Anti-malware and virus policy

This is a copy of our internal policy. We share it to help customers get a better understanding how how we work. The policy will get updated or improved from time to time. You’re welcome to give us feedback by sending a mail to security@small-improvements.com.

Overview

It’s crucial our computers are not getting infected with malware, since that would bypass any of our other security measures. To achieve this, several measures are required

  • The biggest threat to an already security-concious organization like Small Improvements is malware that disguises itself as useful software. Any small useful utility (like a timezone conversion tool, or audio-player) can turn out to be spying on the user, or – even if not harmful today – get hacked eventually and turn into Malware. Therefore employees are requested to install software from trusted vendors only, from vendors that have been pre-approved by the company, or approved on the spot by their team’s Team Lead.  The goal is to minimize potential attack vectors, so don’t install software on work computers unless it’s required to do the job, and unless you know a software has approval from the company. You may always request access to new software of course, but the company needs to know and approve.
  • Another key attack vector is malware sent by mail: Everyone is required to be very sceptical at any unsolicited mail, and at any odd-sounding mail that requires to open attachments of click links. Even coworkers’ mails need to be viewed with scrutiny to avoid falling victim to a coworker who has been hacked and starts sending malware mails
  • Further Malware attack vectors are dodgy or breached websites. Only go online with up-to-date browsers that are considered safe, like Chrome, Safari, Firefox, or Edge, and avoid sites that are neither work-related nor informational
  • Firewalls: Every employee is required to enable their operating system’s firewall and keep it enabled
  • Antivirus: Any computer with an operating system prone to viruses (essentially meaning all Windows computers) need to run up-to-date Antivirus software. The company will make recommendations as to what software to use. Apple and Linux computers are excempt from this policy since viruses are effectively prevented by the operating system, and no antivirus software provides better support than the built-in mechanisms.
  • Operating system updates: Every employee is required to keep updating the operating system at all times. This is usually easy since the OS prompts the user, but one still has to accept the update, and everyone is required to do so whenever feasible.

Preapproved installable tools

This is a non-exhaustive list of preapproved software. We update this list frequently internally, but don’t necessarily update it on the website immediately.  We merely provide it as an indication of how we work.

  • Adobe Products
  • Apple Products
  • Microsoft Products
  • Google Products
  • Music: VLC Player, Spotify, Soundcloud
  • Design tools: Sketch, Figma, Skitch
  • Dev Tools: Jetbrains & Github products, JProfiler, Emacs, vim, and comparable popular and trusted dev tools
  • Mail: Thunderbird, Evolution
  • Browsers: Firefox
  • Productivity: Slack, Join.me, Goto-Meeting