Cybersecurity for Small Business: Essential Best Practices

Small business cyber security is all about risk management. There is no such thing as being 100% secure or completely eliminating risk. The goal is to mitigate risk to an acceptable level, and to make your systems, networks and users a difficult target such that attackers will look for an easier target elsewhere. The vast majority of cyber attacks are automated, and the most likely targets are those organizations that have not implemented basic security hygiene measures.

The following small business cybersecurity best practices can help organizations of any size strengthen their defenses, protect sensitive data, and reduce the risk of cyberattacks. It is important to keep in mind that this is a minimal list of security controls from a Storable perspective, and depending on your business and budget, you may need or choose to do more, especially if your organization is subject to any state, federal or industry compliance requirements.

Endpoint and Laptop Security Best Practices

Securing the endpoints (e.g. laptops, desktops and mobile devices) is one of the most important IT best practices for small business operations. Increasingly, staff are working from remote locations and we no longer have a strong perimeter to protect our endpoints. The endpoints themselves need to be resistant to attacks.

A consistent laptop security configuration for small business teams should include encryption, automatic updates, and restricted administrator access. Below are some controls that are important to have in place:

• Advanced Endpoint Protection Software – Traditional signature-based antivirus software alone may not provide enough protection against modern threats. Consider endpoint protection software that can detect suspicious behavior, block malware, and alert administrators to potential attacks.Example vendors include:
  • Malwarebytes
  • Crowdstrike
  • SentinelOne
  • FireEye
• Encryption –
• Full disk encryption will help ensure that if a device is lost or stolen, the data stored on that device cannot be accessed by anyone other than the owner of the system. This is particularly important for laptops, tablets and phones. Most current versions of Android and Apple phones have disk encryption enabled by default. This can be verified in the device’s settings. Laptops typically need to have full disk encryption enabled by the owner/administrator of the system. Fortunately, both Windows and MacOS provide this capability with Bitlocker (Windows) and Filevault (MacOS).
• Automated Patching – Ensure that endpoints are configured to automatically install security patches for both the operating system and third-party software. Windows and MacOS are both configured to install security patches automatically by default. Many third-party software products do as well, but not all. So it’s important to make sure that security patches are installed regularly for all software.
• Limit Admin Access – When using a computer system for general purposes, make sure to use an account that does not have administrator privileges. If something needs to be done on an endpoint that requires administrator rights, login with a different admin user account to perform those tasks, and then logout when finished. Daily use should be performed using accounts that do not have administrator rights.
• Hardware and Software Inventory – It is important to maintain an accurate inventory of all endpoints and installed software. You cannot secure systems if you don’t know what you have.

Get self-storage specific tips for cybersecurity.

Email Cybersecurity for Small Business

Email and web browsing are two of the primary attack vectors utilized by attackers today. It is very important to make sure your email system detects and blocks malicious emails before they make it to the user’s inbox. Similarly, employ software to block access to malicious websites, and enable protections for your self-storage website and customer data.

Below are some important controls to reduce the risk of email and web-based attacks:

• Email Vendor – Use a reputable vendor such as Microsoft or Google. Both provide email security tools for small businesses, including spam filtering, phishing detection, and additional account protection features. Review your provider’s security settings regularly to ensure these protections are enabled and configured properly.
• Web Protection – Implement software that will prevent users from accessing malicious websites. Many endpoint protection tools have this capability, but there are also network-based solutions that will block access to known malicious websites. Some examples include:
  • Malwarebytes
  • Cisco Umbrella
  • Zscaler
• SSL Certificate – An SSL/TLS certificate enables HTTPS, which encrypts information exchanged between a website and its visitors. This is especially important for small businesses that collect customer information, process online payments, or offer online reservations.This is critical in securing credit card transactions and protecting customer information and data.

Employee Cybersecurity Training and Password Best Practices

Most attacks today focus on the end user. The reason being is that it is easier for an attacker to have a user click on a malicious link or divulge a password than it is to try and circumvent network and software security controls.

Below is a list of small business cybersecurity best practices and controls:

• Security Awareness Training – All computer users should be provided with security awareness training. This is extremely important so that users will be able to recognize and defend against attacks such as phishing. Train employees to identify suspicious links, unexpected attachments, fraudulent payment requests, and attempts to impersonate trusted vendors or customers. Some good security awareness training vendors include:
  • SANS
  • KnowBe4
  • Proofpoint
• Passwords – Passwords are typically the first line of defense against unauthorized access to your systems. As such, it is important to implement a strong password policy that will make it difficult for attackers to guess or otherwise obtain these credentials. In general follow these guidelines:
  • The longer the password the better. Use a minimum password length of 12 characters.
  • Encourage the use of a passphrase.
  • Use software to prevent users from choosing a password that is easily guessable or already known to have been compromised.
• Multi-factor Authentication (MFA) – Reusable passwords should be supplemented with MFA wherever possible. MFA raises the bar significantly for attackers and prevents the most basic and common types of attacks where the attacker obtains the user’s credentials and uses those for unauthorized access to a system.

Small Business Network Security Best Practices

Since most attacks occur across the network, you should ensure that network traffic is properly managed. This includes both wired and wireless networks.

Below are a few actions that can be taken to prevent attackers from accessing your network:

• Firewalls – Firewalls should be installed and configured to deny all traffic by default. Then add rules to allow only that traffic that is required for business purposes. This applies to both network firewalls and host-based firewalls installed on your endpoints. Also be sure to limit both inbound and outbound traffic.
• Wi-Fi – Most devices connect to the network over a wireless network, and it is very important to make sure this wireless traffic is secured. Enable wifi encryption using either WPA2 or WPA3, and do not expose the management interface of your wifi controller to the Internet. And as with your endpoints, be sure to keep your wifi network devices up-to-date with the latest software.

Creating an Incident Response Plan

It is very important to develop a security incident response plan so that in the event that your organization ever suffers a security incident, you will have a plan in place to guide your response activities.

For additional guidance, learn how to create a cybersecurity incident response plan for your self-storage business. 

Cybersecurity for Small Business Resources

Below are a number of free small business cybersecurity resources that are geared toward helping SMBs with their security practices and controls:

• The GCA Cybersecurity Toolkit for Small Business – This is an excellent resource to help small businesses implement practical and effective cyber security controls.
• Center for Internet Security Computer Security Controls – This is a list of 20 controls that if implemented, will greatly increase the security posture of your organization.
• NIST Small Business Cyber Security Corner – This is another great resource published by the National Institute of Science and Technology which is funded by the US government.
• NIST Cyber Security Framework – This is one of the leading cyber security frameworks used by both public and private sector organizations.
• FTC Cyber Security for Small Businesses – This guide was developed by the Federal Trade Commission to provide SMBs with a list of basic security practices.
• FRSecure Incident Management Template – This is an excellent template to assist in the creation of an incident response plan for your organization.

Obviously, these are just a few of the ways to prevent the increasing concern of cyber attacks. Awareness that a risk exists is the first step in thwarting the risk. We remain committed to partnering with you in this effort and will be vigilant alongside you in this effort.

Get More Support from Storable

Cybersecurity for small businesses starts with consistent habits, from updating software and securing devices to training employees and preparing for potential incidents. For self-storage operators, these IT best practices for small business can help protect tenant information, reduce operational disruptions, and build customer trust. Review your security practices regularly and make cybersecurity improvements as your business grows.

If you’re looking for a reliable software vendor for your small storage business that protects, automates, and centralized key information, try Storable. Request a demo today.