Some small business owners – you might be one of them – will take comfort in the belief their operations are too inconsequential to attract attention from international cybercriminals. However, smaller companies have in fact become a preferred target for cybercrime largely because many lack the time, budget and expertise to put comprehensive security defences in place.
They are also seen as much easier targets for cyber criminals than large multinational corporations, in part because many smaller companies only have a basic notion of their network security risk.
Best Practice Recommendations
Today, IT networks at organisations of all shapes and sizes are much more complex than they were just five years ago and have grown organically over time. Frequently, they are made up of a combination of on-premise networks, mobile networks and cloud services. Unfortunately, in many cases, internal security protection has not kept up with these changes.
Cyber crime is a real threat that should not be ignored, and as such, the below advice will help you get on track to implement an effective security policy suited to the needs of your organisation:
- Update software – Make sure both software updates and antivirus programs are current. Malware is constantly evolving to take advantage of vulnerabilities in software, and so are patches and fixes that repair these weaknesses. However, these fixes are useless if updates aren’t applied.
- Educate employees – Educate your staff about cyber security, to never open unknown attachments in emails or click on unknown links. It may sound basic, but web- and email-based threats are growing very quickly. In the first half of 2012, web-based malware infections grew 400 percent over 2011, and email-based attacks grew 56 percent from the first to the second quarter of 2012. It is often said that technology is only as good as the people that use it and preventing behaviour that puts your systems at risk is key.
- Effectively deal with remote workers – Small business owners increasingly depend on remote workers and external contractors to help with the workload, but it is important to securely manage them. Knowing how many people are accessing which corporate information, and from where is critical to ensure your organisation’s security defence.
- Be careful of social media – Social media can be an important marketing channel, but malicious code is increasingly injected into social networking sites, including harmless-looking links, advertisements and game apps. On Twitter, shortened URLs make it impossible to recognise if links are legitimate and retweeting these helps spread infections.
- Employ stringent password policies – Workers with access to financial or personal data should have separate accounts for sensitive and more general business content. Ask your staff to change passwords regularly, using a mix of alpha and numeric characters that do not resemble words, so that exposure from password theft is time-limited.
- Limit access to financial data – Minimise the number of people who have access to sensitive financial or personal content – the fewer people who have log-in credentials to this data, the harder for criminals to compromise the data.
- Be wary of downloaded apps – Be alert when buying and installing applications from online app stores and make sure they come from a reputable source to avoid malware infections.
- Develop a layered approach to security – This means the integration of multiple forms of technology for maximum protection, including web, email, data and mobile protection.
- Speak to an expert you can trust – All-in-one layered security systems are widely available, but if you prefer to deploy separate technology for different areas, consult an accredited cyber security specialist as vulnerabilities can occur if technology is not well integrated. If you don’t feel you have the necessary technical expertise to implement an effective security policy, consider asking a member of staff with interest in IT to help you with the decision-making process.
Summary
A majority of UK businesses are relying on nothing but luck to protect them from cybercrime threats. Put measures in place now, so that your luck doesn’t run out. Security is becoming more and more important as time goes on, but it goes beyond protecting yourself against cyber attacks. Read our post about protecting your technology equipment.
