NIST Releases Version of Cybersecurity Framework for Small Businesses Researchers offer a step-by-step approach for covering the basics of cybersecurity.
NIST has been working closely with the Small Business Administration on cybersecurity issues for small business since 2003.
Now, as a follow-up to years of collaboration, NIST recently released a streamlined version of its Cybersecurity Framework geared to small businesses owners.
Released earlier this month, Small Business Information Security: The Fundamentals, runs 54 pages and offers small businesses a snapshot of the core concepts of the framework, which include the following: identify, protect, detect, respond and recover.
Patricia Toth, a supervisory computer scientist and co-author of the report with Celia Paulsen, says the guide came out of numerous workshops NIST held in tandem with the SBA over the past several years.
“We wanted to get some of the main points of the Cybersecurity Framework to the small business audience, but realized that the average small business owner wouldn’t want to pour through the entire framework,” Toth points out.
Frank Dickson, an analyst with IDC who covers security, says the streamlined document NIST put together for small businesspeople does a good job covering the basics of security.
“The only point I would add is that the document stresses strong passwords and while that’s good cyber hygiene, I’d like to see people look more toward stronger authentication,” Dickson says.
Toth adds while stronger authentication makes sense for more mature organizations, the average small business is generally just starting to think about stronger security, so they decided to get people focused on stronger passwords.
Even though it’s streamlined at 54 pages, small business owners may still not know where or how to get started security. Here’s a thumbnail that outlines six steps:
- Manage risk. Small business owners should start by asking what information is most important to the business and what’s essential for them to protect. For example, if a marketing booklet gets leaked it’s probably not as sensitive as if a customer list was exposed.
- Train the staff. Run a lunchtime seminar on how to identify phishing attacks and how to notify suspicious email and report it to the owner. It’s also important for the staff to be aware of the company’s policies on using Facebook, YouTube videos or general Internet browsing time. If there are no policies, then make your wishes known to the staff.
- Stay up to date. Keep in mind there are small businesses with close to 100 employees and those with under 10. For the companies with under 10 employees, they may have a tech person who comes to set up the network, but they don’t always have that person handle software updates and patches. We understand there’s a lot going on at your company and you are focused on sales, but don’t let updates and patches sift through the cracks. Automate as much as possible, but try to do the updates when they come out.
- Run backups routinely. So many small businesses don’t do this and with ransomware as much as a threat as it is today, running offsite backups has become more important than ever. Decide if backups need to be run once a day or once a week, but once a month won’t keep your company safe.
- Investigate cyber insurance. Cyber insurance may or may not be worth it to your company. However, it makes sense to talk to some insurance brokers and see where you stand. Whatever you do, don’t call about cyber insurance without having your security program in place. The rates you pay and how much cyber insurance your company qualifies for will be based on your overall security posture. A ratings system has been evolving and has not been standardized yet, and be prepared to do some homework before asking a broker about cyber insurance.
- Seek out a professional IT company. Even larger small businesses tend to have an IT person or outsourced contractor who comes in and sets up and manages the network. Use business contacts or your trade association to find out technology companies with experience running network security, preferably in your industry if possible. These companies can set up individual password accounts, secure the routers, install firewalls and web filters and explain how the system runs to the owner or the owner’s designated in-house tech person. Too many companies try to go it alone and then complain about spending money on a professional IT company. Don’t be that company. One breach of a prized customer list or sales results that get into the wrong hands and it could cost you your business. Working with professional IT people is well worth the expense, especially in this threat landscape.
Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio