Cybersecurity: A Big Issue for Small Business

Today, the Federal Communications Commission (FCC) released a top ten list of cybersecurity tips for small businesses as part of National Small Business Week. I had the privilege of sitting on a panel convened by FCC Chairman Julius Genachowski this morning to discuss securing and empowering small businesses with technology.

Small businesses are a major contributor to the American economy. In 2011, there are an estimated 27.2 million small businesses in America, according to the Small Business Administration, and small businesses comprise two-thirds of all jobs created as stated this morning by Chairman Genachowski. These small businesses are handling financial data, intellectual property and personally identifiable information, and it is vital to the businesses as well as national and critical infrastructure security that the data stays secure.

The list provided by the FCC to small business released today contains valuable reminders for all of us—companies big and small, corporations and individuals. It’s important that we all realize that cybersecurity is not just an IT issue—it’s an overall corporate and global risk that affects all of us.

As many panelists stated, every company needs a cybersecurity plan that includes pre-established relationships in the private sector, government and law enforcement, of who to call in an event. Having a plan in place ensures your company brand and consumer trust as it enables effective response and advanced customer consideration. It shows your stakeholders that you’re building an infrastructure that is responsible and prepared. We’re all connected. If one company does not do its piece to be responsible and keep a healthy network, its putting other companies—both big and small—at risk. 

At McAfee, we have a saying: “Safe Never Sleeps.” We’re dealing with an adversary in cybersecurity that is fast and relentless, so it is vital that we all make a plan to protect ourselves for the before and the after. I commend the FCC for releasing the tip sheet that will help small businesses plan and prepare for threats, as well as help keep their businesses and their customers safe. You can view the FCC’s tips for small businesses below, or on their website.

FCC’s 10 Cyber Security Tips for Small Business

1.       Train employees in security principles

Establish basic security practices to protect sensitive business information and communicate them to all employees on a regular basis. Establish rules of behavior describing how to handle and protect customer information and other vital data. Clearly spell out the penalties for violating business policies. 

2.       Protect information, computers and networks from viruses, spyware and other malicious code

Install, use and regularly update antivirus and antispyware software on every computer used in your business. Such software is readily available online from a variety of vendors. Most software packages now offer subscriptions to “security service” applications, which provide additional layers of protection. Set the antivirus software to automatically check for updates at a scheduled time of low computer usage, such as at night (midnight, for example), and then set the software to do a scan after the software update.

 3.       Provide firewall security for your Internet connection

A firewall is set of related programs that prevent outsiders from accessing data on a private network. Install and maintain firewalls between your internal network and the Internet. If employees work from home, ensure that their home systems are protected by firewalls. Install firewalls on all computers – including laptops – used in conducting your business.

 4.       Download and install software updates for your operating systems and applications as they become available

All operating system vendors regularly provide patches and updates to their products to correct security problems and improve functionality. Configure all software to install such updates automatically.

5.       Make backup copies of important business data and information.

Regularly backup the data on every computer used in your business. Critical data includes word processing documents, electronic spreadsheets, databases, financial files, human resources files and accounts receivable/payable files. Backup data automatically if possible, or at least weekly.

6.       Control physical access to your computers and network components

Prevent access or use of business computers by unauthorized individuals. Laptops can be particularly easy targets for theft, so make sure they are stored and locked up when unattended.

7.       Secure your Wi-Fi networks If you have a Wi-Fi network for your workplace make sure it is secure and hidden.

To hide your Wi-Fi network, set-up your wireless access point or router so it does not broadcast the network name also known as the Service Set Identifier (SSID). In addition, make sure to turn on the encryption so that passwords are required for access. Lastly, it is critical to change the administrative password that was on the device when it was first purchased.

8.       Require individual user accounts for each employee

Setup a separate account for each individual and require that strong passwords be used for each account. Administrative privileges should only be given to trusted IT staff and key personnel.

9.       Limit employee access to data and information, and limit authority to install software

Do not provide any one employee with access to all data systems. Employees should only be given access to the specific data systems that they need for their jobs, and should not be able to install any software without permission.

10.   Regularly change passwords

Passwords that stay the same, will, over time, be shared and become common knowledge to coworkers and can be easily hacked. Passwords should be changed at least every three months.

Tags: counter identity theft, credit card fraud and protection, Cybercrime, Data Protection, Mid-Market, Public Sector, Small Business