3 Reasons Why SMBs Need to Care About Their Security, and 6 No/Low Cost Ways to Mitigate Risk
Courtesy of www.journyx.com
Businesses, no matter what size, can come to a halt because of a security breach. Email could fail, and people could no longer communicate; servers could go down, and important data could be lost. These are problems that could affect anyone business, however, small to medium sized businesses (SMBs) are becoming a growing target because of the perception that they are less secure, and less aware of security issues in comparison to larger companies.
Most Small businesses don’t realize this, but hackers are breaking into your systems and installing malicious software that would make your company a stepping stone to hacking another company.
What’s worse is that when cyber forensic investigators piece together what happened to their system, it’ll be your company initially launched the attack on the system and not the hacker’s PC. Days later, Law enforcement will come visit you and most likely take your servers for analyses.
It is important that SMB owners prove hackers wrong by starting to care about their security!
3 Reasons Why SMB Owners Should Care:
1. You will feel a much stronger impact of a breach because a limited or non-existent budget for IT staff and services. There is often no room left in the budget for IT security because it seems like preparing for a snow storm in the desert; however, a single breach can become a massive expense for a company, and there are plenty of no/low cost methods to better increase its security.
2. Even low risk vulnerabilities can be leveraged to gain access into a company network, so be aware of all possible break-points. Even if all of the digital databases are locked tight, social engineering––which many managers don’t even consider––could be what causes the breach. Back in April,I wrote an article called “The USB Keys in the Urinal” about how during a security audit I broke into a company’s network by leaving a set of USB keys in the company’s office mens’ washroom. Their cyber networks were impenetrable, so I had to find another way in.
3. You don’t know what attackers might be looking for. You may be thinking, “why would anyone want to attack my business? I don’t have anything that valuable.” Your most valuable asset, however, maybe be something as simple as your high speed internet connection. John Sawyer, a Senior Security Analyst at InGuardians, says that such connections act “as new launch points for brute-force SSH scans and Denial of Service (DDoS) attacks.” Attackers may be seeking customer credit card information, or sensitive employee files. You cannot be sure what they will search through, so you need to be ready for all possibilities.
6 No/Low Cost Ways to Improve the State of Your SMB’s Security
1. We agree with Debra Donston Miller, a contributing writer at Security Dark Reading, that your first job should be to set priorities based on what is most important to your company. Each business is different, and so this duty entails outlining a reasonable budget, and evaluating what are your company’s security needs. Are your customers’ credit card numbers safe? Could someone deface your e-commerce storefront? What would happen if your servers crashed? This is the time to address any and all questions. I’ll list a few more assessment question at the end of this article.
2. Update technical policies so that they include licensing anti-malware and anti-virus software, and keeping them up-to-date. This is an easy way to decrease your risk for many attacks.
3. Do not allow users to run as administrators on their devices (as recommended by John Sawyer). This could be a difficult conversation to have because it requires playing a babysitter role. Even though the device belongs to the user, there are still too many dangers that could present themselves from browsing the Internet.
4. Educate all employees from all departments on IT security and your company’s policies. People are commonly unaware of how to best protect their data, and so giving instructions policies will allow everyone to be on the same page. In a white paper written by GFI Software, they suggest that you may want to implement policies such as an Acceptable Use or Remote Access Policy, so that employees cannot access risky material.
5. Ensure that all workstations, hard drives, and removable disks/drives are locked down and encrypted. This is done in case of theft or a local boot attack.
6. Regularly performing network and vulnerability assessments of internal and external networks can help you best protect yourself from as many scenarios as possible. You can bring in someone like us, from Digital Locksmiths, to speak with authority, give input on your situation by leveraging one of our services like SPEC Cyber Intelligence and Monitoring capability, and ensure that your data is locked down.
You may think that your SMB is safe, but can you really be sure?
Ask and write down the answers to these assessment questions.
- How easy would it be for someone to steal our corporate information?
- How easy would it be for someone to crash our network?
- What vulnerabilities exist at our internet connection?
- What is the likelihood that we will be hacked by someone?
- What damage can they do?
- What could one of our employees do with unauthorized privileges?
- How easy is it to circumvent access controls?
- Is it easier for insiders than outsiders to come in from the internet?
- How should we spend on our IT security program?
- Who is responsible for protecting our IT and informational resources?
What is the risk?
Risk is measured on how much you have to lose! How about this! Ask yourselves these questions now
- What can go wrong?
- If it did happen, how bad can it be?
- How often might it happen?
- How sure are you of the first 3 questions?
- What can be done to remove, mitigate or transfer risk?
- How much will it cost?
- How efficient is it?
About the author
Terry Cutler is a co-founder of Digital Locksmiths, an IT security and data defense firm based in Montreal and serves as the company’s Chief Technology Officer and Certified Ethical Hacker. Prior to joining Digital Locksmiths, he was a Premium Support Engineer for Novell in Canada where he analyzed network vulnerabilities and transitioned security technologies into production. In addition to being a licensed private investigator in Canada, Terry is an internationally known author, trainer, speaker, and security consultant, Terry has appeared in numerous national television and radio programs and is very active on the conference circuit. Follow Terry on Twitter at @TerryPCutler and connect with him on LinkedIn
Terry Cutler
Connect with Terry on Google +
Latest posts by Terry Cutler (see all)
- Monitor, not surveillance, more important role of adults in kids’ online lives, says study. - January 24, 2015
- Terrasse-Vaudreuil’s website one of many hacked - January 24, 2015
- Crossing the “online” into cyber bullying - December 31, 2014
