It hardly ever gets reported on the news that every day hundreds of cyber attacks succeed against small and medium-sized businesses. Learn how to protect yours.

Every week, citizens of the world learn of a large company or government agency suffering a successful cyber-attack. What hardly ever gets reported is the hundreds of cyber attacks that succeed against small and medium-sized businesses. The security issues facing these companies is ever-growing. In 2014,60% of all online attacks were against companies. That same year, the average cost associated with a breach, for additional hardware and software to protect data was $8700. Three years later that cost has risen to nearly 10,000. And, that doesn’t include so-called soft costs such as public relations, credit monitoring for customers, defending against a potential lawsuit, loss of business, and more.

Small & Medium-sized Businesses Attractive to Attackers

While large companies can be more lucrative for cyber criminals, Businesses are often targeted because it is much less work for a cyber criminal to successfully attack a company than a large company. With many attacks on companies, they gain the amount of information with less effort.

On the flip side, Businesses have proactive measures they can take that are the Best IT Security Practices for Business.

Best IT Security Practices for Small and Medium-sized Businesses

Jeff Foresman, a consultant with Rook Security, an Indianapolis-based computer security company noted that many companies don’t understand or are ignorant of the risks facing them from cybercrime or how they can protect themselves.

“They don’t know what they don’t know. They don’t understand the sophistication of these attacks,” Foresman says

Following are five of the most prominent best practices that are easy to implement and highly cost-effective.

Use Firewalls

The Federal Communication Commission (FCC) urges businesses to install excellent firewall protection on company computer systems. Because so many employees work from home, it is an accepted practice to offer or mandate that employees install firewall software on home systems to secure them and the company links and data they have on them.

Password Policy

Develop and publish to employees a password policy that specifies the length and the composition of passwords. Also, the policy should mandate how frequently passwords should be changed.

Two Factor Authorization

2FA is shorthand for two-factor authorization. In addition to a username and password, 2FA uses another authorization factor. It could be a PIN number or a biological marker or even a nearby device. 2FA is quickly becoming the standard for sensitive information and system security.

Mobile Devices

Companies are allowing employees to “Bring Your Own Device” (BYOD) to work or on the road. Establishing clear security policies for BYOD is essential to security efforts. Mandating 2FA on these devices and equipping them with “wipe clean” software that can be activated if a device is lost or stolen keeps your company data safer.

Inform and Educate Employees

Although security starts with top management, all employees need to be educated and informed about the dangers lurking on the internet waiting to attack your company. Employees should never download a link from an unknown email address nor open links or downloads from unknown sites.

You Need Help

Most companies have limited time or staff to address computer system security requirements and keep system security up-to-date. For them, the best solution is a knowledgeable managed services provider (MSP).

{company} in {city} can be reached {phone} or by {email} is such a company. Contact them for more information on computer security.

If you are giving a presentation and part of it involves a shared display or handouts of a spreadsheet what can you do to keep the group awake? Let’s face it, Microsoft Excel is an excellent tool for organizing and manipulating statistical data, but when sharing your spreadsheet with others, your spreadsheet has to be interesting and informative.

How Do I Get More Information into an Excel Spreadsheet?

Before you get more information into your spreadsheet, make sure that a spreadsheet is a right tool for the job. More often than you might think, we use spreadsheets inappropriately. Would an Access database work better? Should you use PowerPoint for your presentation.

If you have decided that Excel is the right vehicle for your presentation, include a text document that is a “welcome” or “about” for the Excel document. This keeps you on track and reminds others what the purpose and mechanics of the spreadsheet are.

While it’s true that most of the spreadsheets we use in our careers are for our own consumption, it is a good practice to talk about your spreadsheet with others. Find out what features they like and which they don’t favor. If you work collaboratively with others in your organization be generous with credit and be sure to mention their names in the about or welcome document.

PivotTables Help (A lot)

PivotTables are important as they take tables of data, often with hundreds if not thousands of rows and help you and others understand the data by summarizing them by the column fields.

For a PivotTable to operate correctly it has to be set up in a certain way; each column needs to contain the same kind of data that is in a “raw” state – that is the data has not been processed yet. The following are some advantages associated with using PivotTables in Excel:

• Simplicity
• Speedily produced
• Multiple dimensions – you can sort data by row or by column
• Allows for interactive analysis

Appearances Do Matter

Your Excel Presentation can be exciting and visually stimulating. Following are some tips that help you accomplish this.

• Consistency: Your spreadsheets will be easier for others to understand if you use only one font, bold headings for data groupings and formulae, distinct shade categories of data (for example shade raw data gray and results in green) and analytical comments should be in italics.
• Create a Logical and Natural Flow: This is done by using the order of Worksheets and the layout of calculations and data to read left to right and top to bottom. An excellent Excel presentation takes the reader through a story – from inputs and assumptions to calculations and finally the results.
• I Want Highly Informative Excel SpreadsheetsMake Data Relevant: To be more informative, an Excel spreadsheet presentation needs to have relevant data and analysis stand out. To do this, try to downplay the non-data elements of your tables and graphs. While you might create axes and gridlines the same color, make them paler than the data points.

{company} in {city} is your best source for tips, tricks, and hacks as well as news relating to the latest advances in technology. {phone} or {email} us today.

As Verizon recently learned as they continue their plans to acquire Yahoo, failing to conduct a cyber security assessment as part of M&A due diligence can be costly; any business considering an acquisition should learn from Verizon’s misstep.  

