Key takeaway
Staff education, email and web defenses, device security and incident response should reinforce each other. Define what each control is responsible for.
Include remote devices in inventory and patching
Identify who owns each work laptop, server and mobile device, which services it can reach and who is responsible for updates. Maintain a process for supported operating-system, browser, web-application and server-software updates. Use the organization’s approved remote-access path and MFA; a VPN alone does not prove that a device is safe. Define access conditions separately for personal devices, contractor systems and field equipment. Do not assume that every mobile device or field asset supports an EDR agent.
Define the role of EDR clearly
Endpoint detection and response (EDR) supports monitoring and investigation of device activity. Depending on the product and configuration, EDR may surface suspicious process or file activity, raise alerts and support response actions. It does not ensure that an employee will spot a fake invoice or avoid entering a password on a phishing page. Email filtering, web protection, strong authentication and employee reporting have separate roles. In an incident exercise, check who receives alerts and who is authorized to isolate a device.
Limit application and third-party access
Give a cloud application only the permissions it needs and restrict unapproved remote-access tools. Keep a record of supplier accounts, integrations and access periods; remove unused accounts and permissions. Where supported, require multifactor authentication and separate approval for sensitive systems. Network segmentation can limit the routes a compromised device can reach.
Practise incident and recovery steps
Use an exercise to check responsibilities and response authority. Because ransomware can affect backups, test their protection and restoration separately. Use safe scenarios without live malicious files.
Assign owners
Agree on IT, security and finance roles, their authority and contact paths.
Test reporting
In a safe exercise, test reports of link or file opening, credential entry and MFA approval.
Rehearse response
The authorized team handles account and device actions; finance contacts the bank if a payment is affected.
Test restoration
Verify backup integrity and restoration in an isolated, clean test environment.