Cybersecurity is obviously crucial all year round, but October is Cybersecurity Awareness Month, so it's a great time to remind businesses about the dangers and the precautions that should be taken. If you need a refresher, keep the following seven tips in mind.
1. Use Strong Passwords
It's important to make sure you and your employees are using strong passwords for all of your accounts. Don't reuse passwords because hackers expect you to do so, and if they get one password, they will try it on other services and accounts. Require all employees to use strong passwords that have a mix of letters (upper and lower case), numbers, and symbols.
It's also a good idea to implement multifactor authentication wherever possible and avoid password sharing. Each employee should have their own login credentials. Encourage the use of password managers to generate and securely store passwords.
2. Keep Software and Systems Updated
Make sure you keep all of your software and systems up to date, as outdated versions are often vulnerable to security exploits. Security software products are frequently updated with new patches, but you have to make sure you're installing those updates for them to be effective. Don't only focus on security software. If there are new versions of other software products your business uses, including operating systems, make sure you have the latest updates. Keep an inventory of all devices and software in use and schedule regular reviews to make sure each one is up to date.
3. Use a Firewall
Firewalls have long been one of the most effective lines of defense against cyberattacks. While they are only one tool in the toolbox, they are still important.
"A firewall is a set of related programs that prevent outsiders from accessing data on a private network," explains the FCC.* "Make sure the operating system's firewall is enabled or install free firewall software available online. If employees work from home, ensure that their home system(s) are protected by a firewall."
4. Control Access to Sensitive Data
Make sure that you are in control over how to access sensitive data to prevent it from slipping into the wrong hands. Even a well-meaning employee might leave data vulnerable. Your whole team likely doesn't need access to every file or system your business uses. Limit access based on job roles to reduce the risk of accidental exposure as well as potential nefarious use.
When access is restricted, it also makes it easier to identify the source of the problem when something goes wrong. Only grant employees the access they need to do their work. Use role-based permissions to manage access, and require unique logins so you're able to trace activities. If an employee leaves the
company, revoke access right away.
5. Embrace Security Culture
Make security part of your overall company culture. Everyone on your team needs to be on the same page and understand the importance of proper protocols.
"Make it a point to talk about cybersecurity to direct reports and to the entire organization," says the Cybersecurity and Infrastructure Security Agency (part of the U.S. Department of Homeland Security).** "If you have regular email communications to staff, include updates on security program initiatives. When you set quarterly goals with your leadership team, include meaningful security objectives that are aligned with business goals. Security must be an 'everyday' activity, not an occasional one. For example, set goals to improve the security of your data and accounts through the adoption of multifactor authentication (MFA), the percentage of systems you have fully patched, and the percentage of systems that you back up."
6. Keep Data Backed Up
Keep all of your business data backed up in case of emergency. That goes for customer information, financial records, operational files, and anything else important. If you lose access, your business can face big problems, especially in the event of a ransomware attack, but also against hardware failures or even human error.
Schedule automatic data backups, and store backups in multiple locations, including on- and off-site and in the cloud. Test your backups to make sure they can easily be restored, and encrypt them to be sure those are protected, as well.
7. Have a Response Plan
Even if you are careful with your security practices, you should have a response plan just in case you fall victim to fraud or a data breach. If something happens, how quickly and effectively will your business be able to respond? How easy will it be to maintain operations?
Know what steps you and your employees need to take when a breach is suspected. Assign responsibilities, such as who needs to contact IT support,
customers, legal authorities, etc. Keep any emergency contacts and cybersecurity vendor information easily accessible, and review/test your plan each year to make sure it accounts for newer threats, as the security landscape is constantly changing.
During October, make it a point for your business to keep cybersecurity top of mind. It's a good time to review your practices and make sure you are prepared to deal with threats.
* https://www.fcc.gov/communications-business-opportunities/cybersecurity-small-businesses
