Cybersecurity resource guide for small businesses and entrepreneurs

An annual internet crime report published by the FBI states that in the year 2020 alone, the costs related to cybercrime had exceeded $4.2 billion. It is important to bear in mind that small businesses are far from immune to cyber threats. As such, businesses of any size should ensure that they have gone to appropriate lengths to protect sensitive data relating to their clients, employees, and business operations.

Evaluating cyber risk

When evaluating cyber risks for a small business, the following measures can be effective:

• Determine what information your business manages and stores.
• Evaluate the security priority of various types of information that your business manages and stores.
• Research what cyber threats could affect your business.
• Identify the potential outcomes of various types of cyberattacks.
• Judge how likely each breach scenario is to occur.
• Take inventory of your available resources for cybersecurity.
• Review your current procedures and policies relating to cybersecurity.
• Review your current software, hardware, and services related to cybersecurity efforts.

Once you have evaluated your cyber risks, you can better develop procedures to reduce them.

The potential impacts of cyber attacks

Potential negative consequences for a small business as a result of a cyber attack include:

• Damage to your business’s reputation;
• Damage to IT resources;
• Interference with IT processes;
• Interference with business operations;
• Financial losses related to loss of assets, legal actions, and damage control.

These impacts can arguably be far more devastating to small businesses, as they often have fewer resources to devote to recovery.

Cyber risks for small businesses

Cyber risks and risk factors are much the same for small businesses as they are for large businesses. However, small businesses may have fewer resources at their disposal to identify, prevent, manage, and recover from cyber threats.

Types of cyber risks

Common types of cyber risks for small businesses include:

• Phishing: Phishing refers to an attack where a bad actor poses as a reputable entity within the company to extract information from an employee or convince them to perform another action.
• Malware: Malware refers to a wide range of harmful software such as ransomware, spyware, adware, keyloggers, and trojans.
• Weak passwords: Some passwords are easier to guess than others, such as those that include simple personal information like names and birth dates.
• Insider threats: An insider threat is anyone who has internal access within the organization, which they can use to carry out a cyber attack.
• DDOS attack: A distributed denial-of-service (DDoS) attack is when bad actors attempt to overwhelm a website’s ability to process and store information through a barrage of requests.
• MItM attack: A man-in-the-middle (MitM) attack is when a bad actor attempts to intercept or interfere with communication or transfer.
• Zero-day exploit: A zero-day exploit refers to an attack where a bad actor identifies and exploits a vulnerability in a system before the target organization is aware of it.

It is important to keep in mind that this is just a small selection of common vulnerabilities. There are a wide variety of strategies for a cyber attack, and these strategies are constantly evolving.

Risk factors and high-risk events

Potential factors that can increase a small business’s risk of cyber attacks include:

• Lack of resources: Lack of resources such as money, manpower, and computer assets may make it more difficult for a business to prevent, manage, and respond to a cyber attack.
• Lack of information: If business owners and employees are unaware of what cyber security threats there are and how to effectively manage them, they will be less equipped to deal with them.
• Lack of cybersecurity policies: Without specific policies in place regarding cybersecurity, there is no consistent structure to fall back on in terms of security.
• Lack of training: Informational resources and cybersecurity policies are not as effective without additional training to reinforce the information and procedures.
• Lack of automated processes: Automation of IT functions can reduce the possibility of human error.
• Lack of a recovery plan: Businesses need to be able to recover from breaches in addition to preventing them.
• Insider threats: An insider threat such as a disgruntled employee often has easier access to sensitive data.
• Man-made disasters: Man-made disasters such as large-scale accidents and acts of terror can affect elements such as the power grid, available hardware, and access to restricted areas.
• Natural disasters: Similar to man-made disasters, natural disasters such as floods and earthquakes can affect elements such as the power grid, available hardware, and access to restricted areas.

If your business is experiencing one of these issues or is likely to, it is important to factor this information into your cybersecurity strategy.

Mitigating cyber risks to small businesses

Options for reducing the likelihood and impact of cyber attacks for small businesses include:

• Sufficient training for employees: Ensuring that employees are aware of potential risks and what to do if they encounter them can allow organizations to more quickly and effectively identify threats.
• Regular software updates: Software updates often include patches related to cybersecurity that address newly identified threats and vulnerabilities.
• Regular hardware updates: To function optimally, cybersecurity software requires a compatible system with sufficient power and storage to run on.
• Regular policy updates: Cybersecurity threats are constantly evolving, along with best practices for addressing them. As such, policy related to cybersecurity should reflect these changes.
• Creation of backup files: Backup files can prevent information from being permanently lost. Backup files can be handled on-site or through an RMM. File backup strategies will be more effective if they are highly automated.
• Use of high-quality cybersecurity services: For some businesses, it is more feasible to outsource cybersecurity management than to handle it in-house. Doing so may offer them more resources than they could manage or afford otherwise.
• Use of high-quality information storage services: Outsourcing data storage can also be a helpful option for businesses that can’t effectively handle secure data storage in-house. Cloud computing is a common option because data is encrypted and stored by a third-party, which provides several obstacles for bad actors.
  Implementation of an alert system: The sooner you know about a security breach, the better. To this end, an automated alert system can bring potential threats to your attention more quickly.

