Build routines around cybersecurity

October is Cybersecurity Month, a time for businesses of all sizes to focus on risks posed by bad actors on the internet. Threat awareness is a critical defense; so is vigilance. How do small businesses with limited IT resources maintain a close eye year-round on possible breaches and other forms of cyberattack?

The risk is real. Small businesses are far from immune from cyberattack; many perpetrators see them as appetizing targets. According to one industry observer, 43% of all cyberattacks target small businesses; in the last year they experienced four times as many breaches as did large enterprises. “Cybercriminals target small businesses more than any other type of company because they often hold valuable data yet maintain weaker security.” 

How can responsible business owners make the most of limited resources to avoid this growing threat? By prioritizing security in their daily lives and using quieter times to focus on perimeter gaps.

One plan for action centers on a common, indeed elementary tool for any business: a calendar. Mark out times of the year to focus on specific cybersecurity functions so you have a built-in framework for protection.

The FCC recommends special care be taken with customer data; urging businesses “establish rules of behavior describing how to handle and protect customer information and other vital data.” Are these rules in place, and are they being clearly communicated and observed? Make time on the calendar to confirm this, then correct it if needed.

Think about using the early part of the year to recheck access levels on your business network or WiFi. Are you giving too much access to employees whose work responsibilities don’t require it? Is your WiFi open to people outside your business because it is not properly secured?

Changing passwords regularly also matters; this includes cloud services which have become increasingly popular targets in recent years. Damage from ransomware attacks also can be significantly lessened by making data backups more routine.

Do the people who work for you understand what to do if a breach in your network is detected? Drills are seldom fun but they can be added insurance against worst-case scenarios down the road. Often a breach can be contained effectively if only people know how to respond when one is detected. 

Drills not only ensure people know their roles and responsibilities; they help determine if your cyberattack response plan is optimal, or if key steps are being overlooked.

Other types of yearly checklist items can include data backup routines, scheduling yearly password updates and performing firewall maintenance.

One specific cybersecurity risk for small businesses involves the use of third-party software. Even when the software itself can be trusted, security gaps are created over time when the programs are not updated.

Letting time elapse when there are available vendor patches available for key programs is a highly avoidable risk. But some businesses neglect this fact. “Too many organizations still treat it as a disruptive burden instead of a built-in business function.” 

While not all small business networks have firewalls, many do; keeping these updated is critical to enjoying optimal protection from your investment. Some small businesses, especially those pursuing growth strategies, deploy managed services where critical firewalls are monitored and updated by a trusted technology partner.

Timely intervention can prevent the snowball effect in the use of unmonitored network and network-adjacent technology. The key is to carve out time in your calendar, or that of your IT specialist, to make sure the right updates are happening.

In addition to following cybersecurity best practices like the above, business owners should consider the value of deploying “always on” protections such as Spectrum Business Security Shield, included with eligible Spectrum Business internet service.

By providing an additional layer of protection that works automatically in the background, Security Shield can reduce risks to a business that does not have a dedicated cybersecurity staff. It helps block access to known malicious websites, phishing destinations and other internet threats.

These are just some ways small businesses can promote a more diligent mindset internally to avoid or at least mitigate the growing threat of online attacks.