No business is too small not to be a target by cyber criminals. Therefore, being knowledgeable of the cyber security best practices for small businesses in Kenya will greatly help protect any company from the risk of cyber-attack. Moreover, we have highlighted a framework which will any company to reduce the risk of cyber-attack. All these cyber protection best practices have not only protected companies from losses occasioned by disrupted service delivery but have also brought savings in time and money.
Cyber security best practices for small businesses
Software protection
Company software remain a key entry point for cyber-attacks. And do you protect your software from such vulnerabilities? Keeping company software updated will help close all the backdoors that might facilitate attackers in their mission. Company software include computer operating systems, word processing applications, payroll software etc. All these software should be updated regularly and if possible allow automatic updates.
File protection
All important company files should be backed up and kept in a safe storage. External hard drives can be used for offline backup. Also, backups can be kept in the cloud. Cloud backup works well as part of the disaster planning and business continuity strategy. Thus, should an attack happen the offsite backup will provide something for the company to start over with.
Password protection
Every device used at the work place should be password protected. Apart from servers and internet wireless access points, laptops, tablets and smartphones should have passwords. When the device is protected by password, even data and files kept inside will be protected.
Apart from passwords, all devices containing sensitive company information should be encrypted. Encryption should be extended also to cloud storage so that access should only be allowed to specific people with the decryption keys.
Multi factor authentication
Having provided password protection for devices, it is also important to introduce multifactor authentication. Therefore, before any successful login, the user will be required to enter password plus an OTP code. This way, it will be difficult to execute illegal logins even if that person has the correct password.
Wireless network protection
Wi-Fi network security definitely begins at the router level. The first step will be to change the out of box username and password for the router device. Most people prefer not to change the default logins details for ease of remembrance. However, this practice pose a great risk to a company’s network resources.
Also, remember to disable the remote management. However, remote management can be enabled only when a secure link such as VPN has been made available to protect such activity. When the router is protected, even the telephony infrastructure including the IP PBX phone system will be protected.
Staff training
Most cyber-attacks are successful because most employees are not made aware that such threats exist. The only way to create cyber security awareness is through staff training. Therefore a session should be arranged whereby employees will get trained and made aware of the cyber security basics for small businesses. Consistent staff training will help in creating a culture of responsible use of IT devices and install IT security in the company. Most importantly, employees should be updated whenever risks are identified and vulnerabilities pointed out.
Password use guideline
Guidelines should be provided for creating strong passwords. For example, a password with at least 12 characters containing a mixture of both capital and lowercase letters, special characters and numbers will generally be considered strong. And, the passwords should not be shared whether on email or via text message. Passwords should not written on notebooks or sticky notes either. Lastly, applications and software requiring password for logins should have a maximum number of allowable unsuccessful login attempts.
Best Practice Cybersecurity framework
Classify the IT resources
Use the updated asset register to identify and classify the IT assets that require protection. These include laptops, desktops, tablets, servers, printers, etc. Each employee assigned a device must be informed of their personal responsibility towards upholding IT security standards set. Every stakeholder should be aware of the how to handle sensitive company data and actual step in reporting suspected breach.
Protection of the IT resources and devices
Another one of the most important cyber security best practices, is the installation of network security software. Installing a good network firewall will protect the gateway against intrusion. Then, installing an endpoint protection software will protect all endpoint within the corporate network e.g., desktops, tablets, laptop etc. In addition to the installation of the security, regular back up of important files should be encouraged. Also, there should clear protocols for disposing of old IT equipment and eraser of no longer necessary company data.
Detection of an attack
Because there is a system in place for monitoring network activities, detecting an attack activity will be easy. Common network monitoring system include endpoint protection software. When the endpoint security software detects abnormal application behavior or device activity, the system administrator gets notified. Suspicious behaviors include unauthorized login or installation of a potentially unwanted application.
Response to an attack
Immediately an attack is detected, the affected endpoints should be isolated. The immediate isolation of affected endpoint from the corporate network will help in stopping the rapid spread of the malware or ransomware attack. With isolation, even the structured cabling and networking infrastructure will be kept safe. Some of the activities at the response stage include; stopping the attacks, neutralizing the threat, and investigation of the cause. Also, at this point firewall protection policies will have to be updated. Policy updates will generally help in hardening the router or the gateway against future attacks.
Recovery from a cyber-attack incident
Following a successful cleanup, the previously isolated endpoints should be restored back to the network. A report should be prepared and shared with disaster recovery team. The post attack report should highlight vulnerabilities areas identified and steps taken to ensure there will be no successful attacks attempts in future. Furthermore, a successful recovery should be communicated too all stakeholders e.g. employees, management team and customers. Also very critical cyber security best practices.
The importance of physical security can never be overstated, access control systems and the CCTV cameras.
Main advantages for passwordless authentication
Better user experience
Be that as it may, most users actually hate having to remember a password whenever about to log in to a system. Biometric authentication comes to solve the inconveniences caused by the need to save passwords for future use. With biometric authentication users will no longer be required to memorize login credentials for various systems.
Maintenance of password
Ideally, all systems require that passwords be updated every so often. That is, every 3 months a system user will be required to update the access credentials. This requirement can be time consuming and can also impact negatively on performance. However, when passwords get eliminated, there will be no need for frequent password updates. Because the biometric credentials captured will forever remain unique to each system user.
Strong security
Password protected systems tend to be vulnerable to hacking attacks. Unlike password protected systems, systems with biometric authentication tend to have stronger security. No need to save passwords on browser applications for automatic future logins.
Perfect for social engineering
System users and colleagues at work tend to share passwords due to various reasons. Password reuse can be a major security loophole even for very stable systems. Thus, password less authentication now remains one of the most reliable methods for tacking social engineering. Also, with biometric authentication, the team in charge of security can gain control and the much needed visibility into the system. Therefore, password less authentication is a very important access management tool.
Are you a victim of cyber-attack in Kenya? Is your company a past victim of ransonmware or persistent malware attacks? Contact us today for an effective cybersecurity strategy that not only protects you from losses but also saves you money and time.