While companies generally understand the importance of conducting thorough due diligence before agreeing to acquire a target company, this process has often been limited to an investigation of the potential acquisition’s financial and legal information. However, as Verizon Communications recently learned the hard way, failing to conduct a complete cyber security assessment as part of the M&A process can leave major and costly issues hidden, and these undiscovered cybersecurity risks can profoundly affect the value of the acquisition. Businesses considering acquiring another company should learn their lesson from Verizon’s experience and make cybersecurity an integral part of their due diligence process.

Verizon’s acquisition of Yahoo has made business headlines for months, but recently unveiled information about major security breaches and failed cyber security protocols on Yahoo’s part has made the potential deal seem much less attractive. Yahoo announced last month that it faced two huge customer data breaches between 2013 and 2014. This announcement highlighted what many in the industry saw as Yahoo’s poor record on cybersecurity. For example, security certificate company Venafi Labs claims that almost 30 percent of Yahoo’s security certificates are out-of-date by as much as two years. Particularly following a breach, failing to replace certificates flies in the face of mitigation best practices as a company can’t be certain that hackers don’t still have access to secure information with outdated certificates. What’s more, Yahoo is apparently using a hashing algorithm in its security certificates that is widely considered to be insecure, demonstrating that the company failed to learn a valuable lesson on cyber security even after facing two major breaches within two years.

Ultimately, Verizon has decided to move forward with the acquisition, but the offered sales price was heavily discounted to the tune of $350 million to cover the potential legal liabilities resulting from Yahoo’s data breaches. In addition to the possible legal liability, the communications giant will face massive costs trying to bring the company they are acquiring up to standard in terms of cyber security.

The clear lesson from Verizon’s experience is that due diligence on a company’s cyber security protocols must be an essential part of any potential acquisition. Weak cybersecurity procedures and the associated risk can substantially reduce the value of any business, and if the acquiring company misses these issues, the return on their investment can easily fizzle away. However, knowing what to examine when conducting a cyber security assessment of a potential acquisition can be daunting.

So what steps should businesses take regarding a target company’s cyber security protocols before moving forward with any purchase? Bringing in technical consultants and advisors can certainly help in ensuring that no critical issues are missed. In general, several key areas should be examined, including the target company’s data security and privacy policies across all technologies, their record of compliance with appropriate regulations, any information about known breaches, details of contracts with vendors of IT and cyber security services, storage details for sensitive data, physical security of computing infrastructure, and any social media presence.

While it may be tempting to cut corners when conducting a cyber security assessment, remember that failing to do so could not only cost your business dearly regarding its investment; any security risks of the target company could put your stuff at risk following a merger.

Is your business considering undertaking an acquisition of its own but is unsure how to conduct an appropriate cyber security assessment? The expert security team at {company} can help you analyze the full cyber security health of any potential target to help ensure that you avoid acquiring any serious cybersecurity issues. Contact us today at {phone} or {email} to learn more.

Mobile devices can create significant security and management challenges, especially if they hold confidential information or can access the corporate network. Require users to password protect their devices, encrypt their data, and install security apps to prevent criminals from stealing information while the phone is on public networks. Be sure to set reporting procedures for lost or stolen equipment.

Prevent access or use of business computers by unauthorized individuals. Laptops can be particularly easy targets for theft or can be lost, so lock them up when unattended. Make sure a separate user account is created for each employee and require strong passwords. Administrative privileges should only be given to trusted IT staff and key personnel.

Ransomware creates a nightmare scenario for every business it targets. It results in lost access to critical systems and data, prolonged downtime, lost productivity, and lost profits. And as ransomware continues to become more sophisticated, the level of risk small and mid-sized businesses face increases.

The impact to business continuity, productivity, and reputation alone are a grave cause for concern, but the financial damage is where the real danger lies. Ransomware demands routinely cost hundreds – sometimes even thousands – of dollars, in addition to the funds your business is losing as a result of the sudden halt in day-to-day operations.

Most technology experts advise strongly against paying ransomware demands. Aside from the high cost, paying does not guarantee that you will receive the promised access to your data. And the more businesses cave to these demands, the more money cyber criminals are able to make, encouraging them to keep targeting businesses and keep raising their price.

Often, the real concern isn’t whether or not you should pay the ransom, but rather whether your business will be able to recover from the damage caused by the infection. Losing access to critical files and applications for any length of time is problematic, to say the least, and it’s estimated that less than half of all ransomware victims are able to fully recover after an attack.

There are several reasons for this grim statistic. A business that pays for the decryption key and receives it run the risk of their data being corrupted during the decryption process, rendering the data useless. The loss of necessary files can result in missed deadlines or lost sales, and keep even the most basic tasks from being completed for days, or even weeks. News of compromised client data can push consumers into taking their business elsewhere and keep new customers from doing business with you. All of these factors lead to significant financial losses for your business.

Even with a recovery plan in place, the time and effort required to restore data from backups, clean all traces of the infection from your systems and network, and get your operations up and running again still results in downtime. Whether the “clean up” takes a few hours, or a few days, that’s still a long period of time where your business has little to no access to your systems and data. The client needs to go unaddressed, productivity nosedives, and your business’ reputation suffers.

The best case scenario when dealing with a ransomware attack? Your business has a rock-solid business continuity plan in place that allows your staff to carry on as usual with minimal to no downtime, and security monitoring in place that can detect an infection the moment it happens, allowing the infection to be contained before it has the chance to spread and cause significant damage.

The faster you and your IT support provider can spot, quarantine, and remove a ransomware infection, the better your business’ chances of bouncing back will be. Ransomware that runs its course unchecked has devastating consequences. Having a plan in place to stop that from happening is essential for the future of your business.

Want to learn more about the steps you can take to protect your business from the financial damage ransomware causes? Contact us at {email} or {phone}. We’re the IT professionals businesses in {city} trust.