Are you taking cybersecurity seriously? Taking smart steps to improve your organization’s security posture is more critical now than ever.
If you’re an SMB, you may think you’re safe from being targeted by cybercriminals. Yet, studies show that 43% of all cyberattacks are aimed at small businesses.
If you’re not sure where your security posture stands today, review these 14 cybersecurity best practices. It may be time for a much-needed upgrade to protect your business from breaches now and in the future.
Are You Taking Cybersecurity Seriously? 14 Ways To Find Out
- Do you have a strong password security policy?
- Are you using security software?
- Do you have a patch management process?
- Are you running regular backups?
- Are you using MFA?
- Does your network have a firewall?
- Do you conduct employee awareness training on phishing dangers?
- Do you monitor your network regularly for suspicious activity?
- Do you have guidelines for BYOD and MDM?
- Do you have a legacy system?
- Do you limit security access to privileged information?
- Do you monitor third-party access to your data?
- Do you have a disaster recovery plan (DRP) in place?
- Have you had a network IT risk assessment lately?
1. DO YOU HAVE A STRONG PASSWORD SECURITY POLICY?
Do your employees use passwords? Of course they do — right? But is your password security policy up to date — or do you have one at all? Implementing password policy best practices is a simple but essential step in your cybersecurity strategy.
Password generators and password management software are the easiest ways to safeguard your passwords. PC Magazine’s top-rated password management apps for this year include:
- Keeper Password Manager & Digital Vault
- LastPass
- Dashlane
- Bitwarden
- LogMeOnce Password Management Suite Ultimate
- Password Boss
2. ARE YOU USING SECURITY SOFTWARE?
Keeping criminals at bay can sometimes be accomplished by keeping your doors and windows (no pun intended) locked. Anti-virus, anti-spyware and anti-malware software can effectively protect against hacking and data breaches. You can also use web filters to stop employees from accessing dangerous websites.
3. DO YOU HAVE A PATCH MANAGEMENT PROCESS?
Patch management is the practice of performing regular software updates and fixing vulnerabilities that get found from time to time. Proper patch management can make or break your system security. It helps you keep track of software patches as they’re released, ensuring your applications stay secure and updated.
Patch management can be time consuming. If you don’t implement routine patches, you could experience gaps that could expose you to attacks. A patch management process helps establish routines, procedures and timeframes for effective software updates.
4. ARE YOU RUNNING REGULAR BACKUPS?
Do you know when the next potential disaster event will strike? Of course not. Yet, a staggering amount of businesses still don’t perform regular backup procedures. Disasters that can take down your business range from employee accidents and server failures to regional disasters and cyberattacks.
Can your data safely be restored to a point in time that doesn’t pose a substantial loss to your operations? If you’re not sure, you’re probably not running regular backups. Automating the backup process is the best way to ensure that your sensitive data is always secured.
5. ARE YOU USING MFA?
Multi-factor authentication (MFA) has all but replaced two-factor authentication (2FA) in identity verification. MFA requires two or more identity verification steps to decrease the likelihood of cyberattacks. Microsoft has stated that 99.9% of cyberattacks could be prevented by adding multi-factor authentication.
MFA includes some combination of the following:
- Something you know: A password, a PIN or answers to security questions
- Something you possess: A one-time password (OTP) sent via email or text, a physical token, or an authenticator app
- Something you are: A biometric identifier like your fingerprint, retina or voice verification
6. DOES YOUR NETWORK HAVE A FIREWALL?
Firewalls restrict access to your computer system or network. They’re the first line of defense in keeping hackers from gaining access to your company’s data storage or website. Remote workers can pose threats to your security if home computers connected to your network are hacked.
Installing home firewalls for remote workers in addition to company firewalls add an extra layer of protection for your business.
7. DO YOU CONDUCT EMPLOYEE AWARENESS TRAINING ON PHISHING DANGERS?
Don’t underestimate the ability of your employees to spot and stop phishing attempts — but don’t overestimate them either. Experienced hackers have many types of phishing attack methods at their disposal that can trick even the most savvy computer user.
