Small and mid-sized business (SMBs) are unique in their security needs. \u00a0They have received very little attention from the security industry by\u00a0anything more than a drive by hardware or software salesman. \u00a0Their uniqueness doesn’t come from any special security situation, but from size and resource availability.<\/p>\n
Most security standards, frameworks, and guidance are\u00a0focused on large businesses, governments, and financial institutions where resources are more abundant and attacks have been prevalent for decades. \u00a0SMBs have only started seeing attacks\u00a0in the last several years. \u00a0They are having to catch up to the big guys very quickly. \u00a0However, they are also under much tighter resource constraints<\/strong>. \u00a0That doesn’t mean we can’t use these standards, frameworks, and guidance. \u00a0However, it does mean that we need to adapt them to meet the needs of that different environment.<\/p>\n With both people and money, SMBs cannot afford to throw seemingly unlimited\u00a0resources at the problem. \u00a0Because of this, we must work to implement industry standards and best practices in a cost-effective<\/strong> and unobtrusive<\/strong> manner. \u00a0Good news, though, it can be done! \u00a0The following four areas are key to a successful\u00a0security foundation in an SMB:<\/p>\n 1. \u00a0Planning<\/strong><\/p>\n Planning is key to any implementation. \u00a0A company security plan\u00a0sets the tone for the secure operation across the company. \u00a0It prescribes a level playing field for all users and demonstrates to clients, partners, and other stakeholders\u00a0that your company takes the security of its information and computing resources seriously. \u00a0In planning for incidents and disasters, it also defines processes to be followed in hectic and stressful times that guide your team through the difficult events quicker and with greater chance of success.<\/p>\n 2. \u00a0Secure Architecture<\/strong><\/p>\n Much of the technical portion of cyber security can be accomplished through a secure architecture, including hardened baseline configurations for computer and network systems. \u00a0A few other key systems include a boundary firewall and anti-malware protection for each computer system. \u00a0While there are other types of security systems available, these are the only two I recommend across the board for all environments. \u00a0Other types of systems may be useful in unique situations, but not for everyone.<\/p>\n 3. \u00a0User Awareness<\/strong><\/p>\n Many\u00a0modern cyber attacks\u00a0targeting SMBs are\u00a0actually targeting the users. \u00a0While some of these attacks\u00a0will be caught by your anti-malware software, much\u00a0of it will slip through. \u00a0This is where an educated and aware workforce can greatly bolster your defenses. \u00a0Through foundational training and periodic updates, people are much better than computers at spotting phishing, ransomware, and social engineering attempts.<\/p>\n