{"id":541,"date":"2019-11-08T16:51:10","date_gmt":"2019-11-08T16:51:10","guid":{"rendered":"https:\/\/sectigostore.com\/blog\/?p=541"},"modified":"2024-07-11T20:04:14","modified_gmt":"2024-07-11T20:04:14","slug":"top-25-recommendations-for-small-business-cyber-security","status":"publish","type":"post","link":"https:\/\/sectigostore.com\/blog\/top-25-recommendations-for-small-business-cyber-security\/","title":{"rendered":"Top 25 Recommendations for Small Business Cyber Security"},"content":{"rendered":"\n

When it comes to small business cyber security (and a whole bunch of other things), you’re only as strong as your weakest link! You can rest assured (or maybe not) knowing that hackers will find a way to breach your network’s security via the route that offers the least resistance. Not to freak you out, but if you’re still using your grandmother’s maiden name as your password, it should come as no surprise that a hacker could guess it. <\/p>\n\n\n\n

Security professionals have urged netizens about using strong passwords and issued warnings against phishing attacks so many times it’s almost a clich\u00e9!<\/p>\n\n\n\n

\"Graphic:
Figure 1: Top 7 focus areas for small business cyber security.<\/figcaption><\/figure><\/div>\n\n\n\n

Even for small businesses, SMB cybersecurity should be a priority, at least if we\u2019re to believe the statistics. Score<\/a> reports that 43% of cyber attacks<\/a> target SMBs. According to another report by Juniper Research<\/a>, SMBs account for only 13% of the overall cyber security market in terms of expenses on security products. Security analysts predict that data breaches will triple each year over the next five years with an average annual increase of 9% in terms of budget allocation for cyber security. <\/p>\n\n\n\n

There\u2019s a general apathy towards cybercrime and a false\nbelief that if you\u2019re an SMB, you can fly under the radar of cybercriminals. Of\ncourse, this thought is a lie we choose to believe \u2014 according to SiteLock<\/a>,\na website is exposed to cyber attacks more than 50 times a day on average. Therefore,\nit comes as no surprise that SMBs, especially the ones without a security\nstrategy in place, are desirable targets for cybercriminals. <\/p>\n\n\n\n

Before discussing cyber security solutions for small businesses, let\u2019s\nlook at some of the biggest security threats they face: <\/p>\n\n\n\n

  1. Ransomware Attacks<\/li>
  2. Phishing Attacks<\/li>
  3. Privilege Escalation Attacks<\/li>
  4. Fraudulent Apps<\/li>
  5. Weak Passwords<\/li>
  6. DDoS Attacks<\/li>
  7. Social Engineering Attacks<\/li><\/ol>\n\n\n\n

    We have prepared a list of recommendations, keeping in mind\nsmall business cyber security needs which will help you accomplish your\nsecurity goals.<\/p>\n\n\n\n

    Small\nBusiness Cyber Security Solutions<\/strong><\/h2>\n\n\n\n

    If you\u2019re an SMB and cybersecurity is near the top of your\nlist of priorities, read on to find out how to limit exposure to your sensitive\ndata and secure your network.<\/p>\n\n\n\n

    1.  \n<\/strong>Conduct Cyber\nAwareness Training for Employees<\/strong><\/h3>\n\n\n\n

    Small business cyber security efforts need to be the\nresponsibility of every employee within your organization. More often than not,\nhumans are the weakest links \u2014 especially when it comes to social engineering\nattacks. With regular repeated training on best practices and security pitfalls\nto avoid, employees will gain the knowledge they need to develop a\nsecurity-conscious mindset. <\/p>\n\n\n\n

    2.  \n<\/strong>Streamline\nYour Patch Management Process<\/strong><\/h3>\n\n\n\n

    Cybercriminals are aware that not all companies immediately\ninstall updates to prevent a new attack. That\u2019s why it\u2019s vital to keep your\nsystems up to date. Update your software (including your OS) regularly on all\nthe devices and turn on automatic updates where you can. This includes updating\nand patching your website software and plugins as well.  <\/p>\n\n\n\n

    3.  \n<\/strong>Back Up Your\nCritical Business Data<\/strong><\/h3>\n\n\n\n

    One of the most foolproof ways to prepare your defenses\nagainst ransomware attacks is to have data redundancy. If your data is taken as\nhostage, having multiple backups off-site or on-premises helps to minimize the\nimpact on your business and operations. <\/p>\n\n\n\n

    \"Graphic:
    Figure 2: Backup options.<\/figcaption><\/figure><\/div>\n\n\n\n

    4.  \n<\/strong>Use Firewalls,\nWAFs, IDS, IPS or a Unified Threat Management System<\/strong><\/h3>\n\n\n\n

    Depending on your network design and architecture, it\u2019s\nessential to have some form of traffic monitoring and filtering tool set up as\npart of your small business cyber security defense measures. This helps you to\nassess the traffic flowing to and from your trusted internal network and the\noutside internet. <\/p>\n\n\n\n

    5.  \n<\/strong>Secure Remote\nAccess to Prevent Unauthorized Use<\/strong><\/h3>\n\n\n\n

    Apart from using firewalls and reviewing server logs for\nmalicious activities, ensure that unauthorized users can\u2019t access your machines\nremotely. Restrict functionalities based on access control lists, use a virtual\nprivate network (VPN) for encrypted communication, and implement multi-factor\nauthentication (MFA) to prevent unauthorized access to the business network.<\/p>\n\n\n\n

    6.  \n<\/strong>Run\nRegular Antivirus and Anti-Malware Scans<\/strong><\/h3>\n\n\n\n

