Cybersecurity can be a big problem for small business. A report by the Ponemon Institute shows that the number of small and medium size businesses that experienced a cyber-attack in 2018 increased to 67%. And only 28% say they can effectively mitigate these treats. So, while small businesses are particularly vulnerable to attack, it seems they don’t have the training and resources to implement the type of security programs they need.  

However, there are a number of cost-effective steps small business can and should take that can greatly increase their security. The Center for Internet Security (CIS) offers a regularly-updated list of security controls that any size business can implement.  CIS controls are a set of 20 recommended cybersecurity actions put together by a broad range of government and industry experts. The controls are broken down into groups based on importance to help organizations prioritize a smaller number of highly effective actions.  

Not all controls are right for all business

One advantage of the CIS controls is that they are customizable to fit your organization’s needs and resources. To help with this, the CIS released a guide that identifies some of the controls most important for small business and can be implemented with little to no cost. Here is an outline of their recommendations: 

Know Your Environment  

In order to properly implement a cybersecurity program, the first thing you need to do is actually know what you need to secure. It is therefore essential to understand three basic things: the value of data you have, what devices are connected to your network, and the software that is in your systems. Conducting an inventory of your data and software alongside regular scans of devices on your network will go a long way toward preventing attacks.  

Protect Your Assets 

The CIS outlines two approaches small business should take that will greatly protect their outlines. The focus is not just on implementing technical security measures, but also on training employees to prevent accidentally damaging your systems.  

The first step is to secure technical baselines. Often attacks will exploit weakness in applications running on your systems, so it’s important to ensure all operating systems and applications are updated with the latest security patches and are securely configured. The CIS also recommends using anti-malware software to regularly scan your environment. Most systems will include built in anti-virus software, but there are also plenty of low-cost alternatives available. 

When it comes to educating your employees, the first step is to train the entire staff on identifying phishing schemes and phone call attacks. These can target employees at any level of an organization, so it’s essential everyone is properly trained. You will also want to implement more targeted trainings by identifying users with access to sensitive information and educating them on proper cybersecurity behaviors.  

Prepare Your Organization 

The last step the CIS recommends all small business take is to prepare for the possibility of a cyber-attack or data breach. While the idea is to prevent these from happening in the first place, it’s important to have systems in place should the unexpected occur. 

To mitigate the damage of data loss the CIS recommends performing automated weekly backups of systems that contain important information and to ensure at least one of your backups is not accessible through the network. 

The CIS also recommends conducting periodic incident response simulations. It’s essential to identify and train those within the organization who will serve as lead in the event of an attack and to run through possible scenarios. You will also need to familiarize yourself with state and federal regulations to understand what notification requirements you need to adhere to. 

Of course, this shouldn’t be understood as a comprehensive guide for small businesses. It contains only a small subset of the complete 20 controls but represents what the CIS views as a barebones guide that small businesses can implement with only small cost to them. Check out the full report for more details on these steps as well as a list of small or no cost programs the CIS recommends to help with implementation.  

Once you’ve set up these simple security procedures, you might want to take a look at the full list of CIS controls to see what additional steps you can take to create the most effective cybersecurity program you can. Don’t be a statistic on next year’s Ponemon report.  

Cyber security is a catch-all term, but your approach to it doesn’t have to be. Not all organizations need to be utilizing the same types of security controls. An organization processing payment cards, for instance, will need to implement different security procedures than a small business collecting names and email address for lead generation.  

Simply put: The level of security your organization requires depends on a variety of factors. If you just implement one security system across your entire network, you may end up over–protecting certain information while under–protecting others. 

This is why a risk assessment is so important. Identifying and evaluating your current cybersecurity risk will not only ensure you have adequate security controls in place but will also help you understand how you can properly direct your resources.  

The Basics of a Cybersecurity Risk Assessment 

Before starting, it’s important to sit down and set the parameters for the assessment. Make sure everyone understands the scope of the assessment, and that any priorities or constraints are well communicated. Once everyone is on the same page, you can begin the assesment itself.  

Identify Threats 

The first step is to identify what potential threats your organization faces. In general, threats can be categorized as either adversarial or non-adversarial. Adversarial threats include both internal and external entities acting with malicious intent. You will want to identify possible sources and capabilities of such threats. Non-adversarial threats generally include unintentional acts from employees or admins that expose system vulnerabilities.  

In addition to threat actors, you want to identify the types of threats those actors pose. This includes anything from installation of malware and targeted phishing attacks to unintentional data leaks and misuse of information by an authorized user.  

Identify Vulnerabilities  

After identifying the threats your systems could face, the next step is to understand to what extent your systems are vulnerable to those threats. Such vulnerabilities include holes in your technical controls such as out of date software or security patches, mismanaged user access privileges, under-trained employees, and even the physical security of your data center.  

Determine Likelihood and Impact of Threat 

Now that you’ve determined possible threats and your vulnerability to them, it’s time to categorize the likelihood and impact of those threats. Determining the likelihood of a threat will depend on a number of factors, not only including your current vulnerabilities but also whether certain threats target your specific industry. Financial institutions, for instance, are common targets of business email compromise schemes, so are likely to experience phishing campaigns.  

Along with calculating the likelihood of a threat, you’ll need to understand the impact or potential harm each threat poses to your organizations, employees, and customers. You can determine the impact of a threat by analyzing what systems would be effected, the sensitivity of the information involved, and whether the threat could spread to other areas.  

Calculate Risk  

Having completed the previous steps, you’ll be able to calculate the risk each type of threat poses. There are a number of methods you can use to calculate risk, but the simplest is to weigh the likelihood of each treat against its potential impact. You can then arrange potential threats by the level of risk each poses and prioritize actions to prevent them. 

Final Notes 

While all organizations should devote time to assessing their cybersecurity risk, it may even be required by state, federal, or industry regulations. PCI-DSS, for example, requires yearly risk assessments as a part of their compliance validation reports. Both HIPAA (Health Insurance Portability and Accountability Act) and FERPA (Family Educational Rights and Privacy Act) also require some form of risk assessment. Be sure to check which regulations apply to you. 

Lastly, for more details on conducting a risk assessment, we recommend checking out the National Institute of Standards and Technology’s (NIST) Guide for Conducting Risk Assessments. We’ve outlined the basics, but NIST’s report contains further details on each step and a variety of charts and tables on threat types, quantifying likelihood and impact levels, and more.