Posts

Think you are too small

Image
Think you are too small to be targeted by a cybercriminal? Think again. When I meet with clients, especially SMBs, I often hear them say that they feel their business is too insignificant to be a target of cyber-criminals. Why would someone go after my business when there are bigger ones out there, making more money? Here are a few reasons why. Because you think so - The fact that you think you are safe makes you more vulnerable, because you are not prepared for the eventualities that arise from an attack. Most SMBs I interact with don’t have a well-defined plan in place in terms of IT securityYour staff is a gateway: Smaller businesses rarely conduct formal training sessions or provide information updates to their staff about the latest cyber threats. Such sessions are never a priority when the staff is too caught up with other ‘real’ work. As a result, your staff is more likely to fall for phishing messages and unknowingly become a gateway for cybercriminals to enter your organization…

Keeping your data safe: Access Control

Image
Keeping your data safe: Access Control Cyberattacks are a commonplace today. Malwares such as viruses, worms and more recently ransomwares not only corrupt your data or hold it hostage, but also inflict irreversible damage on your brand and business. As a norm, most businesses these days do invest in anti-virus/cybersecurity systems. But, is that really enough? The answer is--NO. Because, they often overlook one important aspect--access. Ask yourself, how easy is your data to access? How can you strengthen the walls that keep your data safe? Read this blog to find out. Role-based access Always follow a role-based access permission model--meaning people in your organization have access to ONLY the data they REALLY need. Generally, the higher the designation, the deeper the data access permission and stronger the rights. For example, someone at the executive level may not be able to edit your MIS spreadsheet, but a manager should be able to. Formal password controls No matter how good your c…

Smaller firms less likely to keep up to date on the basics that protect them

Image
Smaller firms less likely to keep up to date on the basics that protect them. On the never ending problem of cyber security, small firms often do not have any/much in-house IT support. As a consequence, they may be less likely to be able to make sure their software is consistently updated to reflect any patches released by the product’s maker. This simple oversight, deliberate or not, is a major source of data breaches and ransomware attacks.Think back many years to when Microsoft pulled the plug on maintaining Windows XP. Many users refused to upgrade because there were afraid of losing compatibility with other software programs, the unintended consequences of moving to a new OS, or just not being sure how to install an upgrade. Whatever the issue, it meant those users had an operating system that was no longer updated to reflect the latest security fixes. Their operating system became an unlocked gate. You may not be scared of technology, but as a small business owner, tracking the…

Cyberattacks and the vulnerability of the small business

Image
Cyberattacks and the vulnerability of the small business You cannot go a day without reading about some big name company or even government agency being hacked and critical data being compromised. What you don’t see in the media is that most of the attacks happen to small firms, and that this is where a lot of the cybercrime is occurring. What any business, but especially a small business, needs to be afraid of are cyber attacks that disable your operations, disrupt customer interaction, or breach your customer’s personal data. Contrary to what one might expect, smaller firms are far more likely to be targets of hackers than large firms. They are also likely to have less sophisticated security measures in place. Any firm’s existence can be threatened by these events, but smaller firms are often unable to rebuild after a major breach. Studies show that customers are less forgiving of smaller firms than larger ones when their personal data has been compromised. The lesson here is tha…

Denial is not a solution: Something you owe your customers and your employees

Image
Denial is not a solution: Something you owe your customers and your employees Why do so many people procrastinate about making a will? Why is it so hard to get young people to buy health insurance? Because it is one of those “probably won’t happen--at least in the foreseeable future, and I‘ve got more interesting things to worry about or spend my money on” issues. Small business owners tend to take the same approach to making business continuity plans in case of a disaster. They are usually fully consumed just running the business and keeping revenues steady and growing. Diverting energies and resources to a “what if” scenario just isn't an imperative. There are affordable, effective tools out there that will allow any smaller firm to develop effective business continuity plans, but they only work if you take action. Our best advice to overcome denial? Think of this scenario: If something happened right now and your entire operation came to a halt because of a cyber attack, a power f…

Limited investment capital and planning for trouble

Image
Limited investment capital and planning for trouble Small businesses often fail to take the time to make business continuity plans. One aspect of a business continuity plan involves developing plans to handle the loss of physical infrastructure and hardware. Unfortunately, smaller and younger firms often fail to address these issues because they lack the necessary capital to invest in additional or supplemental equipment. Redundant servers, battery back systems or uninterruptible power supplies, and data backup systems that allow for offsite backup storage are the most obvious examples. These can represent considerable capex for a small firm. However, these costs need to be weighed against the costs that would be incurred if a severe business interruption occurred. Encouragingly, new technology is creating tools for redundancy and data protection that don't require additional hardware investments. The cloud is probably the single biggest savior for small businesses looking to def…

Data Protection Laws and PIIs

Image
Data Protection Laws and PIIs Last week we discussed the overall concept of “Data Protection Laws,” which govern the handling and securing of specific data. While these laws are wide ranging, most of these laws reference Personally Identifiable Information (PII) This “refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.” (https://www.gsa.gov/portal/content/104256) For example, if you possess an individual’s first initial and last name and store it with their credit card number, bank account, SSN or driver’s license number, that becomes a PII. At the Federal level, the United States doesn't have any overarching and comprehensive data protection laws of the sort that most European nations do, but they do exist and primarily affect individual sectors, such as healthcare. Presently 48 states in the US have some laws requir…