Every small business faces unique difficulties in securing its data. This guide will help you determine your threat model and take the steps necessary to protect your company.
be a part of any business plan going forward.
the assistance of a team of trained IT professionals.
Data leaks have become more and more common, and not just tech companies have been affected. Plenty of more traditional companies, such as Mariott, have suffered massive leaks. Not only do these leaks erode consumer confidence, but they are beginning to incur financial penalties and regulations under the GDPR. While certain exceptions are made for small businesses in the GDPR, putting good cybersecurity and data protection practices in place will reduce your exposure.
As profit-seeking entities and organizations with a responsibility to society, small businesses must work to protect the data their customers have entrusted them with.
What kind of data do you process in your business?
How is that data handled and protected?
Who has access to that data and under what circumstances?
Answering these three questions will help you know exactly what data you have, where you keep them, and who has access rights to them. Drawing a diagram to visualize these relationships can be very helpful as well. For instance, perhaps you have data securely stored on a local, encrypted server, but then you realize that as the data travels over your business's network that it is not encrypted, or that too many people have unnecessary access. Creating a threat model will help you identify where the data are vulnerable to hacks and leaks.
processes in place to protect it.
Another vital part of protecting your network is maintaining the software of connected devices. You can help prevent attackers from installing malware on your company's devices by keeping your apps and operating systems up to date. Software updates often include security patches for recently discovered vulnerabilities. You should also use anti-virus software.
don't have to write them down.
created on an authenticator app or fob.
Tell your employees to avoid using public computers to access their company accounts because keyloggers can record and steal the login information and compromise their account. If your employees absolutely must use a public computer, tell them to be sure they log out of their account afterwards.
strong passwords to protect their devices and make sure they encrypt their data.
reporting lost or stolen equipment.
username and password into a spoofed webpage).
Encryption is the process of converting readable information into an unreadable string of characters. Without encryption, anyone monitoring the Internet could see all the data being transmitted, from credit cards to chat messages. The vast majority of online services use some form of encryption to protect the data traveling to and from their servers. You should encrypt any data that your company considers sensitive.
However, only a few tech companies encrypt your information in such a way that even the company cannot decrypt it. This kind of encryption is called end-to-end encryption (E2EE). Often, there is an E2EE alternative to less private services. For example, ProtonMail is a private alternative to Gmail — and is HIPAA compliant. Instead of Google Drive, which can access your files, your company could use Tresorit. For notes, Standard Notes is one E2EE option. These services prevent anyone but the owner (and in ProtonMail's case, the receiver of the email) from decrypting the file and accessing the data.
For instant messaging, there are a number of options — though the most popular services are still unsecured. Neither Skype for Business nor Slack offer E2EE protection for its users. For better chat security and privacy, we recommend using Wire or Signal.
and whom they should contact if they encounter a problem.
like installing new software, should only be given to trusted, key personnel.
Developing these systems and training your staff on them will be time-intensive, but your employees are your first and last line of defense against data leaks. Now that the GDPR has been implemented, businesses have had to be more forthcoming about data breaches, and the reports have shown human error to be the cause of more data leaks than malicious attacks.
We hope this guide helps you to establish a cybersecurity plan for your business. For businesses interested in a more thorough resource, the Federal Communications Commission has issued a Cyber Security Planning Guide which will cover much of the same ground in greater detail.
At ProtonMail, we believe that security and privacy are everyone's responsibility. By following these guidelines and by using security-focused services, you can significantly improve your cybersecurity.
The post A cybersecurity guide for small businesses appeared first on ProtonMail Blog.