Make sure you have regular security awareness classes to educate employees on how to thwart phishing attempts. Include security guidelines in new employee training sessions, and inform all employees about new security measures you adopt.
8. DO YOU MONITOR YOUR NETWORK REGULARLY FOR SUSPICIOUS ACTIVITY?
24/7 network monitoring is the only way to stay ahead of cybersecurity threats and prevent issues before they become problems. Constant network monitoring and daily system scans detect anomalies and ensure that malicious software and security incidents are caught early.
9. DO YOU HAVE GUIDELINES FOR BYOD AND MDM?
Bring-your-own-device (BYOD) and mobile device management (MDM) practices became commonplace during 2020’s work-from-home explosion. Many companies scrambled to implement procedures and protocols to safeguard company data on personal devices — and not all were successful.
Your BYOD and MDM guidelines should include clear rules on acceptable usage of mobile devices, including laptops and notebook computers, smartphones, portable media devices and tablets. They also establish rules for approved apps and public WiFi usage.
Read How To Create A Mobile Device Management Policy: 9 Best Practices
10. DO YOU HAVE A LEGACY SYSTEM?
A legacy system is outdated computing hardware or software that you’re still using. We get it: replacing hardware and migrating systems is not easy and often quite costly. But legacy systems can increase your exposure to security risks, hamper your growth and leave you hopelessly behind your competition. Is it time to upgrade your outdated infrastructure?
11. DO YOU LIMIT SECURITY ACCESS TO PRIVILEGED INFORMATION?
The “principle of least privilege” is a guideline that gives users only the level of data access they need — and no more. If you currently have no limits on the data your employees can see, edit or download, you may be asking for trouble.
Additionally, make sure you revoke access, privileges and credentials when employees leave or are terminated. This commonly missed step leaves the door open for corporate espionage and malware attempts.
12. DO YOU MONITOR THIRD-PARTY ACCESS TO YOUR DATA?
Do you commonly work with contractors, suppliers or vendors, in-person or remotely? Giving access to third parties is a risk factor you should monitor closely. Never take for granted the threat that open data can provide to someone outside your circle.
You should oversee any third-party worker’s activity carefully. Consider using one-time passwords (OTPs) and keep a record of all interactions in case an investigation becomes necessary.
13. DO YOU HAVE A DISASTER RECOVERY PLAN (DRP) IN PLACE?
Performing system backups is an essential component in any disaster response plan. But does your DRP also include a tried-and-tested process for preventing serious disruptions, restoring data and getting back to business?
A DRP can encompass a range of tools and processes in four broad stages of the disaster recovery cycle. Do you have all four under control?
- Proactively taking steps to prevent disruption (prevention)
- Putting safety guidelines in place (preparation)
- Minimizing loss when incidents occur (mitigation)
- Returning to normal operations (recovery)
Read 11 Steps For Designing A Foolproof Disaster Recovery Plan
14. HAVE YOU HAD A NETWORK IT RISK ASSESSMENT LATELY?
An IT assessment (also called a security or network assessment) is like a “check-up” that helps optimize your operating systems and maintain a healthy IT security strategy. Without a regular system status report, you could be well on your way to a costly break-fix scenario.
A network IT assessment identifies opportunities to improve efficiencies and reduce risks. It identifies critical gaps in your IT environment configuration, enabling you to solve technology issues before they become work-interrupting security problems.
Read Why Your Business Needs A Network It Assessment
TAKE STEPS TO IMPROVE CYBERSECURITY WITH HELIXSTORM
Never take your security for granted. If you’ve ever considered using a managed services provider to help meet your IT security goals, Helixstorm may be the partner you’ve been looking for.
Helixstorm serves all of Southern California. Our managed IT services include:
- Future-focused IT strategy
- Best-in-class software
- 24/7 proactive maintenance
- Stress-free IT that gives you peace of mind
We’re business-minded, but we put our relationships first — that’s why we’ve worked with some of our clients for more than a decade.
