There's often a tacit sense of accomplishment when something once on the margins goes mainstream – mobile payments, cutting the cord, home automation, that kind of thing.
\r\nCyberattacks are an exception. It's not that they haven't gone mainstream – they have, with a vengeance – but there's zero satisfaction in their newly entrenched status. While technology providers are obviously on the hook, mainstream businesses, particularly small businesses, aren't mere bystanders.
\r\nA handful of recent headlines underscore the point. \"Hacks are affecting everyday life … cyberattacks on supply chains, governments and financial institutions are bad for not only those directly affected but also customers, suppliers and residents,\" said a recent CNBC report, citing tax delays and canceled home sales among the \"costly ripple effects\" of porous cybersecurity.
\r\nIn that same vein, a Kaspersky Lab report indicated that companies moving to the cloud \"still ignore security concerns – 9 in 10 cloud breaches occur due to employee mistakes.\" And Dror Liwer, in his article for business.com, pulled no punches describing the peril of cyber complacency, suggesting cyberattacks on small and midsize businesses could trigger a \"trickle-up recession.\"
\r\nA major cloud-based payroll software provider suffered a crushing ransomware attack earlier this year, taking down payroll management services for hundreds of the company's customers over a three-day period. Faced with the threat of an extended outage, provoked by a destructive strain that encrypts computer files and demands payment for a digital key needed to unscramble the data, the company paid the ransom and began restoring service. The target organization's reach was significant, touching payroll service bureaus that cater to small businesses nationwide. Payroll customers, in turn, were beside themselves. While one key provider was battling pneumonia, everyone else caught a cold.
\r\n[Are you looking for the right internet security solution for your business? Check out our reviews and best picks.]
\r\nThe fact is, in cyberspace, everyone's ox is (potentially) gored. An estimated 60% of companies have experienced a hack of some kind. That being the case, it behooves every business to take cloud security seriously, for the greater good. Cyber engagement is no longer an option but a requirement. Small businesses need to have each other's backs. They need to defend themselves against things they didn't do and that were not personally directed at them. They need to be good stewards by implementing policies and practices that acknowledge what is almost a fiduciary duty to the market at large – a tough pill to swallow, given the rough-and-tumble nature of everyday competition.
\r\nPractically speaking, what does it mean for an SMB to be a good steward in this brave new cyber world?
\r\nCompanies can start by becoming familiar with online threats and at least somewhat conversant with tools to arrest them – no single system can circumvent vulnerabilities that haven't been patched. Still, there are things that businesses can and should do to maximize their safety and, indirectly, make the cloud a more secure place in which to compute.
\r\nYou might think of these as steps – concentric circles, really – for SMBs on the road to good stewardship:
\r\nThe human element remains the most important social engineering piece of this construct. It's always best to stop a problem early, before it festers and productivity suffers (think smoke detectors versus sprinkler systems).
\r\nThere's no quick fix, but there are fixes. High-profile companies need to take cloud security seriously, not just for themselves and their users, but for just about everyone. One misstep by one well-placed player can easily overlap and affect others. Everyone needs to treat user data with respect or risk ripples with untold consequences.
\r\nCorporate responsibility – what companies owe their stakeholders, whoever they may be – is the embodiment of enlightened self-interest. By holding itself to a higher standard than just getting by, an organization generates goodwill, cements customer relationships and, to an extent, inoculates itself against trouble down the road. \"Cybersecurity activism,\" for lack of a better term, isn't a marketing strategy but, instead, is central to this \"good stewardship\" mindset. Case in point: Every organization needs to have some kind of business continuity plan, whether that plan is simple or complex – a plan that provides a course of action when the worst of the worst happens.
\r\nCybersecurity is but one bullet point in that plan. Disaster recovery shouldn't be treated as a siloed task, a matter of too little encryption, porous firewalls or some other technology-driven glitch that, once fixed, doesn't actually move the business any closer to seamless operations. Business continuity is all-encompassing, full stop. Every organization should be in the business of mitigating risk.
