It’s no surprise small businesses put off cyber security.
There is almost always something that seems more pressing. A computer has become unresponsive. An employee is trying to log into their account. A new software subscription was requested. An employee accidentally clicked on a dodgy link and needs to know if it is dangerous.
Security is often the last thing you think about until something happens.
But that is getting more difficult to sustain. Companies are using more cloud apps, accessing them remotely, collecting more payments online, sharing more files, and using more connected devices – than they did just a few years back. Meanwhile, customers and business partners are more concerned than ever about how the organizations they work with safeguard their data.
For a small to medium business, Keeping Up doesn’t mean going for a massive security operation. It begins with a lot easier steps: Know what you’ve got. Know who can get to it. Make sure the basics are all working.
The Problem Is Often Bigger Than It Looks
Ask a business owner whether their company uses multi-factor authentication, and the answer might be an immediate yes.
But ask a slightly different question: Is it enabled for every employee? What about administrators? Remote access? Cloud applications that were added six months ago?
The answer can change quickly.
This can be the same thing that is happening with software updates, endpoint protection and user accounts. A company might have good security tools, but have a few forgotten devices, some old accounts or a system not setup correctly that lies outside those protections.
This is why a basic security review is useful. It replaces assumptions with facts.
Start with the simple questions. What devices are connected to the business? Which systems contain important information? Who has administrative access? Which employees can access sensitive files? What happens to an account when someone leaves?
The answers often uncover problems that were not obvious during day-to-day operations.
Security Tools Are Only Useful When They Are Working
It’s easy to see cybersecurity as being a shopping list.
Enable two-factor login. Purchase a duplicate system. Protect email. Complete.
Unfortunately, it does not work that way.
You can deploy a security product and it could be poorly configured. You can have backup running every night and it still be a waste of space and time if you cannot restore your files. An employee can be having MFA whilst an abandoned administrator account is locked down with only a password.
The details matter.
For example, take backups. When a dashboard says “backup completed” it is good news, but it doesn’t answer the most important question: Is the business actually able to restore their files?
A basic restoration test will provide much more information than a green indicator.
The same principle applies elsewhere in the environment. Businesses should periodically verify that their security controls are working as originally intended.
SMBs Have Less Room for Security Mistakes
For bigger companies they typically have individuals who their specific job is 100% about infrastructure and security. For a smaller company you may have only one employee that takes care of everyting for your staff and your Microsoft 365 accounts.
Sometimes there is no internal IT person at all.
That makes consistency difficult.
A business can start the year with good security practices and gradually drift away from them. A new employee gets an account. Someone leaves but their access is not removed immediately. A new cloud application is introduced without being added to the company’s existing security process. An old laptop is replaced but remains connected to the network.
None of these events seems particularly serious on its own.
Together, they can create a very different security environment from the one the business thinks it has.
That’s why several SMBs partner with an outside IT Services expert in Atlanta. A third party’s occasional site review can help an SMB to identify small concerns that can be overlooked when organizations only examine their environment when everything is broken.
Start With the Accounts
User accounts are one of the easiest places to begin a security review.
Go through the list of employees and administrators. Remove accounts that are no longer needed. Check who has access to sensitive systems. Make sure former employees cannot still sign in. Look for shared administrator credentials that should have been replaced with individual accounts.
Then look at MFA.
It is not enough to know that the company “uses MFA.” Check where it is actually enforced and whether the most important accounts are covered.
Administrator accounts should be monitored even more than an employee account because they will give you so much more. That same hand if the administrators’ account gets cracked or compromised will lead to less damage.
These checks are not complicated. The challenge is remembering to do them.
Do Not Forget the Devices
A review of the data must also be performed on other devices used by the company.
A small business might have laptops used in the office by employees, home use computers, phones attached to business accounts, and legacy equipment that is unused but can still connect to the business.
It can be unknown if all devices are being updated with security patches or protected with endpoint security without device inventory.
A business at least needs to understand the devices they have, who is using each one, the operating system they run and if these are supported.
Special care should be taken with unsupported software and operating systems. If your device can no longer receive security updates it is a problem that needs to be addressed, even if that device is still protected by your antivirus software.
Backups Must Be Tested
Backups are a further comfort zone that can make companies feel safe.
The backup system might run forever without a true recovery ever being tested.
You don’t have to bring the entire business down when testing. Begin with the basics. Roll back a few files. Make sure they are accessible. Time the restoration process. Ensure key staff members are familiar with the steps involved.
A more thorough recovery exercise of critical systems will expose issues that regular backup reports will never show.
The idea isn’t to complicate the backup process. It is to do everything we can to ensure that “we have backups” actually means “we can recover.”
Build a Simple Security Review Cycle
SMBs should not have to worry about cybersecurity every week.
A regular review is usually more practical.
Every few months, take a look at the employee and administrator accounts. Review critical devices and the update status. Review backup reports and perform a restoration test. Review what applications have been added since the last review. Confirm that ex-employees have been disabled.
It is also worth keeping basic documentation.
Create documentation of the essential systems, security responsibilities, backup procedures and account-management processes. This doesn’t have to be a 100-page tome of a security manual. It just needs to be handy to have around when the primary person who takes care of all the technology is not around.
That’s an important consideration for many organizations. If one employee understands all the technology infrastructure, there’s technology risk in the organization regardless of how good its security tools are.
Cybersecurity Should Keep Up With the Business
A company’s technology environment changes whenever the business changes.
Hire more employees and there are more accounts to manage. Move to a new office and the network changes. Add a cloud application and there is another system to secure. Start allowing remote work and there are new access points to consider.
Those decision are changing needs to change security.
The goal for an SMB, then, is not to build an unbreachable system. No company can realistically guard against every threat.
A better goal is to make it more difficult to make the common mistakes, limit access to the critical systems, maintain backup copies of vital data and know what to do when things go awry.
That starts with basic visibility.
Know what is connected Know who has access Keep your systems up to date. Test backups. Regularly go through the accounts and devices. Record the key processes.
This might not be the most thrilling set of tasks, but it is the foundation of a cybersecurity program that can actually grow with your business.
