For any Westerners brave enough to scale the treacherous route up Everest, hiring a Sherpa is non-negotiable.

Kami Rita Sherpa, who’s been to the world’s highest summit more times than anyone else, put it this way: “Without a Sherpa, there is no expedition.”

The ethnic group indigenous to the Himalayan region is not just renowned for climbing with phenomenal energy and power. Described by many as the “guardian angels of the Himalayas,” Sherpas are essential guides. They possess all the resources necessary for their clients’ climb, including water, oxygen and food. They’re well-adjusted to the climate, the culture and perform well in high risk situations along the trek.

They’re also expert navigators.

Meet Sherpa Richard Martin. The Datamax Helpdesk Operations Manager possesses great resources to accommodate his clients’ journey. He knows the climate and the culture well. He, and fellow IT team members at Datamax, are expert guides for customers navigating the cybersecurity landscape every day.
Even with his credentials (which are many),* Richard knows as good as anyone, the landscape is always changing. Consider, just as an example, email phishing campaigns.

Sherpa skills must remain sharp.

“We talk all the time with key contacts within an account to train them  (about phishing emails and social engineering), so they can train other individuals within the company,” Richard says. “It’s definitely changed from two or three years ago, the sophistication of the email messages, and in some instances making an email look exactly like it came from your boss.”

But if you dig deeper, and know what to look for, you will see it didn’t.

“There are tale, tale signs that we can show people: Here’s what you look for. Here’s how you can avoid getting caught in the trap.”

Collecting the Gear.

Richard doesn’t himself use the term Sherpa.

He refers to his role as a Security “Generalist,” a term that’s more accurate if slightly less colorful, that describes a person competent in several different fields or activities. So with TechCare accounts or customers with security concerns, what does mapping out a security plan look like?

There’s more than one layer to that question.

“We want to train them on best practices, and the different vulnerabilities that are out there,” Richard says. “Security is a layered approach. It’s not one thing that will keep you secure. The way we prevent breaches or attempted breaches is to layer security on top of one another.”

What are the basic layers for businesses today?

• The Gateway or Firewall Level – Richard recommends an Advanced Gateway security suite, which has capture advanced threat protection (when you open an attachment, or click on a link that downloads something, it executes that link in a sand box in the cloud before it gets to your computer).
• The Email Level – spam filtering services with advanced threat protection against malicious emails.
• The Desktop Level – Webroot security anywhere, antivirus/anti-spyware/anti-malware on every system. (as soon as a file is touched, it’s scanned before being delivered to you).
• The Patch Level – making sure systems are patched and up to date, as well as ensuring you’re running operating systems that are still supported by Microsoft.
• The End User Education level – This layer of defense is a little more tricky, because the climber must take responsibility for his – and his entire group’s – security and wellbeing.

“By the time it makes it to that end user, you hope there’s enough training and enough education and security parameters to prevent what’s coming through,” Richard says.

Training the Climber.

Kami Rita Sherpa believes that “Climbers need to wake up.”

At least 11 people had died midway through the 2019 climbing season, and he feels like many do not take responsibility for their own abilities and sustain awareness of their environment.

It only takes one misstep to incite disaster.

"Even the strongest Sherpa cannot take an incapacitated person lower by themselves or expect extra oxygen to be delivered to 8,400 m at a moment's notice,” he said in an interview with the BBC. “Climbers need to wake up and understand that climbing a big peak like Everest is extremely risky.”

Richard, in many ways, feels the same. One thing he pushes with clients is higher end user awareness about the environment around them. One avenue for that? Email security awareness training.

“They not only get security training. There are simulated phishing campaigns, where ‘malicious’ emails are sent out to test employees, and alerts are sent out to executives saying ‘here’s where we need additional training.’”

It only takes one misstep, one ill-advised click, to incite disaster.

Having a Backup Plan.

“Backup, Backup, Backup.”

Our Sherpa says it three times, just for emphasis.

A hybrid cloud/onsite backup solution is an essential component to security, he says. (Read more about Business Continuity and Disaster Recovery in this article).

“We use a particular solution that not only backs up a server, it will boot that backup in a virtual environment, take a picture of the log in screen and show you it’s there, as well as look at your active directory and let you know it’s functioning properly,” Richard says. “If someone gets hacked, your backup is your saving grace.”

If Sherpas are the “guardian angels of the Himalayas,” Richard and the entire IT team at Datamax are the “saving grace” for businesses navigating today’s treacherous cybersecurity climate.

The trek continues, conditions change. But traveling without a Sherpa? It’s essentially non-negotiable.

*For a full list of Richard Martin’s Microsoft, CompTIA and other certifications, visit his LinkedIn page here.