\r\nBecause cybersecurity is of the moment, its value lies partly in raising awareness among companies that haven't fully thought about the big picture, of which cybersecurity is simply an element.
\r\nSo what does your plan look like? In the event of a quake or a hurricane, do you have a way to restore your business processes, not just your data? How do users function? How do you serve customers? Can you answer the phone? Can you continue to sell your services even after the event? If your employees can't work, where's the continuity?
\r\nThe astute way to frame this discussion is to think of the gestalt of the cloud, not of the roles of the various actors (innocent, complacent, negligent, etc.). Any platform or environment succeeds only to the extent that users/stakeholders trust it. Responsibility for fostering trust isn't \"out there\" with the IT or tech support; it rests with rank-and-file users.
\r\nThat's why every company doing business in the cloud (that is, off-premises, remotely) needs to understand that failing to arrest breaches harms the business community as a whole. The fiduciary mindset is the right response to hacks and ransomware and cyberattacks, because it affirms that everyone has skin in the game. Indeed, users are central to the security model. Users, not techies, deserve an informed, even sophisticated, approach to the seemingly mundane practice of opening (or not opening) emails and attachments.
\r\nThe strangely good news is that technology won't save us. What will save us are changes in attitude and awareness. Both are more powerful than policies and procedures. Responsible cybersecurity means small businesses are in this together. This is top-down, bottom-up and side to side – enough to shake us all awake.
\n","docType":"article","guid":"articles_f3b16dc5674100b06e1293cbe2c526a3","lastModified":"2019-08-20T12:00:00.000Z","published":"2019-08-20T12:00:00.000Z","structuredData":null,"subtitle":"Every small business should be invested in cybersecurity.","template":"v1","title":"Cybersecurity Activism: A Wake-Up Call for Every Small Business Owner","type":"article","author":{"avatar":null,"bio":"Stern is an entrepreneur who saw the value of virtualization and cloud computing nearly a decade ago. Stern’s company helps businesses move from obsolete hardware investments to an IaaS [Infrastructure as a Service] cloud platform, providing them the flexibility and scalability to transition select data operations from in-house to the cloud. Stern established Infinitely Virtual in 2007 to provide virtual dedicated server solutions to growing enterprises, offering what was essentially a cloud computing platform before the term existed. Infinitely Virtual is a subsidiary of Santa Monica-based Altay Corporation, which Stern founded in 2003 to provide Windows, VMware and other service solutions to the SMB market.","name":"Adam Stern","image":null,"slug":null,"social":{"facebook":"https://www.facebook.com/infinitelyvirtual/","linkedin":"https://www.linkedin.com/company/infinitely-virtual/","twitter":"https://twitter.com/iv_cloudhosting","website":"http://www.infinitelyvirtual.com/"},"status":"enabled","title":null,"type":"New BDC Member","user":{"imagePath":"https://staging.business.com/images/uploads/user/profile/2af4ad03576e3ba2cb637491915997ee362a8.jpg","profile":{"company":"Infinitely Virtual","jobTitle":"Owner/Founder","website":"http://www.infinitelyvirtual.com/"}}},"breadcrumbs":null,"channels":{"primary":{"name":"Technology","slug":"technology"},"sub":{"name":"Security","slug":"security"}},"meta":{"robots":"index, follow","description":"Small business owners must adopt a fiduciary mindset when it comes to cybersecurity.","title":"SMB Owners Must Also Be Cybersecurity Advocates - business.com"},"parsedContent":{"toc":[{"id":"cyberattacks-are-increasing-and-their-effect-is-widespread","title":"Cyberattacks are increasing and their effect is widespread"},{"id":"business-owners,-small-and-large,-need-to-be-vigilant-and-united-against-online-threats","title":"Business owners, small and large, need to be vigilant and united against online threats"},{"id":"business-continuity-needs-to-be-part-of-every-smbs-cybersecurity-plan","title":"Business continuity needs to be part of every SMB's cybersecurity plan"},{"id":"the-bottom-line","title":"The bottom line"}],"json":[{"component":"p","children":["There's often a tacit sense of accomplishment when something once on the margins goes mainstream – mobile payments, cutting the cord, home automation, that kind of thing. "]},{"component":"h2","props":{"id":"cyberattacks-are-increasing-and-their-effect-is-widespread"},"children":["Cyberattacks are increasing and their effect is widespread"]},{"component":"p","children":["Cyberattacks are an exception. It's not that they haven't gone mainstream – they have, with a vengeance – but there's zero satisfaction in their newly entrenched status. While technology providers are obviously on the hook, mainstream businesses, particularly small businesses, aren't mere bystanders."]