Cyber Security Best Practices from Flosum for SMEs

It is easy for small business owners to think that the cybercriminals will ignore your online assets will pass over attacking your company. This secured feeling is not, in fact, justifiable in case of cybersecurity and fully out of sync with the security best practices for businesses of any size. Contrary to this common belief, a U.S. Congressional Small Business Committee study found that about 71% of the cyber-attacks are happening to those small to medium businesses with employee count less than 100. Another alarming fact, too, found in the same stud is that about 50% of the SMBs had a minor or major security breach within the last year.

But what is the reason why attackers are focusing on small businesses? The objective of almost all cyber-attacks is to steal sensitive personal data. While the larger enterprises typically have a bigger volume of data to steal within a very secured network, small businesses tend to have a less secure network. This makes it easier for hackers to access the same with minimal effort. With the use of their automated malware, they can attack thousands of small businesses with vulnerabilities.

The study had shown that it is mostly a lack of resources, time, and budget to maintain proper security is the major reason why there is a high rate of cyberattacks happening on the SMBs. Some other reasons for the same are lack of an IT security specialist on board, being unaware of the potential risks, lack of employee/user training, not having a security policy in place, outsourcing the security aspects, and ultimate failure in securing the endpoints.

So, how can small businesses avoid being susceptible to these cyberattacks? Let us discuss some key security best practices for SMEs to implement to strengthen their cybersecurity.

Security best practices for SMEs

Always use a firewall

The first line of defense in the case of cybersecurity is having a strong firewall in place. Federal Communications Commission’s recommendation for SMBs is to set up an established firewall to ensure a barrier between sensitive enterprise data and cybercriminals. In addition to the external firewall, many such companies also tend to install internal firewalls to have an additional layer of protection. It is also important to mandate the employees working from different locations and from home to install a firewall at their home network to ensure security. Offer a firewall software, training, and support to them to ensure foolproof security compliance.

Have a solid, documented cybersecurity policy in place

Most of the small businesses operate by verbal policies and the intuitional knowledge they have gained, but this is not enough in cybersecurity. It is one area where you need to document the protocols and ensure strict adherence to the same. You can find a reference at the Small Business Administration Cybersecurity portal, which offers some protocols, checklists, online training, and relevant information specific to cybersecurity for businesses. The FCC also offers a Cyberplanner, which can be your starting point for cybersecurity documentation. You may also participate in the Cyber Security programs like the C3 Voluntary Program, where you can get some detailed toolkits and insights on cybersecurity latest practices and policies.

Cover the mobile devices too

Almost all enterprises now offer BYOD for their employees. Almost all enterprise applications have seamless integration abilities with smartphones and other gadgets used by the stakeholders and partners, etc. As pointed out by FLOSUM experts, the companies need to have a security policy related to BYOD and other connected devices, too, as an important security precaution.

As there is increasing use of smartphones and wearables for communication and data sharing, it is possible to pose a cybersecurity threat. Norton Antivirus by Symantec has recommended that small businesses set up automated security updates for BYOD employees. The company’s password policy also needed to be extended to mobile devices, which access the company network.

Educate the employees and users

In an SBM enterprise, the employees need to wear many hats based on situational needs. So, it is important that all employees who access the network and being part of the technology infrastructure need to be trained on safe usage of the infrastructure and cybersecurity best practices. Security policy is something that they have to go through and be thorough with at the first point before starting their work at the company.

As the security threats and related policies are evolving day by day, it is also important to make cybersecurity training an ongoing practice in organizations. As cybercriminals become savvier, it is important that the users also get regular updates on the latest security protocols. Take all measures to hold the employees accountable and get a document signed by employees stating that they are informed and well versed with all the policies and agree to stick to the instructions without fail.

Enforce and ensure safe passwords practice

A regular user finds changing passwords frequently a painful affair. But the Verizon 2016 Data Breach Investigations reports show that about 63% of the data breaches happen due to weak, stolen, or old passwords. Another report also shows that about 65% of the SMBs do not follow such a strict password policy or do not enforce it with care. In today’s world, with seamless technical integrations, it is so critical that all employee devices and accounts accessing a company network should be password protected.

The expert advice on password security is that the employees need to follow an untraceable password-making practice by preparing passwords with a combination of upper- & lower-case letters, symbols, and numbers. The advice is that the SMBs should make it a policy to change passwords every 50 days to 90 days.

Along with the above cybersecurity measures, it is important to back up the data regularly, have a proper restoration plan in place, install the best anti-malware software, and for transactions always use multifactor authentications. Remember that security is a moving target, and the cybercriminals are always a step ahead.