Editor’s note: Martin Morgan is Marketing Director at WingSwept.
GARNER – The massive global ransomware attack that hit recently affected more than 1,000 companies across the world and could cost tens of millions of dollars. We still don’t know the full extent of the damage it caused.
For small and mid-sized businesses across the Triangle, this is the latest wake-up call in what’s becoming a long list of high-profile cyber attacks. Here are six things SMBs should do now to protect and prepare their company for future attacks:
1. Understand where your risks are. Ransomware is coming. Hackers may have already tried to compromise your company through phishing emails or other attack vectors. No matter the size of your company, telling yourself you won’t be a target is no longer plausible. Who and what has access to your network and your data? Consider employees, vendors, systems and software. Document all of the people and things that have access and then reconsider if they need the level of access they have. Implement the principle of least privilege. Make sure your users have training on how to avoid phishing attacks.
2. Take inventory of everywhere you are storing data. Where is your most sensitive data stored? If you had to, could you close access to it? Document where all your data is being stored and then rank it by sensitivity so that if you were under attack you could take steps to close down access to your most sensitive data first. Make sure your data is being backed up. Consider implementing the 3-2-1 backup rule – three copies of your data across two different systems with one copy stored offline.
3. Make physical copies of phone trees and important contact information. If you suddenly lost access to all of your files, would you be able to reach the people you need to reach immediately? Document their contact information and print it out.
4. Use a next generation antivirus tool. Next gen antivirus uses machine learning and artificial intelligence. Look into your current antivirus tool. If it’s not considered next generation switch to one that is.
5. Layer your security. Don’t just stop at antivirus. Modern security requires defense in depth. Every layer gives you a chance to protect your most important data. Use multi-factor authentication. Use a firewall and DNS level security. Create or update your password policy to be more stringent. Train your employees. Utilize network threat detection and security information and event management (SIEM) tools. Don’t forget physical security.
6. Conduct due diligence on any potential technology vendor. Put them through a vetting process just as much as you would a banker or other mission critical vendor. Ask them about the software they use, any recent compromises they may have had, and recent holes discovered. Think twice before putting in an exclusion in your antivirus to run software.
If a vendor tells you that you need to put an exclusion in your antivirus to run their software, then you should find another vendor.
As a small or mid-sized business it can be easy to be overwhelmed by the many things you are told to do to protect your organization from cyber attacks. By following the six tips included here you can establish a strong foundation of security and preparation that will serve you well now and allow you to build on it going forward.
WingSwept is a B2B technology services company headquartered in Garner, North Carolina with an additional office in Chantilly, Virginia. Visit www.wingswept.com for more information.