},{"component":"p","children":["A handful of recent headlines underscore the point. \"Hacks are affecting everyday life … cyberattacks on supply chains, governments and financial institutions are bad for not only those directly affected but also customers, suppliers and residents,\" said a recent ",{"component":"a","props":{"href":"https://www.cnbc.com/2019/05/26/wolters-kluwer-baltimore-ransomware-attacks-have-big-ripple-effects.html","target":"_blank","rel":"nofollow"},"children":["CNBC report"]},", citing tax delays and canceled home sales among the \"costly ripple effects\" of porous cybersecurity."]},{"component":"p","children":["In that same vein, ",{"component":"a","props":{"href":"https://usa.kaspersky.com/about/press-releases/2019_nine-in-ten-data-breaches-in-the-cloud-caused-by-social-engineering-finds-kaspersky-lab","target":"_blank","rel":"nofollow"},"children":["a Kaspersky Lab report "]},"indicated that companies moving to the cloud \"still ignore security concerns – 9 in 10 cloud breaches occur due to employee mistakes.\" And Dror Liwer, in his ",{"component":"Link","props":{"href":"https://www.business.com/articles/small-business-cybersecurity-concerns/"},"children":["article for business.com"]},", pulled no punches describing the peril of cyber complacency, suggesting cyberattacks on small and midsize businesses could trigger a \"trickle-up recession.\""]},{"component":"p","children":["A major cloud-based payroll software provider suffered a crushing ransomware attack earlier this year, taking down payroll management services for hundreds of the company's customers over a three-day period. Faced with the threat of an extended outage, provoked by a destructive strain that encrypts computer files and demands payment for a digital key needed to unscramble the data, the company paid the ransom and began restoring service. The target organization's reach was significant, touching payroll service bureaus that cater to small businesses nationwide. Payroll customers, in turn, were beside themselves. While one key provider was battling pneumonia, everyone else caught a cold."]},{"component":"p","children":[{"component":"strong","children":["[Are you looking for the right internet security solution for your business? Check out our ",{"component":"Link","props":{"href":"https://www.business.com/categories/best-antivirus-and-internet-security/"},"children":["reviews and best picks"]},".]"]}]},{"component":"h2","props":{"id":"business-owners,-small-and-large,-need-to-be-vigilant-and-united-against-online-threats"},"children":["Business owners, small and large, need to be vigilant and united against online threats"]},{"component":"p","children":["The fact is, in cyberspace, everyone's ox is (potentially) gored. An estimated 60% of companies have experienced a hack of some kind. That being the case, it behooves every business to take cloud security seriously, for the greater good. Cyber engagement is no longer an option but a requirement. Small businesses need to have each other's backs. They need to defend themselves against things they didn't do and that were not personally directed at them. They need to be good stewards by implementing policies and practices that acknowledge what is almost a fiduciary duty to the market at large – a tough pill to swallow, given the rough-and-tumble nature of everyday competition."]},{"component":"p","children":["Practically speaking, what does it mean for an SMB to be a good steward in this brave new cyber world?"]},{"component":"p","children":["Companies can start by becoming familiar with online threats and at least somewhat conversant with tools to arrest them – no single system can circumvent vulnerabilities that haven't been patched. Still, there are things that businesses can and should do to maximize their safety and, indirectly, make the cloud a more secure place in which to compute."]