New Business Cybersecurity Baseline
Building basic security controls into your business plan from day one is significantly easier - and less costly - than retrofitting security systems after a business has been in operation for a while. Here are some ways to establish a more secure operational baseline.
First 30 Days: Essential Setup Checklist
1. Secure Business Email
There is current debate on whether a website is a "must have". Regardless of your decision on building a site, you will most certainly need professional email support. Dedicated business email account providers allow you to turn on protections that:
- assure those receiving your emails that the email was really sent by you,
- the email content was not changed in transit and
- you can find out who sent bogus emails using your email address.
Avoid generic free accounts (think gmail, yahoo, etc), which do not allow you to set security.
2. Multi-Factor Authentication (MFA)
Enforce MFA on every initial business account—starting immediately with your email administrator, main business bank account, and accounting suite.
[For more information: See TOPICS-Topic 1: Passwords, Multi-Factor Authentication & Account Access in Security Topics]
3. Device Encryption & Passphrases
As a business, you will be working with several kinds of data: public, company confidential and protected by law. Turn on full-disk encryption (BitLocker for Windows or FileVault for Mac) on every new computer.
Enforce long passwords (more than 15 characters) or passphrases instead of short passwords for account logins.
4. Automated 3-2-1 Backups
Configure automated daily backups. Backups are important...really important. It is easy to forget to run one. An automated backup process assures you that your data is always backed up.
You should always have 3 current copies of data - the actual working data, an onsite backup and an offsite backup. Offsite can be cloud-based. Onsite backup should only be connected during the backup. Encrypting the backup for offsite provides added protection.
Have a plan to test backups by restoring a folder and files, at least bi-monthly.
Setting Up Your Initial Infrastructure
When launching operations, focus on these core safeguards:
- Protect Devices From Electrical Outage and Surge: The Kittanning area is known to have brief power outages. Use surge protectors to protect devices like printers and FAX machines. Use the additional protection of UPS to protect computers and monitors.
- Separate Guest & Work Wi-Fi: Keep client, visitor or public Wi-Fi on an isolated, restricted guest network.
- Standard User Accounts: Create non-admin, standard user accounts for daily use. Use Administrator accounts strictly for system updates, software installations and other administrative functions.
- Payment Verification Rules: Establish a mandatory phone-call verification rule for any request to change any vendor billing arrangement. This also applies to unexpected invoices from vendors.
Reviewing Your Startup Security Plan?
You do not need to know everything about cybersecurity. You need to know how to protect the accounts, devices, and data your business depends on.
Use the Contact form for any specific questions.