Basic cybersecurity principles do not have to involve complicated tools or an extensive list of technical requirements.
For most businesses, a strong cybersecurity program begins with a few basic principles that reduce everyday risk and make it harder for attackers to gain access to important systems and information.
The challenge is making sure those basics are actually in place across the entire business, not just assumed to be.
Use Strong Passwords and Multi-factor Authentication
Passwords are still one of the most common ways employees access business systems, which makes password security an important starting point.
Employees should use long, unique passwords for email, banking portals, and accounting software rather than reusing the same password across multiple systems. A password manager makes this easier to maintain without relying on memory.
Multifactor authentication, or MFA, adds another layer of verification before access is granted. Even if a password becomes compromised, MFA can help prevent someone from immediately logging into a Microsoft 365 account or a VPN connection.
Keep Systems and Software Updated
Software updates are not only about adding new features.
Many updates include security patches that address known vulnerabilities. When computers, browsers, accounting software, and firewall firmware are left outdated, those vulnerabilities remain available for attackers to take advantage of.
Businesses should have a clear process for identifying updates, testing them when necessary, and installing critical security patches within a defined window, such as 30 days, rather than whenever someone gets around to it.
Give Employees Only the Access They Need
Not every employee needs access to every file, system, or application.
A marketing employee generally doesn’t need administrative rights to accounting software, and an office coordinator doesn’t need access to HR personnel files. Access should be based on what someone needs to perform their role.
Access should also change when an employee moves roles, and a departing employee’s email, VPN, and shared drive access should all be removed the same day they leave.
Regularly reviewing permissions, for example once a quarter, can help identify accounts that have accumulated access they no longer need.
Back Up Important Business Data
Backups are an important safeguard against ransomware that encrypts a file server, hardware failure, and accidental deletion.
However, simply having a backup does not automatically mean your data is protected. Businesses should know:
- What information is being backed up, such as client records and financial documents
- How often backups run, whether that’s nightly, hourly, or continuously
- Where backups are stored, including whether a copy exists off-site
- Whether backups are regularly tested by actually restoring a file or folder
The most important question is whether the business could successfully restore a specific client’s files, or an entire server, within a timeframe leadership would consider acceptable.
Protect Business Devices
Laptops, desktops, phones, servers, and other devices can all provide access to company information, including the laptop an employee takes home or the phone they use to check email after hours.
Businesses should have basic protections in place such as antivirus or endpoint security, automatic screen locking, device encryption, and clear policies on how company devices should be used, including on personal networks.
Remote employees and mobile devices should be included in the same security planning, especially since a lost or stolen laptop is one of the more common ways a device ends up outside the business’s control.
Train Employees on Common Cybersecurity Risks
Employees interact with email, websites, files, and passwords every day.
Basic cybersecurity awareness can help employees recognize a suspicious invoice email requesting a change to payment details, an unexpected MFA prompt they didn’t trigger, or an attachment from someone they weren’t expecting to hear from.
Training should be ongoing enough that cybersecurity becomes part of normal business operations rather than something employees hear about once a year and forget.
Employees should also know exactly who to contact, whether that’s an IT provider or an internal manager, when something does not look right.
Know What Technology Your Business Is Using
It is difficult to protect systems you do not know exist.
Businesses should maintain an accurate understanding of their devices, software subscriptions, cloud apps, and vendors with system access.
This becomes especially important as employees sign up for a free trial of a new app without looping in IT.
Knowing what is in your environment makes it easier to identify risks, remove outdated systems nobody is using, and plan ahead for things like replacing an aging server.
Create a Plan Before Something Goes Wrong
Businesses should know what they would do if an employee’s email account were compromised, a ransomware attack encrypted the file server, or a laptop with client data on it was lost.
A basic incident response plan should identify who needs to be contacted, what systems are most important to restore first, and how decisions would be made.
The middle of a cybersecurity incident is not the ideal time to decide who is responsible for what.
Start With Basic Cybersecurity Principles
Cybersecurity can become complex, but the foundation should not be.
Strong passwords, MFA, updates, backups, appropriate access, secure devices, employee awareness, and clear planning can address many of the risks businesses face every day.
The next step is making sure those protections are consistently implemented and regularly reviewed as the business changes.
If you are not sure whether your cybersecurity basics are fully covered, RBS IT can help you review your current environment, identify gaps, and determine what should be addressed first.
Want practical technology and cybersecurity tips delivered to your inbox? Sign up for our Tech Tips.
Ready to take a closer look at your IT and security? Schedule a time to talk with our team.
