You're a small business owner with limited resources. How can you protect your company from cyber threats?

prioritize cybersecurity by implementing strong password policies, regularly updating software, and conducting employee training on recognizing phishing attempts. Utilize affordable antivirus and anti-malware solutions to protect against common threats. Regularly back up important data and invest in basic firewall protection to bolster your company's overall cybersecurity defenses.

In my experience, foundational and basic security principles are key to success in managing cyber risk for small business. These are my 3 tips: 1. Maintain good asset inventory - you can only protect what you know you own and install good anti-malware protection. 2. Know your perimeter defense, be diligent about in and out traffic and what's being allowed or not. 3. Strong access control with multi factor authentication with good practise of segregation of duties and not only more senior personnel has more access. I believe these 3 basic tips can help a small business to go a long way in defending cyber threats.

You can consult NIST2 framework to know where to start from. In my opinion nowadays with a small budget you can outsource it. For instance to have another company looking at you infrastructure using XDR/EDR capabilities you could be paying less than 10k / year for a really small company that needs it. On the other hand, systems like backup as a service make sure in case you data is compromised you can have it back again. But on this topic would it be more for cyber resilience.

•Assess the risks and benefits of security measures using the cost of prevention versus potential losses from a breach. •Regularly educate all staff on cyber threats, safe practices, and social engineering tactics. •Be proactive & not reactive, don’t wait for incidents to occur. Prevent attacks by implementing security controls. •Patch vulnerabilities, update your software, and monitor for suspicious activity. •Encrypt sensitive data to prevent unauthorized access. •Back up critical assets regularly to minimize data loss. •Invest in ongoing training for IT staff and employees. •Stay informed about emerging threats and adapt security practices accordingly. •Consider cyber insurance to mitigate financial risks associated with breaches.

For small businesses, No, don't waste money in this area. Staff training may be the 4th or 5th priority. Do consider go get a quote for CyberInsurance first. The aim isn't getting it signed, but know the basics what an insurer expected, rejected, or their view on risks, provide an idea to your cybersecurity posture. Then, next steps is to get your organisation qualify to insurable.

Here you can have phishing campaigns for instance. It almost seems odd but for small companies the attacks are yet from phishing campaigns that almost always get some employee. On other thing to bare in mind is that laptops should be from the company and avoid at all cost the "bring you lapy" policy. Your IT guys should have some tool to deploy and force updates.

Security awareness training is helpful, but humans will be humans, so they will still click on those links post-training. Mock phishing exercises or solutions from organizations like KnowBe4 are beneficial for testing the effectiveness of your training. Additionally, you should implement MFA to access your organization's information and assets.

2.⁠ ⁠You can not underestimate the power of strong passwords and MFA. 3.⁠ ⁠Regular backing up data is not enough. You must also regularly test that your backup works when needed.

Your team is your first line of defense. Conduct regular training sessions on cybersecurity best practices, such as recognizing phishing emails and creating strong passwords. Employees who are informed make fewer mistakes that could lead to security breaches.

4.⁠ ⁠Start building Zero Trust when you're small, and you'll go a long way as you grow. 5.⁠ ⁠Collaboration with industry experts is the key. 6.⁠ ⁠Most importantly, stay updated on new threats and cybersecurity trends.

Typically, turn on automatic update, provide that automatic backup is there. Comparing the resources, interruptions from untested patching is much lower than the complexity of patching solutions, plus the lost of vulnerability exposure. You can't afford lags behind in patching without good security investments. Just do hit and fix, and if you find particular systems interruption is unbearable, invest patch and test management with it. The key is "test management", not patch, that is much easier in comparison.

Many businesses use Microsoft for email, Outlook, and O365 programs to conduct business. By enhancing their license, they can also get affordable security. By providing corporate-owned managed computers, you can control updates and security through policy. Additionally, if you want to use BYOD, you could still set a policy that needs to be updated to connect to company resources, such as the computer, phone, etc. I find that Microsoft makes it easier for SMBs than other vendors in the space.

Using bitlocker and other tools as such is important, but as someone deeply invested in the future of cybersecurity, I firmly believe that cyber resilience is the cornerstone of our defense strategy. It's not just about preventing attacks; it's about preparing for them, responding effectively, and adapting swiftly. In our dynamic digital landscape, resilience is key to maintaining operations, protecting our assets, and (working nowadays in an Iat integrator) receiving the trust of our customers. By embracing cyber-resilience, we can minimize downtime, mitigate the impact of attacks, and ensure our organizations remains strong and secure against ever-evolving threats or even against those users that are caught in things like phishing or so.

This will rely heavily on the type of infrastructure you have deployed, and there are much more modern approaches to remote work than a VPN - think of things like bastion hosts for cloud storage locations. A VPN for a small business, that operates in the cloud, for example is a waste of resources in most cases.

VPNs are costly to maintain, disrupt user experience, and pose security risks. Their centralized nature creates vulnerabilities, and they often fail to provide full network visibility. Additionally, VPNs require complex configurations and provide a false sense of security, leading to potential breaches. I now see a shift towards XDR, EDR and NDR as game-changing tools. Unlike VPNs, these solutions offer encrypted network traffic, deep packet inspection, and real-time threat detection. By leveraging EDR and NDR solutions, our organizations can achieve comprehensive network visibility, protect against advanced threats, and maintain operational resilience without the limitations and costs associated with traditional VPNs.

We are in an age that you either have you data off the internet or you use a 3rd tool to unsure your organization cyber resilience. Even Microsoft nowadays has something like this. Use it in your benefit even if it costs something more

AI-driven EDR with 24/7 SOC monitoring seems like something reserved for Fortune-1000, but really, it's accessible to everyone nowadays and is a necessity for defending against modern malware. Also, assume that any system may be breached someday and restrict end user access to only what is necessary to perform their jobs. Enable 2FA everywhere, preferably using hardware keys. (How is this not listed when it's even more important than VPNs or encryption at rest? The AI generating these article prompts is not doing well...)

As a small business owner with limited resources, protect your company from cyber threats by using strong passwords and enabling multi-factor authentication. Regularly updating software and security patches. Backing up data consistently to prevent data loss. Training employees on phishing and cybersecurity best practices, using a reward system (run a contest that would reward the employees that complete the most training segments). Using firewalls and antivirus software for basic protection. Small steps can significantly reduce cyber risks.

Consider investing in multi-factor authentication (MFA), firewalls, and endpoint protection solutions. Regularly review and audit your cybersecurity practices to adapt to new threats, and if possible, consult with cybersecurity experts to stay ahead of potential risks. Sometimes admitting what you are good at and what isn't in your wheelhouse is key. Some business owners cannot also add wearing the IT hat while also running and managing their non tech business.

I would recommend that small businesses identify and join an industry-relevant Information Sharing and Analysis Center (ISAC), if possible. These are non-profit organizations that allow small business to leverage the skills and expertise of a community, where there are many other small businesses on the same security journey together and the larger businesses tend to supply much of the intellectual capital that's derived from their expansive cybersecurity (and other) budgets.