Keeping essential systems secure and available
Modern infrastructure depends on software. Hospitals, schools, utilities, manufacturers, government agencies and financial institutions all rely on operating systems, applications, servers, cloud services, mobile devices, network equipment and specialized technology.
To support this year’s Cybersecurity Awareness Month “Securing the Next 250” theme, organizations must maintain these systems and be able to identify suspicious activity. Software updates reduce known vulnerabilities, while logging and monitoring help cybersecurity teams detect and investigate threats.
Why Software Updates Matter
Software can contain vulnerabilities that attackers use to access systems, install malware, steal information or interrupt services. When a developer discovers or confirms a vulnerability, it may release an update or security patch to correct the problem.
Especially in the age of AI, once a vulnerability becomes publicly known, attackers may quickly attempt to exploit organizations that have not installed the update. Delaying an important security update can leave a known path into a device or system.
Updates may address:
- Security vulnerabilities
- Software defects
- Stability issues
- Compatibility problems
- Performance concerns
- Unsupported features or components
Updates are important for more than computers. Phones, tablets, browsers, collaboration tools, network equipment, smart devices and specialized systems also require maintenance.
What Employees Should Do
Employees help keep systems secure by:
- Restarting University devices when prompted.
- Keeping personally managed devices current.
- Allowing approved updates to install.
- Using supported software and operating systems.
- Avoiding unauthorized browser extensions and applications.
- Leaving university security and management tools enabled.
- Reporting devices that repeatedly fail to update.
- Returning or replacing obsolete equipment to the Help Desk.
Do not postpone required updates indefinitely. If an update interferes with an essential business process, contact the Help Desk.
Logging Creates a Digital Record
A system log is a record of events or actions. Depending on the system, logs may show:
- Successful and unsuccessful sign-ins
- Changes to accounts and permissions
- Files that were accessed or shared
- Messages that were sent
- Software that was installed
- Devices that connected
- Security alerts
- Configuration changes
Logs help security teams understand normal activity and detect behavior that may indicate an attack.
Why Monitoring Matters
A log has limited value if no one reviews or analyzes it. Security monitoring uses automated tools, alerts and human analysis to identify suspicious activity across systems.
For example, monitoring may identify:
- A sign-in from an unusual location
- Multiple failed sign-in attempts
- An unexpected mailbox rule
- Access from an unmanaged device
- A large or unusual file download
- Security software being disabled
- A suspicious program communicating with an external server
Monitoring does not eliminate the need for employees to report suspicious activity. An employee may notice context that an automated system cannot see, such as an unusual request from a coworker or a sign-in alert that occurred while the employee was not working.
Preserve the Evidence
If you suspect that a device has been compromised, avoid taking steps that could remove evidence unless instructed by Information Security. Do not delete suspicious files, wipe the device or attempt extensive cleanup on your own.
Instead:
- Stop interacting with the suspicious message or application.
- Disconnect the device from the network if active malicious behavior is occurring, and you can do so safely.
- Contact the Help Desk or IT as soon as possible.
- Record what you observed and when it occurred.
- Follow the incident-response instructions you receive.
Wrap Up
If you have any further questions about updates, logging or our incident response processes, please reach out to the Help Desk. Likewise, if you have any questions in general, please don’t hesitate to ask the NEOMED IT team as we are here to help. For guidance on NEOMED’s incident response plan, please see our NEOMED Incident Response Plan Policy.