Cyber Security

Recommendations for Small Business Owners

I often get asked, what do you recommend for my business. Here are some recommendations for business owners when it comes to cybersecurity: 

Cybersecurity is really a wide net, but very crucial for businesses of all sizes. Given the evolving threat landscape and the potential consequences of a breach (financial loss, reputational damage, legal repercussions, etc.), it is vital that business owners remain vigilant. Hire an MSP (Managed Service Provider) that can manage this for you, while you focus on your business. 

 1. **Risk Assessment**: Before implementing security measures, understand where your vulnerabilities are. Regularly conduct risk assessments to identify and prioritize potential threats to your business. Contact your MSP or reach out to a risk assessment group that some of your business partners might know.  

2. **Regular Updates & Patches**: Ensure all hardware, software, including operating systems, applications, and firmware are updated regularly. Many cyber-attacks exploit known vulnerabilities in outdated software. Not keeping the hardware & software up to date can cause overall issues with the device, slow it down, and cause crashing.  

 3. **Security & Multi-Factor Authentication (MFA)**: Make sure that you are using strong & difficult passwords to secure your accounts, logins, apps, payment system, etc. Require MFA for all business accounts and systems. This adds an additional layer of protection, ensuring that even if a password is compromised, unauthorized access is not easily granted. This is the key. Make sure any account you have is locked down with an MFA. If you do not like passwords, then get a password manager.  

 4. **Employee Training**: Human error is a leading cause of security breaches. Provide regular cybersecurity training to all employees, making them aware of best practices, and how to recognize and avoid common threats like phishing. Use a password manager. Do not let users put passwords on notepads, under a keyboard etc. Make sure to use different passwords on all accounts. Hackers can get into accounts most of the time because people are too lazy to make a different password than the last.  

 5. **Firewalls & Intrusion Detection**: Employ a robust firewall and intrusion detection system to monitor and block suspicious traffic at your office or home. Your ISP (Internet Service Provider) might have a basic security system set up, but you will need to set up a secure firewall. If you are dealing with sensitive data, this is a very important step. Make sure you get a quality firewall that will help you secure your network.  

 6. **Backup Regularly**: IMPORTANT: Maintain regular backups of all critical data, both onsite and offsite. Ensure backups are encrypted and test their integrity periodically. Do not skip this. STOP FOR 1 Min. Read: Simple example: Your life or business is on your laptop, desktop, or server and it takes a dive, or someone steals your device. How do you recover? If you have a backup, you can restore your life, data, business. Do not wait until it is too late.  

 7. **Limit Access**: Practice the principle of least privilege. Only provide access to data and systems that employees absolutely need to perform their duties. Make sure you lock down permissions, and shares. Do an audit at least 1 or twice a year of your file system and shares. This will help protect your data.  

 8. **Endpoint Protection**: Use reputable antivirus and anti-malware solutions on all endpoints, including servers, workstations, and mobile devices. There are so many viruses, & malware in today’s world, that it is too easy to get caught up with one. Make sure you have a solid Anti-Virus/EDR system in place to keep your computers and users safe.  

 9. **Incident Response Plan**: Prepare a detailed response plan for potential security incidents. Knowing the steps to take in the event of a breach can mitigate damage. Make sure you have an IT technician or support team you can call on in case of any incident that comes up. 

 10. **Secure Physical Access**: Don’t forget physical security. Limit and monitor access to offices, closets, servers and network infrastructure.  Door security, Security Cameras, and alarms.

 11. **Secure IoT Devices**: If your business uses Internet of Things (IoT) devices, ensure they are secured and segmented from critical business networks. Open devices that are not on a management system can open up breaches to your data or network.  

 12. **Vendor Management**: Make sure you have quality vendors that you can trust to manage your network, data, etc. Ensure that third-party vendors and partners that have access to your systems or data follow good cybersecurity practices. 

 13. **Encrypt Sensitive Data**: Always encrypt sensitive data, both in transit (using protocols like SSL/TLS) and at rest. This can be files or emails. There are various security vendors that will help protect your data and email systems.  

 14. **Regular Audits**: Periodically review and audit security practices and systems. Consider hiring a third party to conduct penetration testing to your office locations, web, tools, or apps.  

 15. **Stay Informed**: The threat landscape evolves constantly. Stay updated with the latest threats, vulnerabilities, and best practices by following relevant security news, advisories, and forums. If you have a management team, they should be informed and let you know about anything that is urgent. 

 16. **Invest in Security Tools**: Utilize tools like intrusion prevention systems, threat intelligence platforms, and endpoint detection and response solutions for better protection. This can depend on what type of business you are running, and what your wants, or needs are.  

 17. **Data Management**: Know where your sensitive data resides, who has access to it, and ensure it’s securely deleted when no longer needed. Archive to an off site location for long term storage. 

 18. **Legal and Regulatory Compliance**: Depending on your industry and region, there might be specific regulations governing data protection. Ensure you are compliant to avoid hefty penalties. If you are working with a managed service provider, they should be working with you to make sure you are covered for any compliance that needs to be set up to keep you, your office, your team, and your client’s data safe.  

 19. **Network Segmentation**: Divide your network into segments, so if an intruder gains access to one part, they don’t automatically have access to all areas. This would be directed more at a larger office. This can be detailed in another post. 

 20. **Secure Wi-Fi Networks**: Ensure that Wi-Fi networks are secured with strong passwords, and consider having separate networks for company business and guests. Guest networks are limited to web access. They will be blocked from the corporate network where your data is stored.  

21. **Website Management, Backup & Security**: Depending on the type of web site you have, and what all it does, make sure that you know everything about your web site basics (you don’t have to be a nerd, but know your host, register, web site type, how to login, and what the credential are, etc). Make sure it is managed by a professional who is going to be a partner for you and your business, not just a tech. Your website is your first impression to clients. 

• Back up your site – To the local host and off site at least once a day, week, or month depending on the type of site it is. This is crucial.  

• Management – Make sure, as we spoke of above, to find a solid quality company to help manage and maintain the site, host, and any domain registration. They will take care of the site, make sure it is secure, and work as it should.  

• Security – Make sure that your server/website has security set up such as a firewall, and monitoring system to notify you or the management team of any issue with the site.  

Remember, cybersecurity is not a one-time effort but a continuous process of assessment, implementation, training, and adaptation. The combination of the right technology, policies, and user awareness can help safeguard a business in the evolving digital landscape. I have seen clients that do not want to spend the time or the money on securing they networks, data, etc and turn around and loose days/weeks/month of work, money, time, & clients just because they would not secure their network/data/location to keep them safe. Just like you are a professional in your position, understand that your IT team are professionals in what they do. Trust them and allow them to keep you safe and secure.

Got questions? Want to know more? Need to find that partner that will take care of your hosting, or IT needs? Fill out the contact form below and our team will be in touch.