When we read about companies the size of Marriott and Hyatt becoming victims of malware and cyberattacks, it may concern business owners. However, it’s easy to think, “We’re a smaller company, so we’re not as likely to be attacked.”
You may think your small to medium-sized business (SMB) is less likely to be attacked because of its size. However, it’s not the size of the company, but the type of data that makes it attractive to attackers. According to an article in AdWeek, so much personal identifiable information (PII) exists across the internet that it’s practically inevitable that malicious forces would try to take it.
For example, if a hacker can get his hands on confidential customer data, credit card data, or some other type of intellectual property, the company is more likely to become a target regardless of its size. In many cases, smaller businesses are easier targets because they aren’t as prepared for a cyberattack. In addition, it’s harder for a smaller company to recover from the financial ramifications of an attack. Not only could direct costs of an attack, such as clean-up or ransom payments, have a big impact on the bottom line, the indirect costs such as brand and trust damage could have severe consequences.
Here are 7 steps you can take to greatly reduce your risk of a cyberattack:
1. Appoint a Cyber SMB Security Point Person
If you run a small to medium-sized business, you might think that you can’t afford a full-time security person. While this may be true, it’s important that you have at least one person in your organization that keeps up with your cyber security efforts. This person may have other responsibilities, but it’s critical to have someone on top of the latest in cyber security.
A few blogs worth checking out are: Wired’s Threat Level, Roger’s Information Security Blog, Dark Reading and Krebs on Security.
2. Make Sure Your Data Is Backed Up
Use a cloud-based secure backup plan that is completely independent of any hardware that exists in your office. While this won’t keep your production data from being compromised, it will ensure that you still have access to your data in case of an event (and will probably help you sleep better at night).
3. Take Physical Security Seriously
It’s important to think about physical SMB security in stages.
- Stage 1: A key card and a call to a security desk to verify the user can access the building.
- Stage 2: Passing a biometric scanner in addition to the key card. Some companies also like to use a “man trap” during the authentication process; this will give employees access to the interior of the building and a work area.
- Stage 3: A key card and possible additional security for entrance to the data center.
The perimeter of the building should be under a closed circuit video surveillance – with special emphasis on entrances. Once inside the building, every stage should be covered by cameras.
4. Ensure Wireless Security
Don’t assume that your wireless is safe just because someone is outside your building. Any hacker with a decent antenna can connect to your Wi-Fi signal from far away. For this reason, you should always use a strong password for your wireless, along with the WPA2 protocol.
If you have visitors coming to your office, it can be a good idea to set up a guest network that only gives access to the internet. This way, you can give out access to Wi-Fi for guests without giving access to your internal network.
5. Limit Access to the Appropriate People
Do you know who has access to your data? Does Phil from accounting have access to HR data just because he has access to other parts of the system? If you aren’t sure, this is a real problem that you must address immediately.
6. Use Endpoint Security Software
Using endpoint security software gives you several ways of dealing with an attack across multiple operating systems (Windows, OS X, and Linux). Endpoint security software, such as SentinelOne, has the ability to remove a machine from the network temporarily after it is infected to keep it from tainting other machines.
The software will allow you to configure it to alert, quarantine, or kill a malware or virus attack, and then view all attack vectors to see what the malware exploit did on the system. Most importantly, endpoint security software will allow mitigation where you can roll back a computer that has been infected to a pre-attack state, and then reconnect it to the network remotely. This can allow administrators to remotely protect their network and restore computers after an attack, saving both time and money.
7. Train Your Staff
Educate your employees on the importance of cyber security and the unique challenges for cyber SMB security. You can start by creating an education program. Employee attendance should be mandatory.
Some important topics should include:
- Passwords – Passwords are often hacked using a brute force attack – where hackers use a dictionary with thousands of combinations of words to guess a password. To minimize this risk, make sure all employees are trained on how to make proper passwords (uppercase, lowercase, symbols, numbers. Additionally, they should reset every few weeks.
- Email links – Educate employees on never clicking links or attachments (without confirming the attachment was sent intentionally). In short, if they aren’t expecting an attachment or link, question it!
- Social engineering – Sometimes the easiest way to get access to confidential information is through your own employees.
According to an article in AdWeek, “Social engineering attacks continue to rise, making people a weak link in the security chain. One Eastern European syndicate managed to scam $1 billion over two years from 100 different banks through the use of spear-phishing attacks on bank employees.”
Are You Protected?
It’s critical that you start working on your cyber security strategy today – and not wait until after an attack, which could take thousands (or even millions) of dollars to recover from. With the proper training and the right tools, like SentinelOne, employees can take ownership of your company’s cyber security and minimize the risk.
