Best Cyber Security Practices for Your Company

••• Getty Images 

Think about your business. Is your most sensitive data totally secure? If it’s not, it’s time to step it up. Take a look at the headlines to see why you should be so concerned about it. Even if you have a small business (opposed to a large enterprise), you could still be targeted by hackers.

So, the question you have to ask yourself is this: How can I protect my company’s sensitive data? Below, you will find 12 things that you can do to make your company safer now and in the future:

1. Create a Risk-Based Approach to Safety

The best approach is the right approach, and reverse engineering based on risk might be it. Too many companies put a lot of focus on compliance (checking off boxes), and they don’t realize that they are keeping their data unprotected. Instead, it’s best to do a risk assessment. You can identify your assets, look at your current security, and then figure out your threats.

2. Create a Cyber Security Policy

Creating a written cyber security policy is important as it serves as a guide for best practices. Of course, it also ensures that everyone at your company is on the same page. A good company-wide security policy is great, but you also might want to allow each department to create their own based on their individual needs.

3. Keep All Software Updated

You also want to make sure that all of your software is always updated. New malware is coming out all of the time, and updates help to protect your network and your machines.

4. Backup All of Your Data

Of course, you also want to make sure that you are backing up all of your data. Though this is a basic security measure, it’s a very important one. A lot of ransomware is designed to take your data hostage, and as you can imagine, that could be devastating to a company.  

5. Only Give Access to Those Who Need It

Many companies, especially small businesses, tend to give all employees access to everything. This, however, could be a huge mistake. The more people you have fiddling around in your network, the higher the odds are that something is going to go wrong. So, it’s best to give people only the access that they require to do their jobs.

6. Always Require Two-Factor Authentication

One of the best ways to protect your staff’s accounts is to use two-factor authentication. With this, in order to get into an account, not only does your employee have to put in a password and user name, but they also have to us a secondary advice, such as a code that is texted to their mobile phone.

7. Keep Passwords Secure

Speaking of passwords, you also want to make sure that you are keeping all of your company passwords secure, and you should teach your staff the same. The most secure passwords are those that contain both upper and lower-case letters, numbers, and symbols and consider a password manager.

8. Change All Default Passwords

Another point to make with passwords has to do with those devices that are part of the Internet of Things, or IoT. These include any device that connects to the internet from your printers and phones to your lights and yes, even sometimes your car. All of these items have default passwords. Do your research and figure out how to change them to keep your information safe.

9. Watch Staff With the Most Access

We already talked about limiting access when an employee doesn’t need it, but you also want to keep an eye on the staff members with the most access. These are often the most dangerous group when it comes to data breaches. Why? Mostly human error, but there are also those wolves in sheep clothing who want nothing more than to gain access to your network.

10. Know Who Is Accessing Your Data

Many companies allow third-parties to work with them remotely. Nothing is inherently wrong with this…until disaster strikes. Just like those rogue employees can wreak havoc on your network, so can rogue employees of third-parties that have access to your information.

11. Watch Out for Phishing

It is also very important to keep an eye out for phishing attempts. One way to do this is to advise your staff to use spam filters. You also want to tell them to NEVER click on a link in their email, even if they think it’s legitimate, or to call the sender first. Additionally, make sure they do not haphazardly give information about the company out via email or phone.

12. Raise Staff Awareness

Engage in phishing simulation training. Finally, make sure that employees are aware of all of this via computer based learning. Even if you have the best cyber security policies in place, if your employees are not aware of them and following them, you are fighting a losing battle.