    Invest in a reputed antivirus product. It\u2019s critical to have\nthe latest version installed on all devices on the network and to run daily\nscans. You can also use free open source tools like ClamAV<\/a> if you\u2019re comfortable with using\na command-line interface.<\/p>\n\n\n\n

    \"Graphic:
    Figure 3: Features to consider before selecting an antivirus.<\/figcaption><\/figure><\/div>\n\n\n\n

    As far as website security goes, investing in an integrated\nsolution like CodeGuard<\/a> that scans for\nmalwares, performs automatic updates, creates backups, etc. could prove to be\nuseful.<\/p>\n\n\n\n

    7.  \n<\/strong>Invest in\nan Anti-Ransomware Software<\/strong><\/h3>\n\n\n\n

    According to reports from Beazley Breach Response (BBR)\nServices, 71% of the ransomware attacks in 2018 were targeted at small\nbusinesses. Remote Desktop Protocol (RDP) was used as one of the most common\nattack vectors, which is why it is vital to lock\nit down<\/a>. Using anti-ransomware, creating and storing backups at multiple\nlocations, and using good judgment to avoid falling prey to social engineering\nattacks are some of the countermeasures that can be implemented. <\/p>\n\n\n\n

    Avast\nFree Ransomware Decryption Tools<\/a> and Trend\nMicro Ransomware File Decryptor<\/a> are some of the free alternatives in the\nmarket. You can also check out the decryption keys repository at nomoreransom.org<\/a>.<\/p>\n\n\n\n

    8.  \n<\/strong>Use VPN<\/strong>\nWhen Connecting to Your Business Network<\/strong><\/h3>\n\n\n\n

    Enforce the use of VPN when third-party vendors or employees\nneed to connect to your business network remotely. It\u2019s inherently unsafe to\nconnect to the internet via untrusted connections such as public Wi-Fi due to\neavesdropping, man-in-the-middle attacks, and \u201cevil twin\u201d phishing attacks. But\nif you must use public Wi-Fi, then be sure to use a VPN so an attacker on the\nnetwork can\u2019t sniff your traffic.<\/p>\n\n\n\n

    9.  \n<\/strong>Use Email Filtering to Block Malicious Files <\/strong><\/strong><\/h3>\n\n\n\n

    Consider blocking the filetypes you would never require as a\nbusiness. Block any attachment with executable content to prevent accidental\nexecution of malicious scripts on your devices. Here is a list of file types to\nconsider blocking or quarantining:<\/p>\n\n\n\n

    \"\"
    Figure 4: File types to block or quarantine.<\/figcaption><\/figure><\/div>\n\n\n\n

    10.  \n<\/strong>Use Web Filtering\nTools to Prevent Ads from Executing <\/strong><\/h3>\n\n\n\n

    Block web pages or parts of it that contains scripts,\nadvertisements, viruses, etc. You can do this through the use of Websense Web\nFilter solutions or OpenDNS.<\/p>\n\n\n\n

    11.  \n<\/strong>Use DNS\nFiltering to Block Sites With Malware <\/strong><\/h3>\n\n\n\n

    Use DNS filtering solutions that block access to sites known\nto be infected with malware or viruses. Quad9<\/a>\nis one such free solution that you can use.<\/p>\n\n\n\n

    12.  \n<\/strong>Don\u2019t\nGrant Admin Privileges to Employees<\/strong><\/h3>\n\n\n\n

    Deploy identity and access management (IAM) tools such as\nCyberArk, OpenIAM, or WSO2 to grant access based on pre-defined needs.\nImplement application whitelisting to block programs that are not on the list\nof authorized software. Employee accounts should be running as standard users\nwhere they can\u2019t install software or run unapproved applications. Grant\nadministration privileges to trusted and limited personnel only if there is a\nbusiness justification.<\/p>\n\n\n\n

    13.  \n<\/strong>Limit\nPermissions to Thwart Privilege Escalation Attempts<\/strong><\/h3>\n\n\n\n

    Use an access control list (ACL) to limit access to\nresources on a need-to-know basis. An ACL specifies the permissions or the\nrights a user has to access system objects such as files and directories. Regularly\nreview and decommission old user accounts.<\/p>\n\n\n\n

    14.  \n<\/strong>Implement\na Strong Password Policy<\/strong><\/h3>\n\n\n\n

    Implement a strong password policy that details minimum\nrestrictions on complexity, requires the use of multi-factor authentication, disallows\nthe use of old passwords, manages account lockouts, etc. A password manager\nlike Dashlane or LastPass can be used to manage passwords across several\naccounts. <\/p>\n\n\n\n

    You can also perform a quick search for tools that review if\nyour accounts have been compromised. For example, haveibeenpwned.com<\/a> checks whether your\nemail account was compromised in a security breach.<\/p>\n\n\n\n

    15.  \n<\/strong>Formulate\na Security Incident Response Plan<\/strong><\/h3>\n\n\n\n

    Spend some time figuring out how the organization will deal\nwith a security incident just in case it occurs. Define a process, escalation\npoints, recovery strategies, roles and responsibilities, etc. Get guidance from\nalready established frameworks and checklists<\/a>.<\/p>\n\n\n\n

    \"Graphic:
    Figure 5: Incident Response Life Cycle<\/figcaption><\/figure><\/div>\n\n\n\n

    16.  \n<\/strong>Invest in Cyber\nInsurance<\/strong><\/h3>\n\n\n\n

    Consider investing in an insurance plan to protect your\nbusiness against any unprecedented losses due to a cyber attack. Cyber insurance\ncan cover a wide variety of costs, including: <\/p>\n\n\n\n