Best Cybersecurity Practices for SMBs

Today’s headlines on security risks make it seem as though it’s only a problem that large companies face. Nothing is further from the truth. Cybercriminals are looking to get money and disrupt businesses of all sizes. In fact, there are numerous underground organizations that facilitate and create software for hackers to use in their attacks. These packages require minimum effort, making it that much easier to target businesses of all sizes. To them, it’s just part of normal day-to-day business.

Ransomware is a looming threat, and bad actors are capitalizing on it more and more, especially amidst the remote and hybrid work throughout the pandemic. Threat actors undeniably want money, and deploying ransomware is the quickest way to cash out. As we make our way through 2021, ransomware attacks are still on the rise and need to be a grave concern and priority for businesses and organizations. 24% of SMBs are aware of having a cyberattack in the past 12 months. Because of this, insurance carriers are starting to review their cyber liability policies and require companies in the SMB space to implement best security practices. So, how can the SMB space protect against threats that can target and infect even enterprise organizations? Luckily, it’s easy to move forward and build foundational security practices within your business. There is no single “silver bullet” to protect an organization. Great security requires a layered approach. However, there are basic building blocks that, when combined, provide a strong layer of defense. Whether it’s for SMBs or enterprises, these can be built upon in the future as needs arise.

Layer One

The first layer involves securing access to critical electronic business communications. Most organizations today rely on digital communication to distribute key company information, such as financial statements, payroll, industry trade secrets, and even money transfer requests. There are also opportunities for data exfiltration of sensitive employee and client data. Malicious actors are constantly using phishing attacks to try and get into your organization, gather key credentials, and snoop around. Once they have access to key email accounts, they use that to impersonate users:

• Asking for and stealing passwords.

• Stealing critical protected information for use in dark web activities.

• Using your email account to send emails with phishing attacks to your trusted contacts.

The most effective way to protect against this is the implementation of multi-factor authentication (MFA). MFA uses something you know (i.e. password) and something you have (i.e. hardware security key, application on a mobile device with a special code). Utilizing this two-factor approach minimizes the chance that a hacker can guess or brute force your password, and then use it to log into your email. You can have peace of mind knowing that the only way to log into your email is by using something you always have with you.

Layer Two

The next layer is endpoint security. Many workers today operate in a hybrid workspace - working in the office and remotely – and effective workstation security helps protect them anywhere. What comprises good endpoint security? You need to make sure that your fleet of systems is patched with the latest round of security patches. Keeping endpoints up to date is an ongoing process, ensuring that known operating system and third-party application flaws are fixed as soon as possible.

Endpoint Detection and Response malware protection is also needed. This layer of next-gen AV, combined with a managed threat detection solution, ensures that endpoints are constantly being watched for applications and behaviors that indicate an attack happening in real-time. Not only will it protect against known malware, but it also uses machine learning to predict malicious behavior. And while machine learning helps to spot risks, the best solutions also have a team of real human security analysts to examine the data from within your organization.

Layer Three

Third, your organization needs bulletproof backups. Data security is critical in ensuring that if you do get attacked, your business can continue to run without negotiating with criminals. During a ransomware attack, hackers attempt to encrypt data across the enterprise, which includes any connected network storage devices. A proper backup ensures that your data is stored securely offsite and disconnected from your network. It’s critical that once your data has been saved to the backup media, it’s no longer possible for malicious actors to gain access to the files; as such, these backup files are core to thwarting their ransom attempts.

Layer Four

Last, but certainly not least, we come to, perhaps, the most important layer: your internal staff. When it comes to protecting your business, your users are the most important bastion of strength. In effect, they must be educated on proper email hygiene, password management, social engineering, and more! Furthermore, they must be made aware of the traps that hackers set up daily, as they navigate the online world. According to a recent Avanan report, 1 in 99 work emails is a phishing attack. During a 5-day work week, this amounts to an average of 4.8 phishing emails per employee. Providing them with knowledge and understanding of how hackers try to infiltrate your systems gives your employees the skills they need to protect your organization.

How Can VC3 Help?

At VC3, security is key to our way of life. We understand what needs to be done to protect your business and create success! The key building blocks above are core to our foundational level of strategic IT initiatives. We have developed a methodology to ensure that your company is protected and will be able to meet the needs of today’s advanced security landscape.

If you’d like to learn more about cybersecurity for SMBs or you simply need help in determining what are the optimal protection services for you, VC3 is here to help!