Do You Have Control Over Your IT Assets?
An employee or consultant quits (or is fired) and takes critical information with them — such as sales reports, vendor lists, or instructions to keep essential systems running. When someone has critical information regarding the IT infrastructure, it can present real risk to your business.
Real-World Examples
The Web Developer
You hire a web developer. They purchase the domain and hosting, build a great new website, and you invest in SEO that begins to deliver web traffic and sales. Then your web developer goes MIA — not returning emails or phone calls. You hire a new developer, only to find they cannot access your domain name because you do not own it. The legal owner of your domain has complete control: what website it points to, who administers it, and the ability to sell it. This can be a timely and potentially costly oversight.
Digital Marketing Agency
You spend thousands with an ad agency on digital marketing. Monthly reports showed promise, but updates become less frequent and web traffic trends in the wrong direction. When you move on, you discover you don’t have access to any of the Google Analytics data or AdWords campaigns. The entire dataset from the previous year is lost and the marketing campaign has to begin again from scratch.
Fired the IT Administrator
A notable example from The Register: shortly after the American College of Education (ACE) in Indiana fired an IT administrator, it found that it no longer had any employees with admin access to its Google email service. The administrator returned a wiped, damaged laptop. Students could not access their Google-hosted email accounts or online coursework. After a contentious legal dispute, Google finally turned over the account to ACE. The school claimed an estimated damage of $500,000 due to its inability to access its own Google account.
Tracking IT Assets
If you do nothing else this year, commit to taking ownership of your IT assets. Here are our recommendations:
Limit local administrator rights. IT best practices dictate that employees not be given local administrative rights. This limits exposure to malicious attacks and reduces the risk of losing time, data, and money.
Verify you legally own your domain name. You can find ownership and registrar information at whois.net. Once confirmed, keep the details about your domain name registration account. Know who your domain is registered with and maintain the username and password. Limit who has access to this information. If you give someone access, change the credentials once they’re done. If you don’t actually own the domain, contact the owner and request a transfer — you have legal recourse if it was done maliciously.
Review all password-protected systems. Keep track of which systems require passwords and who has access to them, whether employees or consultants. Review system security regularly — a minimum of once a year — and remove any unused accounts. Reset passwords at least once a year and more often with high employee or consultant turnover.
Use a password manager. Maintain a secure record of all critical credentials, and make sure ownership of that record stays with the business.
Contact Versa IT for help auditing and securing your IT assets.