - the effectiveness of the work performed;
- There is a chance to forget about tax problems and do business.

The optimization process is carried out in three stages - analysis of the company, development of a working draft and the introduction of a new scheme.

3. Protection of a computer with the installed system [[DLMURL="https://utmagazine.ru/posts/10099-klient"] client [/ DLMURL] -bank " . Lack of attention to this component of the business in recent years has led to a large number of crimes. Fraudsters easily gain access to the computer through which the flow is controlled and carry out the operations they need. Bank Sberbank of Russia claims that in 2014, in just a few months, hundreds of attempts to steal remotely by means of more than a billion rubles were stopped.

Protect computer with the client-bank system installed on it, in several ways:

- The PC should be used exclusively for operations with the “client-bank”;
- the rights of users should be as limited as possible, which reduces the likelihood of unauthorized access to the system;
- The operating system and antivirus should be updated in a timely manner;
- Mandatory installation of a firewall. Moreover, any traffic (except for transactions with the bank) should be blocked;
- a high level of security should be maintained in a constant mode, and not from time to time;
- information carriers with keys or access rights to the system should not remain on or near the computer;
- a workplace with a “client-bank” should be located in a separate room. At the same time, the organization of access control and video surveillance is mandatory.

Organization of business physical security

One of the most important tasks for any company is to protect against the penetration of unauthorized persons into the territory of the facility, control all the main premises of the enterprise, protect and ensure the calmness of the organization’s employees, and provide protection against fire. For this, the following set of measures can be applied:

1. Installation of video surveillance systems around the perimeter of the building and inside it. At the same time, the security service and [DLMURL="https://utmagazine.ru/posts/13866-rukovoditel-predpriyatiya"] the head of the enterprise [/ DLMURL] should see what is happening inside the office and outside. For visual control, additional options can be installed - recognition system, automatic image analysis, number recognizer and so on.

2. Access control system allows you to reliably protect the company from unauthorized persons entering the guarded object.

3. Hazard warning system activates a siren inside the protected building. If necessary, a voice alert can be activated, but more often a sound signal is enough.

4. Installation of the intercom - A reliable way to control access to the room. Such systems allow you to check the visitor without contact with him. But in large structures such a system will not work - there is too much flow of people.

5. Installation of a fire alarm capable of locating a fire in a timely manner and warning personnel of danger.



Legal security of business

Legal Security - This is one of the ways to protect a company (firm, enterprise) from gross legal errors that could entail serious reputation and financial losses. Legal security of the business implies comprehensive support in legal matters, timely advice and emergency legal assistance. Legal security can be handled by both employees of the organization and representatives of third-party companies.

The main methods of ensuring legal security include:

- examination of all documents, as well as verification of the correctness of their preparation;
- Representation of the interests of the company in the courts;
- service on all types of legal issues at all stages of the transaction;
- examination of all future transactions, commercial and investment projects of the company;
- timely interaction and resolution of controversial issues with government agencies;
- preparation for inspections of controlling structures;
- providing protection in case of illegal attempts by law enforcement bodies to seize company documents;
- filing claims, complaints about actions (inaction) of controlling (law enforcement) structures.

Organizational and personnel security of the business

Ensuring organizational and personnel security is the task of any leader. The essence of such measures is to protect activities from probable threats caused by the human factor. The main tasks are the identification and prevention of fraudulent activities of employees.


The main measures of organizational and personnel security include:

- collection of all necessary data about the company employees, their analysis, as well as decision-making on their basis on the person’s access to classified information;

- timely identification of potential threats that may come from an employee due to his past activities and personal qualities - criminal activity, negative moral qualities, work with competitors, and so on;

- a detailed collection of information about the candidate for the company’s employees for the subsequent analysis of the potential employee and decision-making on his employment;

- ensuring socio-psychological control of company employees, studying the internal situation within the team and identifying problems at an early stage;

- providing training and quality training for personnel in matters relating to the rules for handling classified data, as well as regarding the necessary security measures;

- investigation of all facts of suspicious behavior of employees that led to damage (financial, reputational) of the company;

- organization of labor disputes regarding the fulfillment of obligations under the contract and possible violations of security measures by employees;

- analysis and a detailed assessment of all organizational issues that may become a threat to business security.
Business security