Page 34 - GBC Magazine Winter ENG 2023

ESTABLISH BASIC PERIMETER DEFENSES
Basic perimeter defences, such as firewalls and intrusion detection systems, are designed to protect network boundaries from unau- thorized access and cyber threats. It is crucial to ensure the imple- mentation of a suitable, business- grade firewall.
Secure all remote connections to the corporate network using a Virtual Private Network (VPN).
Wireless networks can be another source of intrusion. To prevent unintended users from gaining access, it is advisable to separate corporate and guest networks. Lastly, adherence to the Payment Card Industry Data Security Standard is highly rec- ommended.
SECURE CLOUD AND OUTSOURCED IT SERVICES Many golf courses use cloud services and outsourced IT solutions for various operations. Securing these services is vital to protect data and ensure the integrity and availability of systems. It is important to under- stand how information is being accessed and managed. Ask your providers for monthly or quarterly reports outlining security scores and access rights.
Another misunderstood area that should be reviewed and addressed is data backup in the cloud services you own. Make sure the backup strategies align with your requirements. There may be times when you will need to add a third-party backup to meet your requirements. A good example of this is Microsoft 365. Although they provide a basic backup, Microsoft claims you should look for other options that provide better retention options, granular recovery, compliance, and additional security.
SECURE WEBSITES
Golf courses often have websites for booking tee times, providing infor- mation to customers, and conduct- ing online transactions. Securing websites is essential to protect customer data and maintain trust. It is also crucial that you align with the Open Worldwide Application Security Project Application Security Verification Standard (OWASP ASVS) guidelines. This guideline provides web application security controls. This is a control that is often overlooked.
IMPLEMENT ACCESS CONTROL AND AUTHORIZATION Implementing access control and authorization mechanisms is relevant to restrict access to sensitive systems and data, ensuring that only authorized personnel can make changes or access specific in- formation. Assign unique accounts to each user and provide the minimum levels of access and per- missions needed to perform the job functions.
SECURE PORTABLE MEDIA
In the golf industry, portable media may be used to transfer data or update systems. Ensuring the security of portable media is important to prevent data leakage or malware infections. Design a policy and understand what portable devices should be allowed on your network. Never allow end users to remove data from your network using a portable media device. Understand access and egress of corporate data and what devices can attach to your network.
THE BEST LINE OF DEFENSE
The Canadian Baseline Cybersecu- rity Controls serve as a comprehen- sive strategy for cybersecurity, providing protection against a broad spectrum of cyber threats, ensuring regulatory compliance,
securing customer data, and reducing financial losses. They also strengthen the overall resil- ience of a business. These controls also provide a competitive advantage by showcasing a dedi- cation to data security. A strong plan provides a strong defence against emerging threats like malware, ransomware, phishing, and data breaches. The plan also ensures legal and regulatory com- pliance, which is critical to avoid legal repercussions and penalties.
Furthermore, these controls are crucial in maintaining an orga- nization’s brand reputation and readiness to respond effectively to cyber incidents. Ultimately, compliance with these controls shows due diligence and a dedica- tion to responsible cybersecurity practices, which is vital for main- taining trust with regulators and legal authorities.
Preparing for cyber incidents is essential, given their inevitabili- ty. The structured framework outlined in the controls above ensures organizations are well- prepared to respond effectively and minimize the impact of security incidents. The Canadian Government and Insurance companies support these controls. Golf courses have a short window each year in Canada to shine, be prepared, and golf on.
Golf Business Canada
34 Golf Business Canada