Week 3: Best practices for protecting your business: a comprehensive security checklist
If it's not already, cybersecurity should be a major concern for everyone using the internet, but particularly for business owners. If you run a business, it's not something you can put to the back of the (no doubt) massive pile of stuff you have to do. Why, you ask, as you stare at your never-ending task list? Because the time you spend now on putting a cybersecurity action plan in place, will be absolutely crucial should your business face a threat.
This week, we look at the areas that are important for you to address to strengthen your defences against threats. In next week's article, we'll tie this all together by providing a comprehensive guide on how to create an incident response plan. But today, let's take a look at the key areas you need to address to keep your business secure.
1. Password Management
Strong passwords are fundamental to your security strategy. Brute Force is a hacking method that uses trial and error to crack passwords, login credentials, and encryption keys. The longer your password is, the harder it is for this type of technology to crack it. Password best practices:
- Use unique, complex passwords for all of your accounts. Long passwords are super important because shorter ones are far easier to crack. They should be a minimum of 12-15 characters. If something is extremely sensitive, the longer the better.
- Do not reuse the same password for different accounts. Why? Because if a hacker gets hold of one, they've now got access to multiple accounts with the same password.
- Implement a password manager for your organisation such as LastPass. Don't write your passwords down where someone can find them.
- Enable two-factor authentication (2FA) for whatever asks for it, particularly using an Authenticator app as text messaging options are far less secure.
- Change your passwords regularly, at least every 3-4 months.
- Avoid using easily guessable information in passwords such as birthdays or number sequences.
2. Software Updates and Patch Management
Keeping your software current and up to date is extremely important for maintaining security. We recently highlighted this in an article about updating to Windows 11. If you have outdated systems that are no longer supported, you are opening yourself up to more threats:
- Enable automatic updates for all software and operating systems.
- Regularly check for and install updates on all devices.
- Larger organisations might want to implement a patch management system.
- Replace software that's no longer supported by the manufacturer. Our article on why you must update your Windows 10 systems to Windows 11 by October 2025 is a great example of why this is so important. In short, software and operating systems that are no longer supported by the manufacturer are a huge security risk.
3. Network Security
Businesses frequently transmit sensitive information over networks, such as personal details, financial records, and intellectual property. Network security measures help to prevent this data from falling into the wrong hands. You should be looking at protecting your network in the following ways:
- Use a firewall to monitor and control network traffic.
- Encrypt your Wi-Fi network and hide the network name (SSID).
- Change your Wi-Fi password periodically.
- Use a Virtual Private Network (VPN) for remote access.
- Segment your network to limit access to sensitive data.
4. Employee Training and Awareness
When 90% of breaches occur due to human error, it is so important to build a culture of cybersecurity within your organisation. Understanding what you need to do and then developing a plan to implement it is one thing, but you must ensure that your team are informed about their role in keeping the business safe.
- Conduct regular, engaging cybersecurity awareness training. It can be a dry topic for many people so try to keep it interesting. Find a provider that provides some good, engaging security training.
- Teach employees to identify and report phishing attempts. This is such a common one for staff because so many people don't know how to spot phishing emails, and as we saw in previous articles, these are getting more sophisticated, especially now with the use of AI.
- Implement clear policies for handling sensitive data.
- Educate staff on the risks of using public Wi-Fi.
- And to drive it home: foster a culture of security awareness in the workplace. This isn't just on you, the business owner.
5. Data Backup and Recovery
Protect your data against loss or ransomware attacks:
- Implement a regular backup schedule.
- Store backups in multiple locations, including off-site.
- Test your backup and recovery process regularly.
- Encrypt sensitive data, both in transit and at rest. Microsoft 365 OneDrive is a great example of doing just this with your files.
6. Access Control
Limit access to sensitive information. Make this based on need-to-know. This means if staff change roles where they no longer require a certain access - remove it:
- Implement the principle of least privilege. This means giving users only the minimum access requirements necessary to perform their required tasks.
- Use role-based access control (RBAC). These assign access rights based on job roles, simplifying your role in managing this.
- Regularly review and update access permissions. Periodic audits of user access rights help maintain security and compliance over time.
- Implement a process for revoking access when employees leave. Having a clear offboarding procedure prevents former employees from retaining access to sensitive systems.
7. Incident Response Plan
Be prepared for potential security incidents. If you haven't prepared, put a response plan in place and installed any security measures, should a threat occur it would be chaos. Steps to mitigate this scenario:
- Develop and document an incident response plan (we will show you how to do this in next week's article).
- Assign roles and responsibilities for incident response so everyone knows what they're doing in the event of a threat and can take immediate action.
- Conduct regular drills to test your incident response plan. If you work in an office, you likely have regular fire drills, right, so everyone is reminded what they need to do in the event of a fire? Think of it a bit like a virtual version of that.
- Have a communication plan for notifying stakeholders in case of a breach. Clear, open and regular communication is very important in protecting the integrity of your reputation, your brand and your continued success.
8. Third-Party Risk Management
Don't overlook the security of your vendors and partners:
- Assess the security practices of all third-party vendors. Failing to do so could lead to data breaches through your vendors, potentially exposing your sensitive business information and customer data to hackers.
- Include security requirements in contracts with third parties. Clearly outline your expectations for data handling, breach notification procedures, and compliance with relevant regulations to protect your business legally and operationally. Without these contractual safeguards, you may be held liable for data breaches caused by your vendors, resulting in severe financial and reputational damage to your business.
- Regularly review and audit third-party access to your systems. Implement a schedule for periodic access reviews and conduct surprise audits to verify that vendors are adhering to agreed-upon security protocols and only accessing necessary information. Neglecting these audits could allow unauthorized access to persist, potentially leading to data theft, system compromises, or compliance violations that could cripple your business operations.
9. Physical Security
Remember that cybersecurity isn't just digital:
- Ensure only those who need to can access servers and workstations. Use key cards or biometrics to control physical access.
- Implement a clean desk policy. This prevents sensitive info from being visible to unauthorised eyes.
- Properly dispose of old hardware and sensitive documents. Use secure shredding and data destruction to prevent anyone stealing sensitive information from the rubbish bin.
10. Stay Informed
Cybersecurity is a rapidly changing field:
- Stay updated on the latest cybersecurity threats and trends.
- Join industry groups or forums to share knowledge.
- Consider engaging with a managed security service provider (MSSP) for ongoing support.
By putting this all into practice you will have taken important steps to significantly enhance the cybersecurity of your business. Remember, effective security is an ongoing process that will require regular commitment, attention and updates, and ensuring a culture of security among your staff. Don't wait until a threat occurs to have nothing in place. Act now.
If you're a bit lost with all this, that's totally understandable. At Red Eagle Tech we can help you to secure your systems. Contact us today.
