Protecting Your Business From a Data Breach

Improve Overall Security

Cybersecurity for a small business does not have to be complicated, but you need dedicated IT support — whether it's an employee, department, or external vendor — and the architecture should fit your business's needs. Here are a few best practices that every business should follow to protect themselves, their customers, and their data:

Install software updates as soon as they're available. Protect sensitive information, computers, and networks from cyberattacks by installing the most current security software, operating system, and web browsers. This is one of your best defenses against malware, viruses, and other online threats.

• Set up a firewall for your internet connection and keep it updated. A firewall is a security system designed to prevent unauthorized access to your private network from the outside. If you have remote employees, ensure they can only access your private network through a secure VPN.
• Limit access to data and information — a security principle called Least Privilege. Sensitive data should only be available to employees who require access to perform their job duties. If your business has 40 employees, but only four need access to all data systems, you can reduce your vulnerability to your employees by 90%.
• Control physical access to computers. Create individual accounts and passwords for each employee and ensure screens are locked when not attended. Encrypt laptops and physically secure them when left unattended. Require strong passwords and implement 2-factor authentication.
• Establish a secure WiFi network. Keep your WiFi network secure, encrypted, and hidden from public broadcast. Password-protect access to your router. If you have a retail space, set up a separate guest WiFi for your customers.
• Use best practices on payment processing systems. Do not process payments with the same computer you use to surf the internet. Ensure third-party vendors employ the most trusted, validated anti-fraud services.
• Regularly back up important business data. With ransomware attacks, hackers block your access to data. Set automatic backups, if possible, and keep regular backups available off the network, so they aren't exposed to ransomware. 

Train Employees

According to Forbes Business Council, 95% of data breaches result from human error.² A cybersecurity plan cannot be successful if your employees aren't participating in best practices. Establish basic security policies and procedures for all employees and train them regularly. Here are a few areas to review with staff:

• Email behavior: Firewalls cannot protect you from all threats because many infiltrate your network through email. Clicking malicious links can install malware that infects a computer, possibly spreading to the rest of your network. Regularly review email threats with your employees, conduct test emails to check awareness, and implement external warnings on emails coming from outside the organization.
• Data protection: Establish rules for protecting customer data, restricting how sensitive information can — and cannot — be sent. Remind employees not to leave data on their screen when it's not needed and to lock their screen when leaving their workstation. Never leave printed records in plain view and secure them when unattended.
• Passwords: Require strong passwords and implement a regular password reset. Consider implementing a multifactor authentication beyond the password for access to systems.
• Peripherals: USB drives are popular devices for transferring data from one computer to another. However, this also makes them appealing to cybercriminals. A drive containing malware plugged into a computer will infect that computer. Restrict use of USB drives or disable USB ports.
• Mobile devices: Mobile phones and tablets carry their own set of dangers. The simplest way to keep your network secure is to prohibit employees from plugging their mobile device into their computers or connecting to the company WiFi. Install mobile device security software on their personal devices if they have access to company information, like email.

Steps to Take if a Data Breach Occurs

Establish a data breach response plan for your business. If a data breach occurs despite your best efforts, you will need to act quickly. Though the response will vary from case to case, here are the basic steps you'll want to follow:

1. Assess. Analyze which systems were impacted, who had access to the infected systems, and which networks were active when the breach occurred. Try to determine the severity of the breach by learning which information was targeted.
2. Contain. Once you know what systems were impacted, mobilize a team for the response and secure systems and physical areas that may be related to the breach. Involve your IT team and any vendors that may have software connected with the breach. Try to limit the breach's impact on new systems but know that changing the system or turning it off may destroy evidence that would be needed for use later in a prosecution or to aid in future recovery.
3. Notify. Based on your incident response policies, laws, and regulations, notify applicable employees, law enforcement, vendors, and customers. Most states require customer and regulator notification with specific timelines. Consult with legal counsel to determine how to best communicate with the appropriate parties that a breach has occurred.

A data breach is costly in so many ways. It damages a business's reputation and costs time, money, and customers. Preventing a data breach is an ongoing endeavor. Hackers are continually looking for new ways to steal data, so your best chance at prevention is to keep your systems up to date, frequently reevaluate your security measures, and keep your employees trained. If you work proactively, you have the best chance of avoiding a breach and are in a better position if one occurs.

¹ https://www.forbes.com/sites/forbesbusinesscouncil/2021/07/30/how-to-prevent-a-data-breach-in-your-company/?sh=24236ce318da
² https://www.forbes.com/sites/forbesbusinesscouncil/2021/10/08/compliance-score-alone-wont-keep-your-company-safe-from-data-breaches/?sh=2c7df77547a9

If you wish to comment on this article or have an idea for a topic we should cover, we want to hear from you! Email us at editor@texell.org(opens in a new window)(opens in a new window).