},{"component":"p","children":["You might think of these as steps – concentric circles, really – for SMBs on the road to good stewardship: "]},{"component":"ul","children":[{"component":"li","children":[{"component":"strong","children":["The first line of defense "]},"– The first line should consist of perimeter technologies: a firewall supported by intrusion detection and prevention software; antivirus and antimalware software, which is limited to blocking items downloaded over unencrypted protocols; and anti-DDoS (distributed denial-of-service) software."]},{"component":"li","children":[{"component":"strong","children":["The second line of defense "]},"– The second line comprises patch management and locally installed antivirus and antimalware software, working together to effectively block attacks. Proper implementation of second-line defense methods means fewer bugs and optimized performance. "]},{"component":"li","children":[{"component":"strong","children":["The third line of defense "]},"– The third line centers on the trained, educated user who is sufficiently cognizant of threats to think before executing a link or downloading an attachment – a user who, in other words, is attuned to the real and present danger inherent in viruses and malware, and acts accordingly. "]},{"component":"li","children":[{"component":"strong","children":["The fourth line of defense"]}," – Obvious as it may seem, the fourth line involves a good backup strategy. As part of that strategy, it's essential to install application-consistent snapshot technology, a rollback process that takes just minutes and restores the server to its exact state prior to the attack."]}]},{"component":"p","children":["The human element remains the most important social engineering piece of this construct. It's always best to stop a problem early, before it festers and productivity suffers (think smoke detectors versus sprinkler systems)."]},{"component":"p","children":["There's no quick fix, but there are fixes. High-profile companies need to take cloud security seriously, not just for themselves and their users, but for just about everyone. One misstep by one well-placed player can easily overlap and affect others. Everyone needs to treat user data with respect or risk ripples with untold consequences."]},{"component":"p","children":["Corporate responsibility – what companies owe their stakeholders, whoever they may be – is the embodiment of enlightened self-interest. By holding itself to a higher standard than just getting by, an organization generates goodwill, cements customer relationships and, to an extent, inoculates itself against trouble down the road. \"Cybersecurity activism,\" for lack of a better term, isn't a marketing strategy but, instead, is central to this \"good stewardship\" mindset. Case in point: Every organization needs to have some kind of business continuity plan, whether that plan is simple or complex – a plan that provides a course of action when the worst of the worst happens."]},{"component":"h2","props":{"id":"business-continuity-needs-to-be-part-of-every-smbs-cybersecurity-plan"},"children":["Business continuity needs to be part of every SMB's cybersecurity plan"]},{"component":"p","children":["Cybersecurity is but one bullet point in that plan. Disaster recovery shouldn't be treated as a siloed task, a matter of too little encryption, porous firewalls or some other technology-driven glitch that, once fixed, doesn't actually move the business any closer to seamless operations. Business continuity is all-encompassing, full stop. Every organization should be in the business of mitigating risk. "]},{"component":"p","children":["Because cybersecurity is of the moment, its value lies partly in raising awareness among companies that haven't fully thought about the big picture, of which cybersecurity is simply an element."]},{"component":"p","children":["So what does your plan look like? In the event of a quake or a hurricane, do you have a way to restore your business processes, not just your data? How do users function? How do you serve customers? Can you answer the phone? Can you continue to sell your services even after the event? If your employees can't work, where's the continuity? "]},{"component":"p","children":["The astute way to frame this discussion is to think of the gestalt of the cloud, not of the roles of the various actors (innocent, complacent, negligent, etc.). Any platform or environment succeeds only to the extent that users/stakeholders trust it. Responsibility for fostering trust isn't \"out there\" with the IT or tech support; it rests with rank-and-file users."]},{"component":"p","children":["That's why every company doing business in the cloud (that is, off-premises, remotely) needs to understand that failing to arrest breaches harms the business community as a whole. The fiduciary mindset is the right response to hacks and ransomware and cyberattacks, because it affirms that everyone has skin in the game. Indeed, users are central to the security model. Users, not techies, deserve an informed, even sophisticated, approach to the seemingly mundane practice of opening (or not opening) emails and attachments. "]},{"component":"h2","props":{"id":"the-bottom-line"},"children":["The bottom line"]},{"component":"p","children":["The strangely good news is that technology won't save us. What will save us are changes in attitude and awareness. Both are more powerful than policies and procedures. Responsible cybersecurity means small businesses are in this together. This is top-down, bottom-up and side to side – enough to shake us all awake."]}]},"resource":null,"sponsorship":null,"thumbnail":{"path":"https://staging.business.com/images/content/5d5/5bd8e5a215ee8348b4573/1500-0-","caption":"PabloLagarto/Shutterstock","isBlurred":false},"bestPicks":null},"related":{"relatedArticles":[{"title":"Decoding the Hierarchy of Data Protection","canonical":"https://www.business.com/articles/data-protection-hierarchy/","slug":"data-protection-hierarchy","thumbnail":"https://www.business.com/images/content/5ad/e2b331039eba5148b456a/1500-0-","dek":"What are your options for protecting your data and how do you decide on a strategy?","lastModified":"2018-04-23T19:00:00Z","published":"2018-04-23T19:00:00Z","sponsored":false},{"title":"Cloud Encryption: Using Data Encryption in The Cloud","canonical":"https://www.business.com/articles/cloud-data-encryption/","slug":"cloud-data-encryption","thumbnail":"https://www.business.com/images/content/5d0/8eac17b437482458b4578/1500-0-","dek":"Data security remains a top concern in cloud adoption.","lastModified":"2018-07-03T12:10:00Z","published":"2018-07-03T12:10:00Z","sponsored":false},{"title":"How to Assess the Cybersecurity Risk of Your Small Business","canonical":"https://www.business.com/articles/assess-small-business-cybersecurity/","slug":"assess-small-business-cybersecurity","thumbnail":"https://www.business.com/images/content/5ed/118db7b437422298b4576/1500-0-","dek":"Security risk profiles can help quantify cybersecurity risk.","lastModified":"2020-06-03T13:41:00Z","published":"2018-06-15T13:30:00Z","sponsored":false},{"title":"Endpoint Protection vs. Anti-Malware: What You Need to Know","canonical":"https://www.business.com/articles/endpoint-protection-vs-anti-malware-business/","slug":"endpoint-protection-vs-anti-malware-business","thumbnail":"https://www.business.com/images/content/5ad/527d892a3a45a3e8b4592/1500-0-","dek":"Learn which cybersecurity solution is best for your business.","lastModified":"2017-04-17T12:00:00Z","published":"2017-04-17T12:00:00Z","sponsored":false},{"title":"The Small Business Case for a Culture of Cybersecurity","canonical":"https://www.business.com/articles/proactive-cybersecurity-approach/","slug":"proactive-cybersecurity-approach","thumbnail":"https://www.business.com/images/content/5ba/102ba92a3a4905b8b4572/1500-0-","dek":"Cybersecurity isn’t just a small IT function — it’s a key part of the business foundation.","lastModified":"2018-09-18T13:51:00Z","published":"2018-09-18T13:51:00Z","sponsored":false},{"title":"How to Select the Right Encryption Key Management Solution","canonical":"https://www.business.com/articles/encryption-key-management-considerations/","slug":"encryption-key-management-considerations","thumbnail":"https://www.business.com/images/content/5b3/b6aae92a3a480118b457d/1500-0-","dek":"Encryption key management is a necessary component of effective data protection.","lastModified":"2018-07-03T12:06:00Z","published":"2018-07-03T12:06:00Z","sponsored":false},{"title":"8 Important Cybersecurity Measures for Small Businesses","canonical":"https://www.business.com/articles/cybersecurity-measures-for-small-businesses/","slug":"cybersecurity-measures-for-small-businesses","thumbnail":"https://www.business.com/images/content/5dc/867c77b43740d048b4567/1500-0-","dek":"Data