Good cybersecurity habits for startups and SMEs

We’re thrilled to have a guest blog contributed by one of our technology partners, Right-Hand Cybersecurity. Right-Hand is a group of mission-oriented individuals driven to shift the power away from the adversary and back into the hands of businesses. Enjoy the article!

You may relate internet attacks with large organizations. However, cybercriminal activity affects businesses of all sizes. Small and medium-sized enterprises (SMEs) are no exceptions. 

On top of that, every one in five SMEs becomes a cyber victim, and 60% of small businesses harmed by a cyberattack fail within six months. There are a variety of cyber-attacks that might represent a threat to these companies, ranging from hacker extortion to malware infection to phishing and other social engineering attacks.

There are managed services options for external threats that provide accessible, strong protection layers for SMEs, from servers to endpoints, on the cloud and on-prem. But what about dangers born out of human vulnerabilities that bypass technological barriers through social engineering and other techniques? 

In this article, we discuss sound cybersecurity habits your employees can easily adopt.

Simple Habits To Maintain Cyber Hygiene For SMEs

According to the UK government’s 2021 Cyber Security Breaches Survey, COVID has made cyber security more complex, with 47% of SMEs having employees use personal devices for work. In addition, only 23% have a security policy that covers hybrid work. 

Now that hybrid work is here to stay for the foreseeable future, businesses of all sizes must rethink their priorities and ensure that security is a top priority. Moreover, as we emerge from the pandemic that forced firms to shift to a hybrid or remote work model, IT professionals will face an even more significant challenge to stay ahead of the curve. 

Why? Many businesses set up hastily put-together infrastructures to allow employees to work from home during the first lockdown, but they weren’t meant to last.

Hybrid environments are frequently far less secure than office environments, leaving a company vulnerable to security threats. You can, however, continuously improve your weakest link by adopting simple cyber habits. 

So, without further ado, let’s look at how adopting the following simple cyber practices can make your employees less vulnerable to cyberattacks and protect your business:

Cybersecurity Habit #1: Ask Employees To Use Strong Passwords 

Strong, complex passwords can prevent cybercriminals from gaining access to company data. However, if a cybercriminal cracks your password, they may gain access to the company’s network. Therefore, it’s critical to create passwords that are both unique and complex.

A strong password consists of at least 20 characters and includes numbers, symbols, capital and lowercase letters, and other special characters. SMEs should require their employees to have strong passwords and change those passwords consistently to prevent credential theft.

If employees have trouble remembering complex passwords, a password manager can help to create, store and even fill in passwords. 

Cybersecurity Habit #2: Make VPNs Widely Available 

Wi-Fi networks in offices are typically secure, encrypted, and hidden. Nevertheless, if you have a virtual private network (VPN), you can use it to help protect data if your employees are working remotely. In simpler words, when working outside of the office or on a business trip, a VPN is a must.

Public Wi-Fi networks can be dangerous, putting your data at risk of interception. However, keep in mind that some VPNs are more secure than others. If your company uses a VPN, make sure your employees understand how to connect to it and use it.

Cybersecurity Habit #3: Use Multifactor Authentication 

When you try to access sensitive network areas, your employees must use multi-factor authentication. MFA adds an extra layer of security by requiring you to log in with at least one additional step, such as providing a temporary code sent to your employee’s email or smartphone. You can also use Google Authenticator for this purpose. Enable MFA on critical applications such as O365 or Salesforce.

Cybersecurity Habit #4: Stay Alert For Social Engineering Attacks 

Phishing, whaling, and other similar social engineering attacks aim to steal your sensitive data and information. So here’s a rule to remember: 

Avoid providing personal or company information in response to unsolicited email, malicious webpage, or other forms of communication. It can result in identity theft and ransomware attacks. Employing email authentication layers that block suspicious emails can help your company. 

Organizing Tips into Training: How to Educate And Prepare Your Employees 

Changing habits requires constant education and a consistent effort. It takes time and reinforcement to ensure that your employees buy into and understand the value of a strong security culture. 

Smart businesses have to invest in their employees’ education. Knowing your employees are fully across and adopting your company’s cybersecurity policies and expectations is part of your responsibility. However, when it comes to SMEs and startups, cybersecurity training and education are often overlooked because they believe they are not a target, and often get deprioritized or not addressed at all. 

Guess what? 43% of the cyberattacks throughout 2020-21 targeted SMEs. 

Why? SMEs are unprepared. They typically lack a mature security infrastructure, and no formal training and education programs are in place. Their employees are vulnerable and they lack the resources to invest in training. So, it should be of no surprise that almost half of the cyberattacks that occur target SMEs. 

But where do you begin if you’re  lacking the human and financial resources to accomplish a comprehensive security awareness training program?

Who leads the effort?

Although IT is always at the helm of Security Awareness programs, SME leaders should take advantage of their size and closeness between departments and create multi department groups to handle the subject. Different perspectives from techies and non-techies build more robust policies and programs. 

Security awareness should start small 

All small businesses should begin small and grow from there. SMEs should identify the most critical vulnerabilities such as: are employees using personal devices to work? Is email communication central to the operation? How tech-fluent is the workforce? Even if not wholly accurate, a preliminary assessment is a starting point to focus the efforts. 

Start training your employees on policies and procedures

The first step in building a secure network is to ensure that your employees know the security policies and procedures. Creating the first drafts of the documentation and engaging the workforce through training is a great starting point. In addition, companies should schedule refresher training on a yearly or semi-annual basis to keep security at the forefront of your employees’ minds.

Focus on security awareness programs 

SMEs must invest in security awareness training to ensure that their employees understand the importance of updating software, following security best practices, and knowing what to do if a security breach occurs. Several options are available for SMEs in the market, including free tools to start the conversation (like Right-Hand’s Cyber Fitness Challenge) as the organization builds the structure to invest in formal Security Awareness training solutions.

Final Words

Cybercriminals have been quick to take advantage of the less-than-ideal conditions of home working over the last two years. Therefore, businesses should act quickly to put robust and long-term cybersecurity measures in place. In addition, companies should also begin investing in employee training to build a strong cyber defense.

Remember: The size of your firm does not matter. If you’re conducting any kind of business in this digital age, you are a target – so it’s best to always be cyber-ready!

Effective cyber hygiene practices simply require employees to follow good daily security routines that help mitigate against the most common threats. Be cognizant that these routines are much more challenging to enforce remotely.

Not only are home-working networks less secure than office networks, but there is also less monitoring of employees’ work habits, resulting in poor password choices and data backup failures being far more common. So, begin educating and training your employees today!

You can always talk to SolCyber to find out more about how you can improve your security resilience across your organization.