Starting From Scratch: How to Build a Small Business Cybersecurity Program – Security Intelligence
When you run a small business, outsourcing for services like IT and security makes a lot of sense. While you might not have the budget for a full-time professional on staff to do these jobs, you still need the services.
However, while it might be helpful to have a managed service provider handle your software and computing issues, cybersecurity for small and medium businesses (SMBs) also requires a personal, hands-on approach. While you can continue to outsource some areas of cybersecurity, every SMB needs to develop an internal cybersecurity program to address the small problems before they escalate into data breaches and other major cyber incidents.
Getting Started With a Cybersecurity Program
You can’t put together a cybersecurity program without knowing what it entails. An information security program is a collection of policies and processes, as well as deploying tools to monitor and protect your company’s data and network assets, explained Patrick Keating, a 20-year security expert, to an (ISC)2 Security Congress audience. Although monitoring and protection services may be something you outsource to a Managed Security Service Provider (MSSP) or to an experienced consultant, you are responsible for defining the processes and policies of your SMB cybersecurity program. You want a program that will “protect the confidentiality, integrity and availability of your company’s data,” Keating advised.
To successfully carry out this process, first, you need to know what your data assets are. Simply said, you can’t protect what you don’t know. Many organizations do not know how much data they accumulate on any given day, what types of data are on hand or where the data is stored.
Next, you need to know what type of security is already in place and what type of technology you are using. How many devices are connected to the network, including IoT and personally owned devices, and how are they protected? For an SMB, it can even come down to knowing what operating systems are used across the company and if they are still under protection. As Keating pointed out, there are a lot of people who think that cybersecurity is simply adding anti-virus software to your computer and maybe your smartphone. While that’s one component of your security program, it’s just one step in the process.
This process can feel overwhelming, but with an expanding threat landscape and a growing number of data privacy regulations, protecting all of your assets is necessary.
Small Business Cybersecurity Framework
According to Keating, the most organized method to begin building a small business cybersecurity program …….