While the threat of cyberattacks will never be eliminated, small- and medium-sized businesses in Baton Rouge can adopt good cyber-hygiene practices to mitigate their risk of exposure.
That’s according to three Louisiana cybersecurity experts who, during a webinar hosted this morning by Business Report, discussed specific ways employers can protect their businesses—as well as their clients and customers—from cyberattacks.
Following a brief presentation delivered by Jeffrey Moulton, president and CEO of Stephenson Technologies Corp., a panel discussion took place that also included Duane Barnes, CTO of RapidScale, a COX Business Company, and Bill Bradley, an executive-in-residence at Louisiana Tech University and retired CenturyLink executive.
“It’s up to each individual to manage their digital exhaust,” Moulton said. “When convenience trumps privacy, you lose.”
Check out some of the questions asked to the panel, paired with their responses, which have been edited for space and clarity.
What are the basic security measures that every small business should employ, and what are the legal requirements for protecting against a cyberattack?
Duane Barnes: Make sure you have an email security solution. There are a ton out there—Proofpoint, Mimecast, Enterprise Vault—and they have a very low cost per user. One of those alone will protect employees from clicking on links they probably shouldn’t be clicking. From a legal perspective, you may have to notify all your customers if there was a breach. There could also be fines levied by PCI or HIPPA. Most importantly, though, a company’s brand and reputation goes down the tube after a breach, and it could cause you to go out of business.
Bill Bradley: Spend some time learning what phishing looks like and make sure your employees are trained in it. Some attacks are pretty obvious, with misspelled words or calling you by a title that doesn’t belong to you, but they’re becoming more sophisticated. If you have a password you’re using regularly that’s more than two years old, change it, and make your password longer and more complex. There are some good password managers that can help with that, some of which are built into browsers. And wherever possible, turn on two-factor authentication, which typically means sending a text to a phone number you’ve given that validates you are who you say you are.
Jeff Moulton: There are five things every small business should do: 1) ensure every device uses some sort of antivirus software, 2) limit remote access, 3) educate your staff, 4) insist your employees use work devices only for work, and 5) have a strong password—bigger is better, multi-character is better.
With a greater number of employees working remotely and using home internet/WiFi to log into company devices and networks, what should every employer require of its remote workforce to limit exposure to hackers?
DB: Either a corporate-owned device, or a very strong bring-your-own-device policy, where endpoint management is installed on that device, and having it centrally managed by an internal or outsourced IT professional. If you limit your remote access to only devices the company has approved, that’s a huge improvement.
JM: You must have a VPN (virtual private network) and multifactor authentication. Don’t let people connect to your network. If you don’t have the resources to do that, consider an outsourced option.
What’s your collective advice for a small business owner who doesn’t have the money for an IT department or a comprehensive system?
DB: You’ll be in a far better spot in your provider’s hands than you would be doing it yourself. You can quickly get three references from peers in your industry and chambers of commerce. Interview them, and go with your gut when selecting one.
BB: Pick one who specializes in small business cybersecurity.
JM: Prevent this from happening by mitigating your risk. Understand data flow, get cybersecurity insurance, have a business continuity plan, an instant response plan, and know full well that you’re going to have this issue at some point in the future, so plan for it.