These strategies will be particularly important if you store personal data such as client or employee information.

How to protect personal data

Steps for protecting sensitive client and employee data can include:

Developing specific policies and procedures related to cybersecurity;

• Providing informational materials to employees;
• Ensuring data is highly organized;
• Providing cybersecurity awareness training;
• Utilizing secure platforms for storing and managing information;
• Regularly updating software;
• Regularly updating hardware;
• Monitoring access and activity on the network;
• Restricting access to sensitive information;
• Maintaining access logs;
• Having a detailed bring-your-own-device policy;
• Limiting what information is documented;
• Securely deleting information as needed;
• Using secure passwords;
• Utilizing multi-factor authentication;
• Using cybersecurity tools;

Immediately reporting and investigating possible security breaches.

It is also important to keep in mind that depending on your industry and the data you manage, you may be subject to regulations relating to its storage and transfer. For example, healthcare organizations are subject to HIPAA regulations.

Cybersecurity training and certifications for entrepreneurs and managers

Training and certification related to cybersecurity can be useful resources for small businesses looking to improve their cybersecurity protocols and practices. Such training programs can be used to refine the knowledge of existing employees or to more effectively vet new-hires by requiring certain certifications.

What Is Cybersecurity awareness training?

Cybersecurity awareness training refers to generalized training programs meant to increase employees’ understanding of cybersecurity risks and how they can help manage them. Such programs are a valuable asset for cybersecurity within organizations, as uninformed personnel can represent a vulnerability. Training programs are offered both through the federal government and private vendors.

Cybersecurity training platforms

Helpful cybersecurity training platforms include:

• Cybrary: This is an aggregation of crowd-sourced career development resources related to cybersecurity.
• EC-Council: This entity provides training and certification related to cybersecurity.
• IBM: Although IBM is most well-known for selling hardware and software, they also provide consultation and training services related to cybersecurity.
• (ICS)2: This entity provides training and certification related to cybersecurity.
• Khan Academy: This is a crowd-sourced online learning platform.
• Open Security Training: This is a crowd-sourced training platform that focuses on cybersecurity.
• SANS Institute: This entity provides training and certification related to cybersecurity.
• Skillshare: This is a crowd-sourced online learning platform.
• Udemy: This is a crowd-sourced online learning platform.

Various educational institutions also offer cybersecurity training programs.

Cybersecurity certificates

Valuable cybersecurity certificates include:

Certified Ethical Hacker (CEH): This certification is administered by the EC-Council through various educating bodies, such as universities. Ethical hackers are given clearance to access various elements of a network to identify and correct vulnerabilities.

GIAC Security Essentials: This certification is developed by Global Information Assurance Certification (GIAC), and is used to confirm knowledge related to information security. Exams are conducted online through third-party vendors.

Certified Information Security Manager (CISM): This certification is developed and administered through Information Systems Audit and Control Association (ISACA) to demonstrate an individual’s ability to manage enterprise information security. You can take the exam online or in-person through PSI.

CompTIA Security+: This certification was developed to test basic knowledge related to information security. The certification is administered by the Computing Technology Industry Association (CompTIA) online or in-person through Pearson VUE.

Certified Information Systems Security Professional (CISSP): This certification is offered through the International Information System Security Certification Consortium, and is meant to test knowledge related to information security. Testing is conducted through Pearson VUE.

These are just a few examples of reputable certifications. It is always important to investigate the validity of certifications and the entities through which they’re offered before pursuing them.

Cyber resources for small businesses and entrepreneurs

Resources that can help small businesses protect sensitive information and other digital assets include:

• Anti-virus software: Anti-virus software identifies and fixes viruses.
• Encryption: Encryption is the process of converting data into a cipher that can only be deciphered by authorized devices.
• Backup files: A backup file is a copy of a file stored in a secondary location such as a cloud server to preserve it in case the device or storage software is compromised.
• VPNs: A virtual private network (VPN) disguises your IP address and encrypts data related to your internet activity to offer more privacy to the user.
• DaaS: Data-as-a-Service refers to cloud computing services that are used to manage data.
• Firewalls: A firewall controls incoming and outgoing traffic for a network.
• Authenticator apps: Authenticator apps generate codes for one-time use to confirm user access.
• Password managers: A password manager generates and stores passwords.

Which options you implement and how will depend on a variety of factors, including your business structure and individual preference.