8 Steps to More Effective Small Business Security
Small business face the same security challenges as large enterprises but with much smaller security teams. Here are 8 things to do to get the most from yours.
April 8, 2019
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc2529188463ddb08/64f0d461c7f14b02954e5b8d/Image_1.jpeg?width=700&auto=webp&quality=80&disable=upscale)
Big cybersecurity challenges aren't limited to large organizations. Small and medium-sized organizations are subject to the same vulnerabilities, exploits, and attacks that plague multi-national enterprises. Unfortunately, these smaller organizations don't have the same resources as the big companies to use to defend themselves. That's why it's critical that small organizations make the most of the cybersecurity resources they do have.
Constraints on small business security resources aren't limited to finances. Small organizations also have smaller security teams or, in most cases, a team of IT generalists who deal with security as part of their responsibilities. And while technology can be part of maximizing that small team's effectiveness, technology alone can't turn a small team of generalists into a large team of specialists.
That doesn't mean that the small business situation is hopeless. When technology is deployed in support of well-considered policies developed through a thoughtful process, then small businesses can achieve a practical level of security that is as effective as that of larger organizations. The question, then, is which processes and policies will have the greatest impact.
[Want to see how other small IT teams have handled their security challenges? Check out sessions like "No CISO, No SOC, No Problem: Blocking Bigger Threats with Smaller Teams" and "When (and When Not) to Use a Managed Security Service Provider" at Interop19 in Las Vegas, May 20-23.]
The eight steps listed here aren't meant to be taken one at a time like steps on a path. The first is a good place to start but after that they represent things that a small team should do — and can do — to get the most out of the security resources they have to work with. And these steps aren't meant to be an exhaustive list of things to be done. We'd be interested to know which things you've found critical aren't on our list — and whether there are any items on this list that you think are over-rated. Let us know in the comment section.
(Image: duncanandison VIA Adobe Stock)
Ransomware is a wonderful tool for stress-testing the effectiveness of a small organization's backup and recovery processes. But it shouldn't take a catastrophic attack to convince a small security team to be active in ensuring that even the smallest company has a robust backup and recovery program in place.
There are scores of packages available for backing up and recovering data from laptop and desktop computers along with the servers and cloud services that make up the modern business IT infrastructure. The key difference in effectiveness is whether an organization has the discipline to maintain those routines, protect the backup copies, and practice restoration on a regular basis.
The reasons for a robust backup and recovery process extend beyond security to business recovery and continuity. For small security teams or companies with IT generalists handling all tasks, the security implications should add urgency to developing a solid process and convincing company management that it must be rigorously followed.
No matter the size of the business, it's a given that more work is being done on mobile devices, and therefore an effective small-team security plan must take mobile devices into account.
Mobile security has several facets. The devices themselves must be protected from malware, the business information on them must be protected from unauthorized access, and the device's access to business systems must be controlled. For the small security team, these can seem daunting, but in fact there are free, low-cost, and communication-provider supplied answers to each of the challenges.
The precise combination of tools will depend on a number of factors (from device to communications provider, to systems that the devices will connect to). The important thing for the small security team is that these small devices not be taken lightly. Mobile devices help define the new enterprise perimeter; they can't be left out of security plans.
Big cybersecurity challenges aren't limited to large organizations. Small and medium-sized organizations are subject to the same vulnerabilities, exploits, and attacks that plague multi-national enterprises. Unfortunately, these smaller organizations don't have the same resources as the big companies to use to defend themselves. That's why it's critical that small organizations make the most of the cybersecurity resources they do have.
Constraints on small business security resources aren't limited to finances. Small organizations also have smaller security teams or, in most cases, a team of IT generalists who deal with security as part of their responsibilities. And while technology can be part of maximizing that small team's effectiveness, technology alone can't turn a small team of generalists into a large team of specialists.
That doesn't mean that the small business situation is hopeless. When technology is deployed in support of well-considered policies developed through a thoughtful process, then small businesses can achieve a practical level of security that is as effective as that of larger organizations. The question, then, is which processes and policies will have the greatest impact.
[Want to see how other small IT teams have handled their security challenges? Check out sessions like "No CISO, No SOC, No Problem: Blocking Bigger Threats with Smaller Teams" and "When (and When Not) to Use a Managed Security Service Provider" at Interop19 in Las Vegas, May 20-23.]
The eight steps listed here aren't meant to be taken one at a time like steps on a path. The first is a good place to start but after that they represent things that a small team should do — and can do — to get the most out of the security resources they have to work with. And these steps aren't meant to be an exhaustive list of things to be done. We'd be interested to know which things you've found critical aren't on our list — and whether there are any items on this list that you think are over-rated. Let us know in the comment section.
(Image: duncanandison VIA Adobe Stock)
About the Author(s)
You May Also Like
CISO Perspectives: How to make AI an Accelerator, Not a Blocker
August 20, 2024Securing Your Cloud Assets
August 27, 2024