What do you do if you notice a client is not following network security best practices?

The initial step is doing assessment to the real situation and see what the existing security measures and controls and do vulnerability assessment to see if there's any vulnerabilities exist as well as doing penetration testing and see if can breach the systems and able to hack it. Once done, a report should be made including all results and findings and also include the recommendations that should be followed to close any security gaps.

I might gently remind them of the importance of cybersecurity and offer assistance or resources to help them improve. It's all about ensuring their safety and the security of their data.

It is important to initially assess the situation from a security perspective. Brief your customer on your findings and make recommendations based on those findings. Allow the customer to select the solution(s), based on your findings. Deploy and test the solution, always keeping the customer in the loop, being sure to inform them of any issues encountered during the testing phase. Once the solution is in production, monitor and keep versioning and patching up to date, in accordance with vendor recommendations. Confirm that the customer is satisfied with the way the solution is working.

Document the Observations: Clearly document the specific instances where the client is not following network security best practices. Include details such as what practices are being neglected and any potential vulnerabilities or risks associated with them. Communicate with the Client: Approach the client in a non-confrontational manner and communicate your observations regarding their network security practices. Explain the potential risks and consequences of not following best practices and emphasize the importance of maintaining a secure network.

This involves utilizing vulnerability scanners, penetration testing, and network analyzers to identify potential weaknesses. Additionally, the network architecture, policies, and documentation are reviewed to ensure adherence to industry standards. Key elements examined include the configuration of essential security components like firewalls, antivirus, encryption, backup systems, and authentication and access control measures. The aim is to pinpoint gaps or vulnerabilities that may exist in the current security infrastructure.

It's important to communicate the finding and the risk, but to understand it's a business decision. I'd caution you (speaking to myself as much as anyone), not to get too wrapped up in what seems an obvious decision. Where possible, quantify the risk. Is it one machine or 100 that are vulnerable? What systems or applications are exposed? What type of data/systems could be effected? The more you can clearly articulate the potential impact to the company the better the outcome will be. If you will be held accountable for the risk, clearly documenting it and getting risk acceptance signatures is strongly recommended. It is all too common to make the Security Lead (CISO/Director...), the circuit breaker to replace.

Do not underestimate the importance of human interactions as a success factor at any stage of any network security assessment report : - Identify all the client stakeholders, - Make sure that your team members are paired with the correct stakeholders on the client side to get the required insights, - Adapt the final executive presentation to the key stakeholders, as you need to get their buy-in: be concise, avoid any technical wordings that can bring confusion, and explain how a tailored network security remediation plan can bring huge benefits to their company in terms of reputation and reliability. - Be open to any of the client feedback, as those are valuable to adapt your plan

After assessing the situation, the next crucial step is to communicate with the client about my findings. I would approach this communication with clarity and transparency, outlining the specific areas where their network security practices are deficient and explaining the potential risks associated with these shortcomings. It's important to use non-technical language to ensure the client understands the gravity of the situation. Additionally, I would emphasize the importance of addressing these issues promptly to prevent potential security breaches and safeguard their sensitive data and assets. Open dialogue with the client fosters trust and collaboration, enabling us to work together to implement necessary improvements effectively.

Communication is step one as well, they are a client. How we communicate makes a world a difference. Are we simply wagging or finger at the situation, which solves nothing or earning our fee? I choose to productive, so that means bringing solutions. Why is the client failing in this area? Perhaps it's a top down situation where resources aren't allocated properly. Or maybe it's tech debt. Whatever the cause I'm bringing solutions to my contact and asking where can I help. Naturally I'd want to point out the consequences of not securing a network or system via a custom use case or more than likely a real world situation from an attack perspective.

Communicate with your client to address the issue, providing specific examples of the lapses in network security best practices. Offer clear, actionable recommendations for improvement and explain the potential risks and consequences of non-compliance. If necessary, propose a meeting or a workshop to discuss these practices in detail. Follow up to ensure that the recommended changes are implemented and offer support throughout the process to facilitate compliance and enhance their network security posture.

Coming to folks with a problem is one thing, but coming to them with an answer will leave you in an infinitely better spot. Take the time to understand the issue from their perspective, but be the person who brings a thoughtful, measured, and situationally appropriate solution, not just a doom and gloom problem.

When communicating with client we techies must use real world examples client can comprehend in their own vanaqular. IE: do not send your credit card information by email. It is the same as writing it on paper and passing it around a restaurant until it reaches the cashier. It is not safe

Provide recommendations and solutions tailored to the client's specific lapses in network security best practices. Educate them on the risks and potential consequences of their current practices. Offer actionable steps for improvement, such as implementing stronger access controls, updating and patching systems regularly, employing encryption for data in transit and at rest, and conducting regular security audits and training. Follow up with assistance in developing a comprehensive security policy and support in implementing the recommended changes to ensure compliance and enhance their network security posture.

A client coming to any new property doesn’t know about the policy and procedures of that property so in my opinion the best practice is guidance.

If a client isn't following network security best practices, start by implementing and testing recommended solutions in a controlled environment. Document changes and their impacts, ensuring they address security gaps without disrupting operations. Educate the client on the importance of these practices, demonstrating the potential risks and benefits. Offer training for their team on new protocols and tools. Continuously monitor the network to ensure compliance and adjust recommendations as necessary, fostering a culture of security awareness and proactive risk management.

First, conduct a comprehensive audit to identify specific lapses in the client's network security practices. Next, prioritize issues based on risk and impact. Develop a clear, actionable plan addressing critical vulnerabilities first. Educate the client on best practices, the risks of non-compliance, and the benefits of adhering to security protocols. Offer tailored solutions that fit their business operations and resources. Implement changes in stages, with continuous monitoring and feedback to ensure compliance and adjust strategies as needed.

Once the client is aware of the security gaps, the next step is to collaboratively evaluate and improve their practices. This involves identifying feasible solutions tailored to their specific needs, budget, and resources. Implementation may include updating software, enhancing access controls, implementing encryption, or providing staff training. Regular monitoring and review ensure ongoing effectiveness, with adjustments made as needed to adapt to evolving threats and technologies.