Posts by admin

Editor's note: Melissa Derr is Director of Digital Forensics and Response at Critical Defence, LLC. We're delighted to share her expertise in cyber security with our audience.

Even though small to mid-size businesses (SMBs) are a primary target for cyber attackers, they remain underprepared to prevent, detect, respond to, and recover from an event. A 2017 report from the Ponemon Institute reported that 54% of SMBs had reported they suffered a data breach in the past 12 months, costing on average just over $1MM in direct expenses, plus additional indirect costs of over $1.2MM.

The numbers are staggering, but the realities remain: most SMBs lack proper budgets to implement the effective security controls that larger companies can afford, nor do they have the staff capable of protecting their technology. So, what can you do about it? Here are a few relatively simple solutions to get you started in the right direction.

1. Identify key risks

Before you can even begin to protect your SMB from cyberattacks, you need to first identify potential vulnerabilities, threats, and risks to your company. Vulnerabilities that most SMBs will find applicable to them are unpatched software, poor employee digital hygiene and unmanaged/unidentified devices on the company network. Cyber threats to most SMBs include the loss of proprietary data/intellectual property, loss of customer data, and loss of control over corporate technology assets.

Once vulnerabilities and threats have been identified, you can more fully understand the organization’s cyber risk. You should plan to patch software as soon as updates are available, encrypt sensitive data at rest, train your employees to detect potential social engineering tactics and phishing emails, and establish a policy prohibiting unmanaged devices on your company infrastructure. Once the policies are in place, make sure you are doing your best to regularly enforce them.

2. Educate Employees

Educating your employees about your key risks and cybersecurity policies is essential. According to independent researcher Ponemon Institute, the number one cause of a breach at SMBs was a negligent employee. Whether it be by clicking a link in an email, web-browsing at insecure websites, downloading software from unofficial sources, or accidentally sending an internal email to an unintended external party, your employees have more impact on the security of your organization than you might realize.

Employees should be aware of the policies you have regarding good digital hygiene, including prohibiting password reuse, safe web-browsing practices, and password length requirements.

While formal cyber security awareness training is ideal, it could be cost prohibitive for smaller businesses. The US Department of Homeland Security’s “Stop. Think. Connect.” campaign, however, is a free resource with sample fliers and internal communications to help you get started.

3. Deploy an endpoint monitoring solution

Detection and remediation is essential to your SMB’s security posture. Monitoring and updating all your endpoints is not at difficult as it used to be; a number of reasonably-priced, cloud-based solutions are available. Earlier this year, PCMag reviewed 10 of the industry leading endpoint protection platforms for small businesses, starting as low as $1 per endpoint per month. These tools can provide anti-virus coverage, quarantine or remove malicious files, email filtering, URL protection, and patch management all in a web-based management console. If you only have room in your budget for one security tool, an endpoint protection solution is your best bargain.

4. Have a back-up plan

No one ever wants to plan for the worst, but as half of all SMBs reported they had suffered a breach, chances are you’ll need a recovery plan. A recovery plan is needed to outline how you will continue business operations in the event of a cyberattack. How will you process payments if your payment system is compromised? What happens to your intellectual property if all your systems are infected with ransomware?

One easy solution is to take regular backups of business-critical systems and data, and store them OFFLINE, so you can recover with relative ease in the event of an incident. You may want to consider building in redundancy in the event of failures. And most importantly, regularly test the solution to confirm it will work in the event you need it.

Cyber attackers have set their sights on small and medium sized businesses. But small businesses often lack the proper budgets, staff and expertise to secure themselves properly. By implementing a few basic solutions small businesses can greatly enhance their security posture. While this is not a comprehensive list of everything you can do to secure your SMB, we hope this provides you with a good place to start. Attackers will continue to target SMBs, and it’s in the best interest of both the consumer and the SMB to be protected. Additional resources are available through the Nations Cyber Security Alliance.

About Critical Defence

Critical Defence, LLC is a global provider of cyber security services including, but not limited to Assurance, Response, Compliance and Training. Additional information can be found at www.criticaldefence.com.

The worst thing you can do, when your customers want to talk about one thing, is to force a conversation about something else. And it's obviously not a very nice way to talk with your co-workers, neighbors, or family. However the tech industry may be making this kind of gaff with its marketing.

According to one observer, there seems to be a significant disparity between what companies are trying to promote for technology improvements and what customers feel would actually be a valuable enhancement. Code is a company based in Manchester, England. They specialize in helping companies offer the most valuable digital products and services possible. To do this requires staying in touch with what makes a digital product/service valuable — that is, what customers are interested in. At the end of 2016, they made some observations and predictions about tech trends. Then they had the humility at the start of 2017 to double-check their claims against reality.

The resulting infographic shows a noteworthy disparity: digital promotions are talking about one thing while the actual consumers sampled want to hear about something else. The most striking example of this disconnect is a comparison of the number of late 2016 news mentions versus the level of customer interest about augmented reality tech:

• 24,200,000 mentions in news coverage — the most prominent topic
• 12.9% of customers interested — the least interesting topic

 The immediate conclusion is that folks who spend their days watching the tech scene aren't the most in-tune with customer interests. This means that if your small or mid-sized business isn't already developing a virtual reality aspect of your products or services, you're probably just fine. No matter what the hype, buzz, and gurus might say.

In fact, the survey by Code gives some excellent advice on what you should focus on. The clear majority of customers said they want to see improvements to existing offerings. For different companies, this will mean something unique. Obviously, a light manufacturing company, a professional services business, and a retail organization won't be able to make the exact same improvements. But every SME can use the same principles to start gathering input from your clients and use that feedback to guide improvement.

From the Code survey, some additional, generally applicable findings are that consumers want:

• more responsive customer service
• better information about what they're buying
• less intrusive tech
• more convenient interconnections between their various online accounts

This final preference from consumers is just as relevant to your own staff. Outside of work, they are consumers, so they understand that technology can be designed to be clean, clear, and easy to use. Those expectations transfer over to the tools they use on the job. If your business operations software doesn't facilitate their work, then its causing needless friction and reducing your team's effectiveness.

aACE 5 is an outstanding example of software developed based on user feedback and organized for clean, straightforward functionality in accounting, CRM, and ERP. It integrates every aspect of your business, ensuring that information from the warehouse is usable by staff in the accounting office and the leaders in the strategic planning session. aACE 5 is built on FileMaker, so it runs smooth on Mac and PC, on desktop and mobile. It can be customized easily to integrate the unique, hard-won expertise that you've accrued through your past years of business.

This powerful functionality is paired with competitive pricing that makes it a compelling alternative to open-source solutions like xTuple, browser-based solutions like NetSuite, or client/server solutions like QuickBooks, Dynamics, and Sage.

Get more answers about how aACE 5 can accelerate your business velocity today.

"Their system covered our work process from start to finish. aACE has the ability to support our company, help us manage our business as we continue grow, and be easily customized to our workflow." ~ Lili Hall, President, KNOCK Inc.