The Basics Of Cyber Security [10-minute guide]

Control who can access different items within your network:
Commonly known as “access control”. Access control allows you to granularly control who has access to which parts of your network/which hardware they can access. Access control is designed help protect your business both from internal threats and external threat actors by making it more difficult to move laterally within your business systems.

Staff & external providers typically do not need full access to all of your business data and accounts. You should restrict access whenever possible.

• Internal threats are real and are a fairly common cause of breaches. A common way this occurs is an external threat actor will offer one of your employees a cut of a ransom if they help them to gain access to your business’s network. This form of malicious access can be very difficult to prevent, the best way to do so is to limit access where possible. Think of it as isolating a fire to a small area rather than letting it run rampant.

You should give users the bare minimum permissions and work from there rather than the opposite. Your employees rarely need administrative access and distributing it freely will leave your business more vulnerable.

Remember to delete accounts when employees leave (especially if the exit is particularly nasty) or if you change providers. Most companies we work with find that they still have active accounts of employees that have been gone for quite some time.

Protect your data offline
Always follow standard security practices. Remember that a threat actor can get access to your business network in person as well.

Don’t write your passwords on sticky notes, don’t let random people access your network, keep your server room locked, etc. You get the picture, use common sense and avoid costly and easy to avoid mistakes.

Get your employees on board
Your employees are both your biggest asset and your biggest cyber liability. Training them to follow best practices can provide immense value and prevent cyber events from ever occurring. Here is our practical 11 step process to helping your employees significantly improve their cyber hygiene (and subsequently, your businesses as well).

• Avoid unknown email, links, and pop-ups
  1. Avoid clicking on anything. Adopt a zero-trust mentality towards any unknown links. If you are unsure, always ask!
  2. Never enter crucial personal or business information in unknown emails, websites, etc.
• Don’t plug in that USB you found
  1. Seriously, this is one of the oldest (and easiest to avoid) ways of injecting malware onto your device. Have your IT team double-check any USB before you plug it in.
• Protect your cell phone
  1. Your mobile device has access to tons of sensitive data, especially in the work-from-home era. If your cell phone is compromised or lost, that could mean free access to all of that important data. Make sure to keep track of your devices, especially those of you with administrative access.
• Use strong passwords every time
  1. Luckily most signups force this now but that wasn’t always the case. Always use complex passwords with special characters, numbers, and letters.
  2. Create unique passwords for each login.
  3. Tip: you can use a password manager to manage your unique password so you don’t have to remember them all.
• Verify software is legitimate before you download it
  1. Not everything you download is safe. Your antivirus software should protect you from threats but nothing is foolproof.
  2. It never hurts to ask your IT provider if something is legitimate.
• Understand that cybercriminals will try to manipulate you
  1. Social engineering is the name of the game in 2021. Threat actors are intentionally attempting to manipulate by preying on your goodwill. If something seems fishy, it probably is. Always verify first.
• Use a reputable antivirus software
  1. If you use Windows devices, the default Windows Defender is a solid pick. Your IT provider may install different types of antivirus on your device as well.
• Backup your data
  1. This is valuable for both cybersecurity and just general peace of mind. Having backups means that in the case that something goes wrong, you have that backup to restore from.
• Be wary of emails & texts from executives, CEO’s, or higher-ups
  1. Compromised emails are becoming increasingly common. You may receive an email from your CEO saying you need to urgently buy gift cards, or enter sensitive information, or download an infected link, etc. These types of emails are difficult for spam filters to detect so they may often land in your inbox. Always verify these are legitimate before taking any action.
• Use multi-factor authentication
  1. MFA is the way to go to protect your personal and business assets. Use an authenticator app on your mobile device whenever possible. There have been instances where cyber-criminals had backdoor access to text messages. Those types of MFA may not be secure.
• Adopt a “zero-trust” mentality
  1. Zero trust basically means that you always verify the legitimacy of an email, text, website, etc. before you commit to any actions related to that thing. The zero trust mentality means that you consider that everything could potentially be a threat. Your IT provider can help you implement systems that can assist with zero-trust if you choose to go in this direction.