Cybersecurity for Small BusinessesThis self-paced training exercise provides an introduction to securing information in a small business. Topics include: Defining cybersecurity; Explaining the importance of securing information through best cybersecurity practices; Identifying types of information that should be secured; Identifying the types of cyber threats; Defining risk management; and Listing best practices for guarding against cyber threats.Course ObjectivesThe course has six key objectives:Define Cybersecurity.Explain the importance of securing information through best cybersecurity practices.Identify types of information that should be secured.Identify types of cyber threats.Define risk management.List best practices for guarding against cyber threats.Course TopicsThis course will address four areas, defining the importance of information security and what you can do to keep your information safe:What is cybersecurity?Why is cybersecurity so important?What are common cyber threats and crimes?How do I determine my level of risk?What can I do to protect my business?Numerous additional resources are identified to assist you. Visit the resource icon in the course player or locate additional tools, templates, and mentors on SBA.gov once you finish the course.Let’s get started!BackgroundCybersecurity is the comprehensive effort to protect computers, programs, networks, and data from attack, damage, or unauthorized access through technologies, processes, and best practices. Large businesses have been working to secure their information and systems, so small businesses are becoming more common targets because they have fewer resources than large companies have. Do you have information that needs to be secure? Consider:Personal information for employeesPartner informationSensitive information for customers/clientsFinancial and sensitive business informationInformation needs to be secured in your systems. This means the information that should be kept confidential should be available when needed, and should be kept as accurate as possible. Your website also needs to be secure in order to prevent putting current or potential customers at risk.Aspects of Information SecurityThere are several different aspects of information security, including confidentiality, integrity, and availability.Some considerations for confidentiality include: only those who need access to information, and have been properly trained on cyber security, should have it, especially when the information is sensitive. Training people in cyber security prevents security breaches when those who are authorized accidentally disclose information. Your goal should be to ensure information is not disclosed to non-authorized people.Considerations for integrity include making sure your information is not improperly modified or destroyed. If you maintain information integrity, no one will be able to claim your information is inaccurate.Last is availability. Your information should always be available to you quickly and reliably.Security CostsIt is important to remember that there are costs for protecting information; there are also costs for not protecting information, which will be covered later in the risk topic.The costs for not protecting information can be much higher than those associated with protecting it. These costs could be associated with notifying victims that their information has been released, which can be very costly, both in terms of perception and litigation. You can lose customers who have lost confidence in your business after a security breach. Depending upon the type of business you have, you may have to payfines for not maintaining information security compliance. You may also have to reconfigure or replace hardware and/or software.Threat OriginsWhile there are multiple threats to information security including natural disasters and systems failure, most threats have a human at their origin. We will focus on the threats with human origins.Threats can be internal and external. Examples of external threats include experimenters and vandals, who are Amateur hackers, hactivists who have personal or political agendas, cybercriminals who are trying to make money, and information warriors who are professionals working for nation-states.Despite the broad range of external threats, internal threats account for 80% of security problems according to the National Institute of Standards and Technology, or NIST. Internal threats can be intentional or unintentional and can include issues such as non- business use of computers which can allow threats in.Types of ThreatsThere are a broad range of information security threats. Some of the most common threats include website tampering, theft of data, denial-of-service attacks, and malicious code and viruses.Website TamperingWebsite tampering can be a very big problem for your business. Website tampering can take many forms, including defacing your website, hacking your system, and compromising web pages to allow invisible code, which will attempt to download spyware to your computer.Select each item to learn more.Theft of DataData theft also comes in several forms and the problems that come with data theft depend upon the kind of data that is stolen. Some examples of data theft include:Theft of computer filesInappropriate access to computer accountsTheft of laptops and computersInterception of emails or internet transactionsPhishing emails that trick you into giving away personal informationSpear phishing emails that deceive a specific group of people into respondingIdentity theftDenial of Service AttacksA denial-of-service attack is an attack on a computer or website which locks the computer and/or crashes the system and results in stopped or slowed workflow, prevented communication, and halted eCommerce. Some common ways that attackers achieve denial-of-service attacks include:Volumetric attacks, which attempt to use all available bandwidth and slow or stop performance andTCP State-Exhaustion Attacks, which cause problems with things like firewalls and application serversThe ultimate goal of these attacks is always to prevent you from conducting business of any kind with your internet connected systems.Malicious Code and VirusesMalicious Code and viruses may be some of the better-known threats. These threats send themselves over the internet to find and send your files, find and delete critical data, or