- Sign up for DHS CISA e-mail alerts specific to your company and industry needs and review the alerts:
- Sign up here.
- Use the free DHS developed CSET (Cybersecurity Evaluation Tool) to assess your security posture – High, Med, or Low. CSET is downloadable here.
- Educate Employees About Cyber Threats and Hold Them Accountable:
- Educate your employees about online threats and how to protect your business’s data, including safe use of social networking sites. Depending on the nature of your business, employees might be introducing competitors to sensitive details about your firm’s internal business.
- Employees should be informed about how to post online in a way that does not reveal any trade secrets to the public or competing businesses.
- Use games with training and hold everyone accountable to security policies and procedures.
- This needs to be embedded in the culture of your company.
- Register for free DHS cyber training here.
- Use the free DHS SMB cyber resource toolkit.
- Protect Against Viruses, Spyware, and Other Malicious Code:
- Make sure each of your business’s computers are equipped with antivirus software and antispyware and updated regularly. Such software is readily available online from a variety of vendors. All software vendors regularly provide patches and updates to their products to correct security problems and improve functionality. Configure all software to install updates automatically. Especially watch freeware which contains malvertising.
- Secure Your Networks:
- Safeguard your Internet connection by using a firewall and encrypting information. If you have a Wi-Fi network, make sure it is secure and hidden. To hide your Wi-Fi network, set up your wireless access point or router so it does not broadcast the network name, known as the Service Set Identifier (SSID).
- Have a secure strong password to protect access to the router (xeeityyg18695845%&*&RELxu78IGO) — example.
- Lastly, use a VPN (virtual private network).
- Control Physical Access to Computers and Network Components:
- Prevent access or use of business computers by unauthorized individuals. Laptops can be particularly easy targets for theft or can be lost, so lock them up when unattended. Make sure a separate user account is created for each employee and require strong passwords.
- Administrative privileges should only be given to trusted IT staff and key personnel.
- Create A Mobile Device Protection Plan:
- Require users to password-protect their devices, encrypt their data, and install security apps to prevent criminals from stealing information while the phone is on public networks.
- Use a containerization application to separate personal data from company data.
- Be sure to set reporting procedures for lost or stolen equipment.
- Protect All Pages on Your Public-Facing Webpages, Not Just the Checkout and Sign-Up Pages:
- Make sure submission forms can block spam and can block code execution (cross-side scripting attacks).
- Establish Security Practices and Policies to Protect Sensitive Information:
- Establish policies on how employees should handle and protect personally identifiable information and other sensitive data. Clearly outline the consequences of violating your business’s cybersecurity policies and who is accountable.
- Base Your Security Strategy Significantly on the NIST Cybersecurity Framework 1.1: Identify, Detect Defend, Respond, and Recover:
- The NIST Cybersecurity Framework Small Business Resources are linked here.
- Require Employees to Use Strong Passwords and to Change Them Often:
- Consider implementing multifactor authentication that requires additional information beyond a password to gain entry. Check with your vendors that handle sensitive data, especially financial institutions, to see if they offer multifactor authentication for your account. Smart card plus passcode for example.
- Employ Best Practices on Payment Cards:
- Work with your banks or card processors to ensure the most trusted and validated tools and anti-fraud services are being used. You may also have additional security obligations related to agreements with your bank or processor. Isolate payment systems from other, less secure programs and do not use the same computer to process payments and surf the Internet.
- Outsource some or all of it and know where your risk responsibility ends.
- Make Backup Copies of Important Business Data and Use Encryption When Possible:
- Regularly backup the data on all computers. Critical data includes word processing documents, electronic spreadsheets, databases, financial files, human resources files, and accounts receivable/payable files. Backup data automatically if possible, or at least weekly, and store the copies either offsite or on the cloud.
- Having all key files backed up via the 3-2-1 rule — three copies of files in two different media forms with one offsite — thus reducing ransomware attack damage.
- Make Sure Your Vendors Have the Required Security Compliance Attestations and Insurance:
- SOC 2, PCI, and HIPAA for example.
- Cyber/data breach insurance should be separate from general business liability, and you should know the exclusions and sub-limits.
- Use A Password Management Tool and Strong Passwords:
- Another way to stay safe is by setting passwords that are longer, complex, and thus hard to guess. Additionally, they can be stored and encrypted for safekeeping using a well-regarded password vault and management tool. This tool can also help you to set strong passwords and can auto-fill them with each login — if you select that option. Yet using just the password vaulting tool is all that is recommended. Doing these two things makes it difficult for hackers to steal passwords or access your accounts.
- Use Only Whitelisted Sites Not Blacklisted Ones or Ones Found Via the Dark Web:
- Use only approved whitelisted platforms and sites that do not expose you to data leakages or intrusion on your privacy. Whitelisting is the practice of explicitly allowing some identified websites access to a particular privilege, service, or access. Backlisting is blocking certain sites or privileges. If a site does not assure your privacy, do not even sign up let alone participate.
- Mimic Your Likely Threats with a Threat Modeling Methodology that works for your Industry:
- PASTA, VAST, and FAIR are just a few.