Blog Written by Diana Giles, Skyline IT Management
Cybersecurity can be extremely complicated, but most security incidents could have been prevented by very simple actions. The problem is that most of them aren’t done for a variety of reasons. The most common reason, however, is that no one thinks their business will become a victim. How many businesses that have been hit by a ransomware attack have said something like, “No one is going to target us, were too small” before their business was brought to its knees? Most of the cyberattacks we see in the news are news because big businesses were hit. Cyber incidents at smaller business don’t make the news, but that doesn’t mean they don’t happen every single day.
Here are some essential recommendations from an IT service provider that will go a long way toward protecting your business.
Establish and Enforce Policies
These policies do not need to be elaborate or complicated, but they need to be communicated clearly with your staff along with the expectation that everyone will follow them. Here are just a few of the things you will want to address in policies: Accepted Use, Passwords, Confidentiality, Personal devices, Internet usage, Email usage.
Stop Bad Things from Running
One note first, the term “anti-virus” has been replaced these days by “endpoint detection and response”. Computers should have business-class endpoint protection to detect, stop threats. Ideally, it should provide a way to isolate the endpoint from the network and revert encrypted data back in the event of a ransomware attack.
Patch and Update Devices
A good number of the security incidents you read about in the news were a result of known vulnerabilities being exploited because a device’s operating system or app was not patched or kept up to date. In many cases a current update or patch would have prevented the attack. Computers are not the only devices that need to be kept up to date. Don’t forget network equipment, printers and those little computers we all have in our hands.
Proper Access Controls
Very simply put, you want to make sure that only those who should have access to a digital asset do. Today, much of our access is controlled by logging into an account. Therefore, good password hygiene and multi-factor authentication (MFA) are a must. Unless there is no choice, do not settle for texting or email MFA, but rather use an authenticator app such as Authy or Microsoft Authenticator. Put processes in place to add or remove access from accounts as employees come and go or change positions within the company. Regularly review who is allowed to access specific data and accounts.
Protect Email
90% of cyberattacks involve email at some point of the attack. It is an open door to bad actors and needs to be protected. Business email services need phishing and malware protection either built-in or as an add-on service.
Backup, Backup, Backup
Deploy an appropriate backup strategy based on your requirements for Recovery Point Objective (RPO) and Recovery Time Objective (RTO). These terms refer to being able to get your important business data back at the point in time you need and as fast as you need to continue business. RPO/RTO vary by the type of business. Will you suffer extreme business loss if you can’t get your data back to how it was an hour ago or is it ok if you get it back at the point it was yesterday morning? The same for how long it takes to get everything back. Some businesses can continue to function if they can get a few things back right away and could wait a day or so to get the rest back.
Police Digital Traffic
Another pretty basic, but very important weapon in the cyber security arsenal is managing what places on the internet company devices are allowed to go. More technical terms for this are DNS filtering or web content filtering. Keep in mind that this filtering is both about blocking sites that people are choosing to go to, but also about blocking a rogue link or email from directing the computer to a malicious location. At the most basic level it can be done for free by changing some settings, but there are customizable services that provide more flexibility, control and even reporting.
Create Superheroes
Company employees are without a doubt the most important part of your business’s cyber security strategy. Much like putting alarms and locks all over a house, IT professionals can deploy state of the art security, but if an employee “opens the door” in response to a phishing attempt or social engineering tactics, it can be a very bad day. Regularly train and educate staff so that having a cyber secure mindset becomes just another part of doing business.
Education
A couple of people I know personally have written some books to educate non-technical people about how to protect their businesses and families. The first is Cybersecurity for Main Street: Cyber Fit in 21 Days by Ann Westerheim, PhD. It is an easy to digest book that provides practical steps without overwhelming the reader with techy jargon. Ann is the owner of an IT service provider in Boston, MA. The second book is The Secret to Cybersecurity: A Simple Plan To Protect Your Family and Business From Cybercrime by Scott E. Augenbaum. Scott is a retired FBI agent who worked in the cybercrime division. He has now made it his life’s work to educate people, to try to prevent more victims like he has seen in so many devastating situations. His book begins with stories from his FBI days and then goes into the truths about cybercrime and how to avoid being a victim of it.
Conclusion
For the non-technical person, even this short list of tips might seem overwhelming. Don’t let perfect be the enemy of good, here. Pick one area to work on in the next month or so and then move on to the next one. Each one that is addressed will improve your business’ cyber security.

Blog Written by Diana Giles, Skyline IT Management