So what do you do to stay protected anyway?
Step 1: Defining the business needs and understanding the risks
The first step is to understand the nature of the business's activity and the types of risks the business faces or may face. We should ask the following questions:
- What types of data does your business keep? For example: customer details, legal documents, business plans, medical information, or intellectual property.
- Is there sensitive information that requires a higher level of security, such as credit-card data, ID numbers or passwords?
- Which internal systems and which organizational networks communicate with the outside world while staying in contact with external parties (suppliers, customers, service systems)?
Understanding these weak points will help define the types of protection your business needs, so you can choose security solutions tailored to its unique business activity.
Step 2: Matching the types of information-security solutions
After identifying the needs and understanding the potential risks, check which information-security solutions already exist in the business, and assess what is missing and what would be right for improving the protection of the business. Here is a review of a few systems you can use to improve and streamline the protection of a business environment:
Firewall:
A firewall is the first line of defense between your business's network and communication from the outside world. It acts as a filter for data traffic, and prevents unauthorized access to the business network. Advanced firewalls can detect attacks, monitor suspicious traffic and block traffic from malicious sources. For small businesses it is recommended to use managed firewalls (managed by companies specializing in the field), so you can rest assured the systems are actually configured to block threats, and know the systems receive ongoing updates as well as an immediate response to potential or concrete threats. Many times we have found businesses where tools were in place - such as a firewall containing IDS and IPS systems (intrusion detection and prevention systems) - but these were disabled: either because whoever installed the systems never bothered to enable them, or because the subscription for receiving their updates had expired.
Antivirus and anti-malware:
Antivirus software protects the computers and the business network against viruses, but also against spyware and other malicious software that may be trying to run on the workstations. Small businesses must be sure the protection software updates automatically, and also verify there are tools for monitoring and central management of all the devices - so that even if a concern or suspicion of a break-in or attack attempt comes up, whoever is entrusted with securing the computing environment receives a notification and acts to verify the threat has been removed.
Data encryption (by the "good guys" ):
Following exactly the same logic as the data encryption attackers use to demand ransom from those they attacked, that same encryption of information can serve the business to protect its data - ensuring that only authorized parties can access the business's sensitive information. Using data encryption, the information can be protected and kept safe wherever it resides and is stored - inside the organization or in the cloud, but also while the information travels across the business's communication networks. Small businesses are advised to encrypt sensitive data such as customer details or passwords, important files or other sensitive business information.
Backup - preferably in the cloud, and if in the cloud, preferably managed:
Backing up data securely in the cloud provides another layer of protection for the organization, and can help recover from cases where the business is breached, from a physical failure in the IT systems, or from a ransomware attack on the business. Cloud backup allows fast restoration of the information and prevents the loss of important data. It is very important to make sure that whoever is entrusted with running the backup knows what they are doing (because it is not enough to verify that the backup runs automatically): you must ensure the ability to restore at any given moment, verify the information is available on fast cloud storage, and make sure the backup systems know how to operate in a way that prevents attackers from deleting the backup as part of the attack process...
Step 3: Working with a managed IT services provider (MSP)
Not every small business has the resources needed to manage information-security systems on its own, so choosing a managed service from a Managed Service Provider (MSP) that operates dedicated teams and systems for this purpose can significantly ease the handling of the business's information security - and of IT in general. Such a support company can provide ongoing protection, perform continuous, professional monitoring and verify that security updates are applied at all times - routine or manual, critical and less critical, and not only for the operating system but for every failure-prone component of the environment. And of course, a company that can respond quickly to a suspected breach or attack, and can also provide answers to problems created by malfunctions or by human error.
When choosing a managed IT services provider, make sure the provider offers and includes the following services:
- Continuous monitoring of the network and everything connected to it
- Real-time fault detection and notifications when anomalies are discovered.
- Automatic updates for security systems, including for the firewall, the antivirus tools and other protection software.
- Secure cloud backups as a business solution - one that can back up open files, encrypt the information on its way to the cloud and, just as important, is available for fast data restoration.
- Advice and guidance in cases of breaches or attempted attacks.
Further readingAssisted-Living Network: Readiness, Security Cameras and Access ControlOne switch was reset and the guard station phone, about 12 cameras, the door controllers and both wireless networks went with it. How the network was rebuilt, and what to have in place first.→
Step 4: Training the employees
The limited knowledge and experience of the people employed in the business, in matters of information security and of conducting themselves correctly under a safe organizational policy, are among the biggest risk factors for a small business - even if the business employs a small number of people. Proper training of employees on information security and correct handling of business information - teaching employees to recognize spam, phishing attempts or other attacks, to create strong passwords and replace them on time, and building awareness of security updates - can significantly reduce the risk of break-ins, or the success of attempts to break into the business. It is recommended to hold information-security awareness workshops for employees, set a conduct policy, and make sure the information-security policy is understood by all employees and properly applied as well.
In summary: business information security matters - for small businesses too, and perhaps especially for them
Small businesses become attractive targets for attackers precisely because in small businesses the security measures are limited, and the business owners do not always keep the computers updated or act with awareness of the dangers. Implementing comprehensive information-security solutions, like the ones we covered here - a firewall, antivirus, encryption and secure backup - along with strong backing from a managed IT services provider, can deliver a high level of protection for the business's computing systems, and prevent data loss or harm to business operations.
Do not neglect your business's security - the right investment in managed information-security services will help you run a business with safe, stable computing systems over time.