lock up the computer or system. They can hide in programs or documents, make copies of themselves, and install themselves on your system to record keystrokes to send to collection point.Reasons for VulnerabilitiesAll of the threats we have discussed can be very scary. Before we can address how to prevent attacks, we must first investigate the reasons that small businesses are vulnerable to these kinds of attacks.Computer hardware and software is outdated and/or insecurePoor or missing security policies that do not establish security protocols.Missing procedures for securing informationLazy oversightLoose enforcement of existing policiesRiskLet’s talk for a moment about risk management, beginning with risk assessment. Risk assessment is the technique of assessing, minimizing, and preventing accidental loss to a business through the use of safety measures, insurance, etc. Removing all of the risk factors associated with attacks can be costly, but you need to ask yourself, “How much risk can I live with?”Remember that no risk can be completely eliminated. If the consequence and probability of a breach is high, then your tolerance for risk is low. If the consequence is minor, more risk may be acceptable to you. If the risk is still too high after all protection efforts have been made, use commercial cyber insurance to “share” the risk/exposure. Contact your insurance provider to find out what options are available.Protecting Yourself from Human VulnerabilitiesThe first step to protecting the information in your business is to establish security policies. It’s very important that your security policies are comprehensive and up to date. You may have to revise your policies periodically as threats change. The second step to protecting information is ensuring that your employees both know and adhere to your security policies. Remember, most vulnerabilities have a human at their root!Who Needs Training?Determine who will need to know the procedures. Consider:Employees who use computers in their workHelp deskSystem administratorsManagers/executives using specialized softwareSystem maintenanceIT Out-sourcingTraining BasicsYou should train employees in basic security principles, and training should begin the first day at work. Include security policies and procedures, security threats and cautions, and basic security dos and don’ts in your training.Continuing EducationTraining should continue with reminders and tools, including pamphlets, posters, newsletters, videos, rewards for good security, and periodic re-training – because people forget! Lack of training is one of the most significant information security weaknesses in most organizations.Best PracticesWhat should you actually train your employees on? How can you keep you information safe? You should address:Safe internet practicesSafe email practicesSafe desktop practicesInternet PracticesSome best practices to keep in mind when it comes to the internet include:Do not surf the web with an administrative accountDo not download software from unknown pagesDo not download files from unknown sourcesDo not respond to popup windows requesting you to download driversDo not allow any websites to install software on your computerProtect passwords, credit card numbers, and private information in web browsers and conduct online business and banking on secure connectionsPassword manager tools can help you keep track of secure passwords for each site.Email PracticesSome best practices to keep in mind when it comes to email include:Be careful when opening attachmentsDon’t reply to unsolicited emailsDon’t click on links in an emailDesktop PracticesSome desktop best practices include:Use separate computer accounts for each userUse passwords and don’t shareUse screen locking, log on and off, and power down your system at the end of the dayDon’t plug ”lost” infected USB drives into systemsSeriously consider encrypting sensitive data on your system. Try using your favorite search engine online to find encryption tools that will work within your computing environment.Select blue items to learn more.Protecting Your SystemsNow let’s discuss some ways to protect your information. There are several different areas you must consider in order to fully protect yourself.Viruses, Spyware, Trojans, and MalwareIn order to protect yourself against viruses, spyware, trojans, and malware:Install anti-virus softwareCompany-wide detection toolsCompany-wide processAssign responsibility in writingUp-to-date search definitionsInclude employee’s home systems21st century computers are complex and include mobile technology, tablets, and personal computers made by many different companies. These various systems tend to have different threats and often require different software in order to adequately protect against viruses, spyware, trojans, and malware. A basic understanding of your computer may help you protect it. Try searching for information about your particular system.Hardware and SoftwareHardware and software protections require:Secure internet connection and change passwordsChange passwords periodicallyUse software firewallsPatch operating systems and applicationsSecure wireless access pointsBackup ProceduresSome people don’t consider how important backup procedures are for information security. Your goal should be the ability to restore systems and data to what existed before any threat is realized.Make back-up copies of important information and restore weekly. Store a backup copy offsite for safe keeping. You should also test your backups to make sure that they actually work. Also keep in mind the importance of disposing of old computers and media securely. Just because you’re finished with it doesn’t mean someone else can’t use it to get important information about you, your business, or your customers.SummaryThat was a lot of information. In this course you have:Learned what cybersecurity isLearned why cybersecurity is importantLearned about common cybersecurity threats and crimesLearned about risk assessmentLearned what you can do to protect your businessNext StepsNow what should you do? Follow these steps to begin securing your business from cyber threats.Step 1. Conduct an analysis of information security needsStep 2. Assess the cost of losing your informationStep 3. Create a plan to protect your informationStep 4. Implement your plan through policies, training, and hardware and software controls