October 20, 2022
In addition to visiting the SBA cybersecurity website, business owners might want to review “Protecting Personal Information: A Guide for Business” and “Start with Security: A Guide for Business,” both available on the FTC website.
Risk management is a key component in any successful business plan. In today’s world — where data breaches are common occurrences — it’s especially important for business owners to understand the digital risks they face. Are you doing all you can to mitigate the risk of a cyberattack?
Many small-business owners may think their organizations hold little appeal to hackers due to their small size and limited scope. However, according to the Small Business Administration (SBA), this naiveté may actually make them ideal targets. Small businesses are keepers of employee and customer data, financial account information, and intellectual property. Their systems, if not adequately protected, may also inadvertently provide access to larger supplier networks. “Given their role in the nation’s supply chain and economy, combined with fewer resources than their larger counterparts to secure their information, systems, and networks, small employers are an attractive target for cybercriminals,” reports the SBA on its cybersecurity website.
Consider the following tips compiled from information supplied by the SBA, the Federal Trade Commission (FTC), and the Federal Communications Commission (FCC).
To protect your organization, you must first understand your vulnerabilities. How are your systems protected? Do you collect and store personal information of customers and employees, such as credit card information, Social Security numbers, and birth dates? If so, how is this information stored and who may access it? Do you store it in multiple locations and formats? Are these files password protected and, if so, are you using multiple complex passwords? Do you have Wi-Fi accessible to employees and customers? How do your vendors and other third-party service providers protect their information? You may want to engage a professional to help identify your risks.
When monitoring your security, ensure you have firewall and encryption technology that protects your Internet connections and Wi-Fi networks. Make sure your business’s computers have antivirus and anti-spyware software installed and updated automatically. Require employees and others who access your systems to use complex passwords that are changed regularly. Keep only personal data that you actually need and dispose of it securely as soon as it no longer serves a business purpose. Back up critical information and data on a regular basis, and store the backups securely offsite. Assign individual user accounts to employees and permit access to software and systems only as needed. Be especially cautious with laptops and company-assigned smartphones. Question third-party vendors to ensure that their security practices comply with your standards.
In writing or speaking, redundancy is typically not recommended unless you’re really trying to drive a point home. When it comes to your digital life, however, redundancy is not only recommended, it’s critical. That’s because redundancy means having multiple data backups stored in different locations. Here are some ideas for redundancy when backing up your data:
Cloud storage — using Internet-based service providers to store digital assets such as books, music, videos, photos, and even important documents including financial statements and contracts — has become increasingly popular in recent years. But is it right for you? If a cloud service is one of your backup tactics, be sure to review carefully the company’s policies and procedures for security and backup of its servers. Another good idea is to encrypt (that is, convert to code) to protect sensitive documents and your external drives. Other considerations include:
To help ensure that your employees are also maintaining sound cybersecurity practices, establish clear security policies and procedures and put them in writing. Cover such topics as handling sensitive or personal information, appropriate use of the Internet and social media, and reporting vulnerabilities. Clearly spell out consequences for failing to follow the policies. Develop a mandatory employee training program on the importance of cybersecurity. Explain the basics of personal information, as well as what is and isn’t acceptable to post on social media.
Employees could unknowingly release information that could be used by competitors or, worse, by criminals. Ensure that employees understand the risks associated with phishing emails, as well as “social engineering” — manipulative tactics criminals use to trick employees into divulging confidential information.
For more information, visit the SBA cybersecurity website.
Content in this material is for general information only and not intended to provide specific advice or recommendations for any individual. All performance referenced is historical and is no guarantee of future results. All indices are unmanaged and may not be invested into directly.
The information provided is not intended to be a substitute for specific individualized tax planning or legal advice. We suggest that you consult with a qualified tax or legal professional.
LPL Financial Representatives offer access to Trust Services through The Private Trust Company N.A., an affiliate of LPL Financial.
This article was prepared by Broadridge.
LPL Tracking #1-546955
The content is developed from sources believed to be providing accurate information. The information in this material is not intended as tax or legal advice. Please consult legal or tax professionals for specific information regarding your individual situation. The opinions expressed and material provided are for general information, and should not be considered a solicitation for the purchase or sale of any security.
The LPL Financial registered representatives associated with this site may only discuss and/or transact securities business with residents of the following states: AL, AK, AZ, CA, DC, FL, GA, IN, KY, LA, MI, MO, MS, NC, NV, NY, OH, SC, TN, TX, VA, WA, WI.
Securities and Advisory Services offered through LPL Financial, a Registered Investment Advisor, Member FINRA/SIPC.