Are you taking steps to protect your business from online threats? You may have heard about, or potentially even been caught up in, some of the recent cyber-attacks affecting some large organisations in Australia. Although the risk to small businesses is generally lower as they are not the primary target for hackers, it is still critical that you take steps to protect yourself, your employees, and your customers from online attacks. If you don’t, it could be a disaster waiting to happen.
Here are 10 best practice tips to protect your business from online threats.
- Make a Security Plan
Spend some time writing a customised security plan for your business. Look at what information assets you have and how they are stored and secured. Think about and document the risks to that data and how you plan to mitigate those risks. Include things like:
- How is your data stored?
- How are the physical and IT assets protected?
- Who has access to the data?
- How is access removed when an employee is terminated from the business?
- What are the legal and regulatory requirements for protection of the data?
- What are the risks involved with the data and how can those risks be mitigated?
- What are your security policies across all data and devices? This could include the use of strong passwords that include numbers and special characters, and not accessing company data on personal devices.
There are several templates available online to get you started, but keep in mind that this is a living document that should be regularly reviewed and updated.
2. Turn on Data Encryption
Your data can be vulnerable to hackers and data thieves. Encrypting your data, alongside other security measures, means that your data should be kept safe even if your business experiences a data breach. This means that even if hackers have access to the data, they are unable to open encrypted files. Any data stored in the cloud, on your physical computer and data drives should be encrypted and this applies to business emails as well. Encryption services are available across devices that handle digital data including your internet connection itself. Look into how you can encrypt all of your data and devices as a first line of defence.
3. Install Anti-virus and Firewall Protection
It may be tempting to stick to free virus protection software that may be provided with your computer, but it may not provide the best defence for your data. There is a variety of anti-virus and firewall protection available, many designed specifically for business environments. They are able to detect and remove malicious software from emails and prevent unauthorised access to your networks. Importantly, ensure that this software is regularly updated and renew your subscriptions on time to ensure there are no gaps in protections.
4. Provide Specific Security Training to Your Employees
This is a critically important step to protecting your data and network. Investing in employee training can help reduce your risk by making your employees more aware of how to keep data safe and how to spot potential threats that may occur when browsing the internet and handling emails. Educate staff on your company security plan, including where to find a copy of it, how often it is reviewed and who to contact if they suspect a potential security breach. It may be valuable to create an easy-to-read guide for staff members who may not be very IT savvy.
Ensure that staff are also across any proactive strategies you have such as regularly changing passwords and multi factor authentication. You can also enforce this via a companywide IT policy.
If your business is heavily reliant on web-based systems, holds sensitive data, or has been the target of security breaches in the past, you may want to invest in a security awareness training course for yourself and your staff.
5. Stay Up to Date
New online threats are identified every day. Make sure that all of your systems, including mobile devices, are configured to automatically download and install security updates and updated software versions to ensure that any potential security holes are plugged as soon as possible.
Keep up to date with the latest information on malware, dangerous email attachments, phishing attempts and other digital threats by monitoring news and security sites. Inform your staff so that they can be aware of what potential threats look like and encourage them to report any suspicious online behaviour to you as soon as possible.
6. Monitor Online Activities
You should regularly review the online activities of employees to ensure that they are using IT resources responsibly and in line with your security and IT policies. There are many monitoring solutions available, from those that simply report on websites visited, to others that track employee keystrokes. However, you need to make sure that your employees are aware of the monitoring systems that are in place to ensure that they don’t feel spied on.
7. Proactively Review Your Social Media Accounts
Social media has been around for quite a few years now and your accounts may not be as secure as you would like to think, especially if you signed up a number of years ago. Recent security and privacy options may not be activated on your business and personal social media accounts. If you are concerned, educate yourself on the security and privacy preferences that are available for each of your accounts and set these as you see fit. You may be surprised at the information your are sharing.
Ensure that your social media accounts include multi factor authentication and that you have more than one administrator set up, just in case there is a problem with one of the accounts. If the accounts are only linked to one admin, sometimes they can be difficult to recover.
8. Be Careful with Online Shopping
Online shopping is convenient and simple, but comes with a few risks. Make sure that any purchases are made using websites that will encrypt your data. You can check for secure websites by looking at the website URL – any websites that begin with HTTP instead of HTTPS isn’t secured. Google has begun warning users who visit these sites, but you need to be vigilant also. Make sure that you are using an updated browser and operating system for the most robust protection.
Avoid saving your credit card details on online shopping sites or within your browser, and designating a credit card which is only used online is an easy way to review your online purchases regularly. Also note that using a credit card is generally better than using a debit card as credit card companies offer better protection against fraudulent activity and unauthorised purchases.
9. Lock Down Your Wi-Fi
Wi-Fi is great for connecting all of your mobile devices to your local network however you must ensure that you have restricted access to the network by enabling WPA2 protection. This is more secure than the old WEP and WPA protocols, so if you have a connection which has been around for some years, it is a good idea to check the protection protocol that has been configured. For robust protection, use a router that provides enterprise-level WPA2 security, and configure the connection so that it is hidden from the general public.
If you are providing Wi-Fi to guests or customers, make sure you provide a separate connection using its own network and hardware.
10. Protect ALL Devices
Don’t just protect your desktop computers – businesses rely on the use of many mobile devices to conduct business efficiently, from mobile phones to tablets and laptops. Make sure that all devices are protected using robust and reliable anti-virus and anti-malware systems to defend your devices when away from the security of your office.
Ensure that all mobile devices are included in your data and security policies, including procedures to follow should a device be lost or stolen. Make sure that access to these devices is restricted with strong passwords and PINs to unlock them, regular backing up to the cloud, and activated tracking features so you can locate them.
Although this may seem to be a lot of work and some additional cost, it is a very valuable process to undertake and is critical in protecting your business and customer data. If you take advantage of the robust software, hardware, and online solutions available to defend your business against the constant stream of online threats, you can be sure you are doing what you can to safeguard your data and online activities.
