Cybersecurity 101 for Small Business Owners

Every business faces exposure to digital threats in the modern economy. Large corporations spend millions of dollars annually on cybersecurity technologies and experts to keep them safe. Small businesses, by contrast, must safeguard their data and systems with far fewer resources. If you're a small business owner, it pays to understand some basic cybersecurity tenets to inform those efforts. With that in mind, here's how to identify and address your business's cybersecurity vulnerabilities. We'll also include some basic cybersecurity tips for small businesses to use for an instant defensive upgrade. On their own, they'll go a long way toward keeping your company safe from digital harm.

Begin With a Cybersecurity Risk Assessment

Unfortunately, no one-size-fits-all approach to cybersecurity will work for every business. That means you'll need to gather specific information about your company's digital risks to determine how to proceed. To perform a cybersecurity risk assessment, you must complete the following steps:

Create an IT Asset Inventory

Make a detailed list of every IT asset your business owns. Include networking equipment, computers, tablets, smartphones, and other hardware. Note each device's operating system version and software update status. Include a list of the 3rd-party software on each device. You should also note any existing endpoint security or antivirus software running on each device.

List Potential Vulnerabilities

With your asset inventory in hand, list any potential digital vulnerabilities. These may include the following:

• Outdated software or operating systems
• Weak passwords
• Unused user accounts
• Unnecessary software
• Unencrypted stored data

Determine Each Vulnerability's Potential Impact

Finally, you should evaluate each identified vulnerability to gauge its potential impact if exploited. It's helpful to use a numerical scale to rate the seriousness of each problem. Rank any serious threat as a five. For example, if you found a computer with unencrypted customer or proprietary data, it's a five. A data breach involving that sensitive information could be an existential threat to your business. A good example of a less serious threat is a fully updated but disused software package on an employee device. That would likely rate a one on the vulnerability impact scale.

Create and Execute a Short-Term Threat Mitigation Plan

Next, using your vulnerability impact scores as a guide, develop a mitigation plan to reduce your business's risk in the short term. At this stage, your goal is only to fix the most egregious and serious vulnerabilities to keep cyber criminals from easily accessing your data. For example, if you've found a company laptop with multiple vulnerabilities, don't waste time trying to fix them all. Instead, disconnect it from the internet, turn it off, and lock it in a drawer. You can revisit it later once you've solved vulnerabilities that demand more immediate solutions. Once you have an action plan that addresses every vulnerability you identified, execute it.

Deploy Appropriate Basic Security Measures

Once you've dealt with your business's most glaring cybersecurity deficiencies, you can move on to structural cybersecurity improvements. To do it, you must apply some basic security measures. Here are some basic cybersecurity tips for small businesses that cover what to do.

Install a Hardware Firewall

If you don't already have one, install a hardware firewall to protect your small business network. A firewall acts as a gatekeeper, applying preset rules to control traffic entering and leaving your network. Major manufacturers like Fortinet, Cisco, Ubiquiti, and SonicWall all make small business-oriented firewall models. Hiring a cybersecurity specialist will help you configure your chosen firewall model if you don't have an in-house IT staff.

Secure Your Business Wi-Fi Network

Next, you should secure your Wi-Fi networks using the latest wireless security method: Wi-Fi Protected Access 3 (WPA3). This method includes strong passwords and the latest encryption to protect your wireless traffic. If your wireless router or access point doesn't support the standard, upgrade to a newer model. Older versions of the WPA standard have security vulnerabilities that may allow a successful cyber attack.

Define Password Standards and Use MFA

The passwords protecting your small business's network, devices, and data are their primary defense against access by unauthorized individuals. They can also be vulnerable if you don't enforce proper password standards. The latest password security guidelines may contradict your knowledge of password best practices. Your password policy should insist on the following:

• Passwords must be at least 12-16 characters long
• Passwords should include numerous special characters
• No password hints
• Passwords never expire unless compromised

Additionally, it's wise to encourage employees to use encrypted password managers. They enable secure password use by eliminating the need for memorization. You should also use multi-factor authentication (MFA) whenever possible. If your business relies on software that doesn't support that, consider choosing a single sign-on (SSO) solution that does.

Practice User Account Hygiene

Over time, losing track of user access credentials is easy as employees come and go. That can create opportunities for hackers to gain surreptitious access to your company's data. To prevent that, adhere to the following basic user account hygiene steps.

• Insist that every employee has a separate user account (no account sharing)
• Password protects every user account (no blank passwords allowed)
• Grant minimal access to each account (principle of least privilege)
• Review access rights at least every month
• Delete user accounts within one month of employee departure

Use Only Well-Supported Software

As a small business owner, you should understand some of the limitations your company size imposes. Smaller software developers often have the same kinds of limitations. That can lead to some software you may depend on going unacceptably long between feature and security updates. Therefore, ensuring your business uses well-supported software from long-established developers is a good idea. That especially includes software containing critical business data.

First, you shouldn't take chances with your business's financial data. So, consider an upgrade if you're using an ad-hoc accounting method or a niche accounting software package. You can consult our handy list of small business bookkeeping software to find a solution that fits your operation. Of the options covered, QuickBooks, FreshBooks, and Wave are among the most actively supported.

A great roundup of small business software is available at TechRadar for your business's other software needs. You should also take liberal advantage of software-as-a-service (SaaS) options. They're cloud-hosted and can help minimize how much data you must secure within your business network.

Employ Encryption Wherever Possible

No matter what you do, you can never eliminate the possibility of data loss. For example, if you leave your business laptop in a hotel or drop your phone on the way to work, the data contained is instantly at risk. For that reason, you should employ data encryption everywhere.

You can use Microsoft's built-in BitLocker encryption if your business is primarily PC-based. It ensures that only a fully-authenticated user can access the data on a given PC. You can also encrypt iOS and Android devices in the same way.

Another way to use encryption to protect your business data is by using a VPN for secure access to your network. Many of the firewall products discussed above include built-in VPN functionality.

Install an Endpoint Security Solution

Straight-up data theft isn't the only digital threat your small business faces. It's also at risk from malicious software, viruses, and ransomware. Combatting those requires the use of a high-performance endpoint security product. Endpoint security software typically offers antivirus, anti-malware, and device management features in a single interface. They're the easiest way to keep every one of your business devices compliant with your cybersecurity policies. For example, F-Secure Elements works on all major operating systems, including Android and iOS. It even includes patch management, so you can remotely manage software updates network-wide.

Backup Your Business Data

As a last line of defense, you must also back up all your critical business data. The best way to do so is with a layered backup strategy. You can begin by backing up critical data on encrypted portable hard drives. That gives you a quick recovery option in case of a hardware failure or cybersecurity incident.

You should also use a cloud-based backup solution so you'll have disaster recovery options. You may lose your disk backups and original data in a fire or other disaster. A cloud-based backup keeps a copy off-premises to protect against that. However, large-scale recovery from a cloud backup can take time, so you shouldn't depend on one as your business's only backup option.

Small Business Cybersecurity, Done Right

While handling your small business's cybersecurity alone may seem daunting, it's likely not as complicated as you once thought. Most of the things you'll need are common-sense solutions that aren't difficult to implement. By following the foregoing basic cybersecurity tips for small businesses, your business will immediately improve its security posture. That alone can be a worthwhile deterrent. After all, a hacker isn't going to waste their time on your business if there's another target with weaker security. Of course, having a professional cybersecurity firm review your new security measures is never a bad idea. And when you finish addressing your small business's cybersecurity, you can move on to more profitable endeavors. When ready, check out our DIY SEO guide to give your small business website a client-attracting makeover!