theft is still a major headache though massive strides are being made to curb this menace. Security starts with you.","lastModified":"2019-11-11T14:00:00Z","published":"2019-11-11T14:00:00Z","sponsored":false},{"title":"Prepare for the Worst: How to Create a Cyber Security Incident Response Plan","canonical":"https://www.business.com/articles/prepare-cyber-security-incident-response-plan/","slug":"prepare-cyber-security-incident-response-plan","thumbnail":"https://www.business.com/images/channel/technology.jpg","dek":"Effective CSIR Plan is an essential aspect of organizations in data governance strategy to make aware about current security readiness.","lastModified":"2016-01-13T19:00:00Z","published":"2016-01-13T19:00:00Z","sponsored":false},{"title":"Bolster Your Data Security Strategy with Intelligent Data Loss Prevention Software","canonical":"https://www.business.com/articles/dlp-software-data-security/","slug":"dlp-software-data-security","thumbnail":"https://www.business.com/images/content/5b8/035861039eba87e8b4569/1500-0-","dek":"Data is your business's most valuable asset.","lastModified":"2018-08-24T07:00:00Z","published":"2018-08-24T07:00:00Z","sponsored":false},{"title":"5 Tips for Developing a More Secure IoT Policy for Your Organization","canonical":"https://www.business.com/articles/developing-a-more-secure-iot-policy/","slug":"developing-a-more-secure-iot-policy","thumbnail":"https://www.business.com/images/content/5a8/320ed51ee478b128b4568/1500-0-","dek":"Eliminate vulnerabilities, strengthen your data and protect your business.","lastModified":"2018-02-13T08:00:00Z","published":"2018-02-13T08:00:00Z","sponsored":false},{"title":"SMEs and Cybersecurity Challenges: A Wakeup Call","canonical":"https://www.business.com/articles/small-business-cybersecurity-myths-and-challenges/","slug":"small-business-cybersecurity-myths-and-challenges","thumbnail":"https://www.business.com/images/content/5ab/3dc3a51ee47aa3f8b45a6/1500-0-","dek":"When it comes to cyber attacks, organizations of all sizes remain at risk.","lastModified":"2018-03-22T16:55:00Z","published":"2018-03-22T16:55:00Z","sponsored":false},{"title":"Biometrics and the Future: What It Means for Small Businesses","canonical":"https://www.business.com/articles/biometrics-facial-recognition-small-business/","slug":"biometrics-facial-recognition-small-business","thumbnail":"https://www.business.com/images/content/5ad/744c11039eb027a8b4599/1500-0-","dek":"Biometrics are popping up everywhere. Find out why it's good for business.","lastModified":"2018-04-19T12:40:00Z","published":"2018-04-19T12:40:00Z","sponsored":false}],"relatedReviews":[{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df908cc5a215e8c4a8b4568/conferencecall_Antonio_Diaz_Getty.jpg","canonical":"https://staging.business.com/categories/best-conference-call-services/","title":"The Best Conference Call Services of 2021","dek":"Which conference call service is right for your business in 2021? We review the top-rated services.","slug":"best-conference-call-services","lastModified":"2021-03-17T18:17:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5e00d4787b43745d6a8b456e/Laptop_undrey_getty.jpg","canonical":"https://staging.business.com/categories/employee-monitoring-software/","title":"The Best Employee Monitoring Software of 2021","dek":"We've narrowed down the best employee monitoring software for businesses. Check out our best picks and reviews.","slug":"employee-monitoring-software","lastModified":"2021-03-05T15:40:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df905909c658a7e538b4567/Faxing_junce_Getty.jpg","canonical":"https://staging.business.com/categories/online-fax-services/","title":"The Best Online Fax Services of 2021","dek":"Online fax services are growing as more companies divest from conventional fax machines in favor of an automated, scalable and cost-effective option. Here's a look at some of the best online fax services on the market. ","slug":"online-fax-services","lastModified":"2021-03-02T16:07:00Z"}],"relatedSponsoredArticles":null}},"pageContext":{"displayModified":"2019-08-20T12:00:00.000Z","template":"v1","title":"Cybersecurity Activism: A Wake-Up Call for Every Small Business Owner","meta":{"robots":"index, follow"},"docType":"articles","slug":"cybersecurity-activism-for-smbs","canonical":"https://staging.business.com/articles/cybersecurity-activism-for-smbs/","skipTOC":false}},"staticQueryHashes":[]}