Cybersecurity is necessary to protect your company from cyberattacks, a real and damaging threat for small businesses. Did you know that 43% of cyberattacks are directed towards small businesses? Even more alarming, only 14% of small businesses are adequately prepared against a cyberattack (Forbes, 2022). Although you may believe you and your company are immune, this may not be the case. A study by Nationwide Insurance, cited by the Entrepreneur, shares that “45 percent of small-business owners have actually been victims of [cyber]attacks -- without even knowing” (Entrepreneur, 2017).
The Cybersecurity & Infrastructure Security Agency defines cybersecurity as the act of protecting your network of devices (company computers, databases, email platforms, filing systems, etc.) from unauthorized or criminal access. Cybersecurity is an essential. Without taking necessary steps to protect your network, your data could be left vulnerable to hackers and malware.
Hackers, or software intruders, seek for these vulnerabilities in your company’s software to steal private client information, manipulate company data, or to download malware (malicious code) to send confidential information to their own computer (CISA, 2019). These attacks can cause severe damage; they can:
- Cause financial loss
- Breach client confidentiality
- Damage your company’s reputation (by publishing damaging content, or by using your computers to attack others)
- Manipulate and edit your data
These data breaches can be devastating for a small business. With sensitive information vulnerable to hackers with malicious intent, it’s important to know how to protect your company.
Let’s break down what you can do to enhance your own cybersecurity measures.
o Protect your network, use a firewall. A firewall is a software that manages who can access your network; it can block unauthorized users from accessing your company’s data. Firewall software can be downloaded or activated on your current operating system (some operating systems already have firewall protection built in -just check your computer’s operating manual-). Exercise caution when downloading a firewall program, and don’t be afraid to Google which firewall is most appropriate for your business (FCC, 2022). Business.org breaks down some great third-party firewall software (Business.org, 2022).
o Back-up your data as frequently as possible. This ensures that any data that may be manipulated, or even deleted, by an outside source is protected. Make sure your most sensitive data (client information, financial information, employee
files, passwords, etc.) is retrievable on an external site; extra points for cloud storage (SBA, 2022).
o Multifactor authentication is an easy, but effective way to protect you and your employees’ accounts. MFA involves a multi-step “guard” to protect each account. This means that when logging into a platform, you need to input two (or sometimes more) pieces of information to access your account. You have likely experienced this when logging into a Google account from a new device. Instead of just inserting your email password, Google may also send a text to your phone with a code to be input into the new device. This may seem overkill, but this extra layer of security can help deter hackers. The Cybersecurity & Infrastructure Security Agency has a great article on multifactor authentication and how to enable it on different accounts (CISA, 2022).
o Control who has access to your company’s data. Passwords to financial accounts, extra-sensitive client information, and firewall passwords should only be shared on a need-to-know basis. Use your best judgment. Consider password-protecting or limiting employee access to sensitive data. Also ensure that company computers are locked and cleared out when unattended (FCC, 2022).
To ensure that all your employees are trained and knowledgeable on best security practices. Advise that remote workers do not use unprotected WIFI networks while working (like the WIFI available at Starbucks or the airport) and take extra caution to shut down their computers while out of the room. Also consider educating on phishing dangers. The U.S. Small Business Administration describes phishing as a type of cyberattack “that uses email or a malicious website to infect your computer or system with malware to collect sensitive information” (SBA, 2022). Phishing most often involves emails. Although an email may look like its coming from a reputable source, it could be a disguise to encourage you to click on a link or share personal information that could leave you open for cyberattacks. Double-check that every email you receive is coming from a viable email address. Be wary, some email addresses may appear to be correct, but upon closer inspection could be inaccurate. Avoid emails that have odd spellings, fonts, or odd requests (click on this link for additional correspondence, ask for your social, or ask for a “reminder” of a company password). Consider having a monthly or bi-monthly company meeting on cybersecurity. Data protection takes a company-wide effort; your employees are on the front-line, educate them well.
