Cybersecurity for Small Business

Cybersecurity for Small Business: Preventing and Recovering from Data Breaches

Data breaches are a growing concern for businesses of all sizes. While large-scale data breaches targeting well-known enterprises get the most media attention, small businesses are the most frequent target of cybercrime. Small businesses who fail to protect customer and business data could find themselves in trouble with both regulatory bodies and the public.

Data Protection Standards

Several standards dictate how businesses handle and store sensitive data. In the EU, data protection laws are grouped under the General Data Protection Regulation (GDPR). In the US, however, rules surrounding data protection are fragmented.

PCI Compliance

The Payment Card Industry Security Standards Council (PCI-DSS) sets standards for how credit card information is accepted, processed, and stored. PCI-DSS standards apply to any business that processes credit card data, regardless of the business’s size. Many small businesses contract with a payment processor that maintains PCI compliance rather than handling compliance internally. If your business stores credit card data, you need to take additional measures.

SOX Compliance

The 2002 Sarbanes-Oxley Act (SOX) regulates the storage of corporate records. SOX compliance requires public companies to save business records and store said records in a manner that protects against loss. For compliance, businesses must maintain records that can’t be compromised in a data breach, such as by combining encryption with other data loss prevention methods.

Data Breach Notification Laws

Data breach notification laws are implemented at the state level and vary in strictness. In the event of a data breach, it’s critical that companies research their state’s laws and comply to avoid incurring fines.

Other Data Protection Strategies

There’s a lot businesses can do to protect data beyond legally-mandated measures. Investing in data protection is not only ethical, it’s also a smart business move: More than half of small businesses that suffer a data breach fail within six months. If you haven’t already, here are some strategies you should put in place:

• Stop storing unnecessary data, and clean up old files.

• Invest in network security solutions, such as antivirus protection, firewalls, and endpoint detection.

• Encrypt sensitive data.

• Patch and update software and operating systems whenever updates are available.

• Back up data, creating copies that can be accessed if original data is compromised.

• Train employees on password security and phishing scams.

• Limit bring-your-own-device policies, and restrict access to company networks.

• Restrict off-site device use in order to limit lost and stolen devices.

Although many people believe that Macs can’t get viruses, this is an oft-cited myth that could ultimately leave your computer vulnerable to an attack. True, Macs are less likely to fall prey to viruses than Microsoft Windows, but they are still vulnerable nonetheless. According to Computer World, there are some Mac-specific tips users can follow to ensure they protect themselves against the threat of viruses and malware. In addition to installing macOS updates as soon as they become available, users should also turn on their built-in firewall, consider installing programs such as AVG for Mac, take advantage of Apple’s FileVault, and get very familiar with the system’s Security & Privacy Preferences.

When a Data Breach Happens

Data protection practices reduce the threat of cyber attacks, but they don’t eliminate it. If your small business is the target of a data breach, launch your recovery plan as soon as the intrusion is detected.

• Inform authorities and customers according to your state’s notification laws. Address customer concerns with a phone or email contact line.

• Contact a professional like Secure Data Recovery to analyze the breach and recover stolen data. Don’t put this off; the longer you wait to recover your data, the more productivity losses you’ll incur.

• Identify and repair security weaknesses. Review your data collection and storage policies and your network security.

A data breach could spell the end for your small business, whether it starts with a high-tech hacker or a careless employee. That’s why it’s important to take data protection seriously regardless of your business’s size. From local mom-and-pop businesses to fast-growing startups, cybercrime affects everyone, and understanding the laws and being proactive about cybersecurity is the best way to prevent it.

What’s Next?

If you are unsure on whether or not your business is following the correct guidelines when it comes to cybersecurity, please schedule a consult so we can review your current practices.