Page 32 - GBC Magazine Winter ENG 2023

Glossary of Terms
Automatic patching: The process of automatically distributing patches or updates to devices, systems, and software.
Backup Retention: also referred to as data retention, involves guidelines regarding the type of data to be stored, its location, and the duration for which it should be kept.
Cloud: Software and services that run on the Internet, instead of locally on your computer.
Data leakage: The unauthorized passage of data or information from inside an organization to a destination outside its secured network.
Encryption: The process of converting information or data into a code, especially to prevent unauthorized access.
Firmware updates: Code that tells the hardware how to behave in a new or modified way to ensure security and efficiency.
Firewall: Part of a computer system or network designed to block unauthorized access while permitting outward communication.
Granular Recovery: This is the ability to recover individual or partial items from a backup set without the requirement to restore the entire backup job.
Incident Response Plan: This is a company-specific guide for IT personnel to identify, handle, and recover from network security issues such as cybercrime, data loss, and service disruptions.
Malware: Software that is specifically designed to disrupt, damage, or gain unauthorized access to a computer system.
Multi-factor authentication: Multi-step account login process that requires users to enter more information than just a password.
Phishing: The fraudulent practice of sending emails or other messages purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card number.
Ransomware: A type of malicious software designed to block access to a computer system until a sum of money is paid.
Social engineering attacks: Manipulating, influencing, or deceiving a victim in order to gain control over a computer system, or to steal personal and financial information.
Threat actors: Individuals or groups that attack digital devices, networks or computer systems.
VPN: An arrangement whereby a secure, apparently private network is achieved using encryption over a public network, typically the internet.
Sources: www.crowdstrike.com, www.dictionary.com, www.ibm.com, www.owasp.org, www.techtarget.com.
32 Golf Business Canada
SECURELY CONFIGURE DEVICES
Properly configuring devices like point-of-sale systems, reservation systems, and golf course management software is crucial to prevent vulnerabilities that hackers could exploit. Secure configuration helps protect sensitive customer and business data. There is no need for exposed or open systems. Remove admin- istrative rights and lock these devices down as much as possible. Save yourself from yourself and leave main- tenance and changes to qualified administrators.
USE STRONG USER AUTHENTICATION
Strong user authentication, like password policies and multi-factor authentication, ensures that only autho- rized personnel can access sensitive systems and data, reducing the risk of unauthorized access and data breaches. The golf industry typically has seasonal workers, so it is easy to neglect access. Know your data audience and lock it down to the least privileged access.
PROVIDE EMPLOYEE AWARENESS TRAINING
Employee awareness training is essential to educate staff about cybersecurity best practices. In the golf industry, where employees may handle customer in- formation and financial transactions, this training helps prevent social engineering attacks and improve overall security posture. Adding random testing will also set the tone that you take security seriously. You can have all of the best security practices in place but your last line of defence is the end user. Train them.
BACKUP AND ENCRYPT DATA
Data backups and encryption are essential to protect customer and financial data. Backups ensure data recovery in case of incidents, while encryption adds an extra layer of security to prevent unauthorized access to sensitive information. A robust backup strategy should include what data is to be protected, where it will be stored (preferably onsite and in the cloud), how often the backup should run, and how long to retain the backup copy. Complete this strategy with monthly backup restore testing to ensure the data’s integrity.
SECURE MOBILITY
With mobile apps and technology becoming prevalent in the golf industry, ensuring the security of mobile devices is crucial. This includes securing mobile payment systems, mobile reservations, mobile golf course management tools and any mobile device used by employees that accesses corporate data. 40% of data breaches are a direct result of lost or stolen devices. It is important to use a good Mobile Device Management application.