10 Ways to Keep IT Systems Secure Use these tips to protect your business from hackers, crooks and identity thieves.
By Scott Steinberg Edited by Dan Bova
Opinions expressed by Entrepreneur contributors are their own.
Technology continues to be a boon for entrepreneurs, offering increased mobility, productivity and ROI at shrinking expense. But as useful as modern innovations such as smartphones, tablet PCs and cloud computing are to small businesses, they also present growing security concerns. Following are 10 safety tips to help you guard against high-tech failure:
1. Protect with passwords. This may seem like a no-brainer, but many cyber attacks succeed precisely because of weak password protocols. Access to all equipment, wireless networks and sensitive data should be guarded with unique user names and passwords keyed to specific individuals. The strongest passwords contain numbers, letters and symbols, and aren't based on commonplace words, standard dictionary terms or easy-to-guess dates such as birthdays. Each user should further have a unique password wherever it appears on a device or network. If you create a master document containing all user passcodes, be sure to encrypt it with its own passcode and store it in a secure place.
2. Design safe systems. Reduce exposure to hackers and thieves by limiting access to your technology infrastructure. Minimize points of failure by eliminating unnecessary access to hardware and software, and restricting individual users' and systems' privileges only to needed equipment and programs. Whenever possible, minimize the scope of potential damage to your networks by using a unique set of email addresses, logins, servers and domain names for each user, work group or department as well.
Related: How Small-Business Owners Can Award Against Online Security Threats
3. Conduct screening and background checks. While rogue hackers get most of the press, the majority of unauthorized intrusions occur from inside network firewalls. Screen all prospective employees from the mailroom to the executive suite. Beyond simply calling references, be certain to research their credibility as well. An initial trial period, during which access to sensitive data is either prohibited or limited, is also recommended. And it wouldn't hurt to monitor new employees for suspicious network activity.
4. Provide basic training. Countless security breaches occur as a result of human error or carelessness. You can help build a corporate culture that emphasizes computer security through training programs that warn of the risks of sloppy password practices and the careless use of networks, programs and devices. All security measures, from basic document-disposal procedures to protocols for handling lost passwords, should be second-nature to members of your organization.
5. Avoid unknown email attachments. Never, ever click on unsolicited email attachments, which can contain viruses, Trojan programs or computer worms. Before opening them, always contact the sender to confirm message contents. If you're unfamiliar with the source, it's always best to err on the side of caution by deleting the message, then potentially blocking the sender's account and warning others to do the same.
6. Hang up and call back. So-called "social engineers," or cons with a gift for gab, often prey on unsuspecting victims by pretending to be someone they're not. If a purported representative from the bank or strategic partner seeking sensitive data calls, always end the call and hang up. Then dial your direct contact at that organization, or one of its public numbers to confirm the call was legitimate. Never try to verify suspicious calls with a number provided by the caller.
7. Think before clicking. Phishing scams operate by sending innocent-looking emails from apparently trusted sources asking for usernames, passwords or personal information. Some scam artists even create fake Web sites that encourage potential victims from inputting the data themselves. Always go directly to a company's known Internet address or pick up the phone before providing such info or clicking on suspicious links.
Related: Seven Steps to Get Your Business Ready for the Big One
8. Use a virus scanner, and keep all software up-to-date. Whether working at home or on an office network, it pays to install basic virus scanning capability on your PC. Many network providers now offer such applications for free. Keeping software of all types up to date is also imperative, including scheduling regular downloads of security updates, which help guard against new viruses and variations of old threats.
9. Keep sensitive data out of the cloud. Cloud computing offers businesses many benefits and cost savings. But such services also could pose additional threats as data are housed on remote servers operated by third parties who may have their own security issues. With many cloud-based services still in their infancy, it's prudent to keep your most confidential data on your own networks.
10. Stay paranoid. Shred everything, including documents with corporate names, addresses and other information, including the logos of vendors and banks you deal with. Never leave sensitive reports out on your desk or otherwise accessible for any sustained period of time, let alone overnight. Change passwords regularly and often, especially if you've shared them with an associate. It may seem obsessive, but a healthy dose of paranoia could prevent a major data breach.
The average cost to an organization to recover from such a breach is $6.75 million, according to Javelin Strategy & Research. And that doesn't count damage to your reputation or relationships. So be proactive and diligent about prevention. An ounce far outweighs a pound of cure.
Related: Data Backup and Storage: Should You Stay Local or Go Online?
