Cybersecurity tips for small businesses

 Do you know the basics to protect your small business from cybercrime? Read to learn the steps you can take to keep your small business safe in the cyber environment. When it comes to running a small business, cybersecurity solutions are not always the most fun topics to discuss and are often overlooked or forgotten. But in reality, you're only as safe as the weakest link, so making sure you adopt good protection practices to safeguard your business from data breaches, hacks and scams is paramount to maintaining a trouble-free business. Let's use an analogy to review some cybersecurity concepts for small businesses.

Think about a traditional business with a physical location. What are the access points to enter the building? You are probably thinking about doors and windows. And you've probably already implemented measures to protect access. You have locks on the doors. You may have an alarm installed and possibly security cameras, motion detectors and lights. The customer-facing area has products. But you keep the money in the cash register behind a counter or desk and you probably have a safe in the back where customers are not allowed to enter.

Industry cybersecurity best practices include logical and physical access to data

Limiting access through physical barriers and monitoring tools will create a safer environment. And all these are also the first steps of cybersecurity. Industry cybersecurity best practices include logical and physical access to data. Physical access refers to all of the above, what you do to protect the business.

Physical security measures should also protect your information technology (IT), as well as your products and cash.

1. Take an inventory of your computing resources. As a business owner, you should know that IT resources contain customer, employee, and business data. Identify where tablets, desktops, and laptops are located.

2. Execute a plan to protect computing resources at the physical level. When the computing resource is not used, where is it stored? You should consider that your data and the physical items that store data are more valuable than the cash sitting at the register. They should be kept locked when not in use. Consider having a log or a way for employees to sign out mobile devices to track the location of all equipment.

3. Password protect devices. Each device should require a password for entry to prevent use of the device by unauthorized persons. This control is a transition from physical to logical controls in establishing a cybersecurity plan.

Next, think about the logical barriers to unauthorized access to data on your devices. Logical measures serve to ensure that only authorized users can perform actions or access information on a network or at a workstation.

1. Take inventory of your data. Just like you need to know what physical computing resources your business is using, you need to know what type of data it is storing. Do you collect customer emails for a newsletter? Do you have a file of proprietary business information that represents your secret formula for success? Identify your employee data and where it is stored.

2. Execute a plan to logically protect data. Locks and keys are important for protecting buildings and rooms physically, and passwords and encryption are the equivalent of protecting data logically. Each employee should have their own password that allows them to access only the data they need to do their job.

a. Use passwords to not only protect your device, but also file folders and documents.

b. Consider using shared portals that store documents that can only be accessed by those who need to complete their assigned tasks.

c. Use software that has multi-factor authentication. Think of this as a lock that adds a layer of protection.

Next, let's think about how to better protect the entire IT structure. Your building may have an alarm or surveillance system that alerts you when an intruder tries to enter. The same type of monitoring is recommended for your computing resources.

1. Updated antivirus protection. Use trusted antivirus or antimalware software and update it regularly. Also, run patches and updates for all software regularly. Companies periodically push updates to improve the functionality of their software and often eliminate identified cybersecurity weaknesses. You don't want to leave a window open that bypasses all the locks on your doors.

2. Train your employees to identify phishing and fraud attempts. Teach them not to click on unknown links or attachments. Consider limiting use or access to personal email accounts on work computing resources.

3. Use the cloud. Using the cloud or cloud-dependent software as a service can be a great way to streamline your business. Check for your safety. Find out where your data will be stored and what measures will be put in place to protect it. Do you encrypt data in transit? Do you encrypt data at rest? What is your responsibility if someone hacks you and accesses your data?

Cybersecurity for small businesses is a path and not a destination

As your business grows, your cybersecurity must also mature. Your cyber security measures will be expanded to include monitoring individuals for unauthorized access. You will check for threat news and apply preventative controls to your systems. Consider obtaining an ISO 27001 (an international standard for information security) or SOC 2 (a voluntary compliance standard developed by the American Institute of CPAs) certification, which can not only protect the business, but can also be a differentiator in the market.

All of this can cost money. If your business can't afford it all today, do what offers the most protection for the most at-risk items. Then, set a deadline to improve the rest. Cybersecurity for small businesses is a path and not a destination. This is an area that will always require updates and improvements.

By having common-sense cybersecurity information, knowledge, and business practices, you can help protect your customers, your reputation, and your bottom line.