C-Level Executives Must Take Responsibility for IT Security
First: No one should open an email attachment if they don't know exactly what it is first. If a company sends out updates by email (which they shouldn't) it should be a standard, easy to recognize format. Employees should not be allowed to install updates on their own. Second: Employees should never be given administrative access to their computers. They should never be allowed to install software, including updates and applications, on their computers. Ever.Fourth: Your company should disable USB ports on computers for all functions except things such as keyboards and mice. There is software available that will allow you to do this, and it keeps malware that's transmitted by USB memory sticks from working. Fifth: All employees who use computers in your company must be trained to recognize social engineering emails, phishing emails and other attempts to insert malware on computers. They should be given a contact in the IT department that will be a real person handling security. If there's one attack, there are surely others. Sixth: Security software needs to be installed and working on all devices, including mobile devices, it must be kept updated, and it must be set so users can't disable it. Yes, it means a performance hit that some users won't like. Those who complain about it should be told to get over it. Any performance hit pales in comparison to the productivity loss of having to recover your network from a malware attack. Seventh: If you don't already have C-level executive buy-in, then get it. Using the example of the chemical companies and their stolen intellectual property should be enough. But if it's not, explain about the criminal penalties and the business risk if protected information is targeted by a Trojan in the network. Fines might not get the CEO's attention, but the prospect of jail time might. What's so sad is that these steps have been known for years. There's nothing new here, and there's no excuse for failing to take them except for poor training, poor motivation, laziness or C-level executives too dumb to protect their companies. You probably can't do anything about that last problem, except maybe find another company that's run by people who care about security.
Third: The update process must be centrally managed. There are two reasons for this. One, it ensures that all updates work with the standard configurations of your company's computers. Second, it keeps the employees from installing updates, including malware, but also updates that could break local custom software.