Small businesses have one priority: grow!

However, focusing only on growth could lead to overlooking the critical importance of cybersecurity in their daily operations. Even when their B2B clients point out the lack of security, the sheer complexity of building and managing a robust cybersecurity program can feel overwhelming, leaving business owners uncertain about where to start.

The rapid pace of digital transformation has made business operations more complex than ever. Protecting a business with this evolution in mind demands specialized expertise, tools, and resources - investments many SMBs would instead channel into fueling sales and product development. However, the cost of neglecting cybersecurity is far greater than the price of prevention. A single cyberattack can result in devastating financial losses and damaged reputation. If one thing is difficult to get back, that is reputation.

To protect their future, SMBs and start-ups should take a proactive stance. This means prioritizing cybersecurity as a fundamental business need, fostering a culture of cyber awareness within their teams, and establishing clear, enforceable IT security policies and controls. These actions mitigate the risk of attacks and empower businesses to grow confidently. Cybersecurity isn’t just a technical requirement - it’s the foundation of trust and resilience.

Step 1: Lay the Foundation

1.1 Understand the Importance of Cybersecurity (it might turn out it is NOT important for you!)

Not all businesses need a cybersecurity program. Or at least not all companies would benefit equally from it.

It could be important, if you have B2B clients or work as a military contractor or a government contractor for important projects involving confidential information. It could be important for you, if your B2B clients ask you to prove you are secure on a regular basis. But if you work in an industry where you don't collect or process confidential information or PII/medical data, then cybersecurity is not important for you, or at least not as important.

Let me share a story.

There was a small cosmetics company, with just 3 employees, that contacted us when their office network got shut down by a supposed 'hacking attack'.

Turned out, the accounting software they were using belonged and was developed by a company which couldn't care less about cybersecurity. As a result, ALL their clients got hacked simultaneously, because of a critical flaw in their software.

That small cosmetics company fell victim not because they were targeted by hackers, or because they held critically confidential and valuable data (they did not!), but because the software they were using was a target.

Was cybersecurity important to them? No.

Did they still fall victim to a hacking attack? Yes.

Could they have prevented the problem? Yes, of course. If they had the right security configuration on their desktops and server, they could have simply restored from a backup...

But I digress. The importance of having a cybersecurity program and executing it the right way depends on your business and the data you hold, as well as on the systems you use.

Step 2: Assess Risks and Current Security Posture

2.1 Conduct a Security Assessment

Identify assets (e.g., customer data, intellectual property, systems, cloud services).
Assess threats and vulnerabilities (e.g., phishing, unpatched software, misconfigured services, improper authentication or access control).
Use frameworks like NIST’s 800-53 v4 or v5 or CMMC as the foundation of your security assessment, as they are the most comprehensive in terms of security controls covered.

2.2 Perform a Gap Analysis

Compare current practices to standards in NIST 800-53 and ISO 27001.
Identify areas requiring improvement, prioritize them by criticality and start working on them.

At Atlant, we prefer the NIST 800-53 v5 as it is more practical and less bureaucratic than ISO 27001. We like suggesting using Kanban as a project management methodology for security projects, after the gap analysis is complete, as often the output contains hundreds of action items, some of which could become complex projects in themselves.

2.3 Establish a Security Policy

Develop a formal cybersecurity policy (which often would comprise of more than a dozen separate documents). You could also use a list of policies from CMMC or NIST best practice recommendations. In the end, you will have more than 20 different policy documents and a bunch of procedures, depending on the complexity of your IT operations.

2.4 Define Roles and Responsibilities

Assign a security champion or designate a part-time security officer.
Identify key stakeholders responsible for implementation, monitoring, and incident response.

If you are a small business, you might designate existing roles to also act in a security role or you could get an external team to take on these roles on a part-time basis. Make sure to document your decision in your policies and procedures.

Step 3: Build a Secure Infrastructure

3.1 Implement Access Controls

Your first step here is to generate an Access Management Matrix. Document all systems (cloud systems and on-premise) that you use, who administers them, who is a regular user, etc).
Use the principle of least privilege to restrict access.
Implement strong authentication mechanisms (e.g., MFA for critical systems).
Set up user role management and enforce periodic reviews.

3.2 Secure Your Network

Install firewalls and intrusion detection/prevention systems (IDS/IPS).
Encrypt Wi-Fi traffic with WPA3 and segment networks.
Use VPNs for remote access. Even better - use the principle of Zero Trust and secure each system and endpoint as if it were on the Internet.

3.3 Protect Endpoints

Deploy endpoint detection and response (EDR) solutions.
Ensure all devices have antivirus and anti-malware protection.
Enforce device encryption and secure configurations.

Here is the place to mention security hardening. Use something like https://www.stigviewer.com/stig/microsoft_windows_11/ to harden your endpoints, but also harden the browsers and office suites (there are separate STIGs for them). Ideally implement centrally managed hardening policies. This is more important than having an EDR and is free.

3.4 Harden Applications

Perform vulnerability scans and penetration tests on web applications.
Apply patches and updates regularly.
Implement secure coding practices if developing software.

Don't forget about monitoring. You should get an alert if your application is under attack, even if you believe it is secure.

3.5 Backup Critical Data

Follow the 3-2-1 backup rule (3 copies, 2 types of storage, 1 offsite).
Ensure backups are encrypted and test recovery processes regularly.

If a hacker is on your network, they will attempt to disable or corrupt your backups months before they encrypt all your data and ask for ransom. That is why testing your recovery regularly is of utmost importance.

Step 4: Establish Operational Security

4.1 Develop Incident Response Plans

Create a playbook for handling incidents like ransomware, phishing, and DDoS attacks.
Include steps for detection, containment, eradication, recovery, and lessons learned.
Assign roles for incident response team members.

4.2 Monitor and Log Activities

Set up a Security Information and Event Management (SIEM) system.
Enable logging for critical systems and review logs regularly.
Detect anomalies in user behavior and traffic patterns.

4.3 Implement Secure Communication Channels

Use encrypted email solutions (e.g., PGP, S/MIME).
Secure file-sharing platforms and cloud services with encryption.
Train employees on identifying phishing attempts.

4.4 Manage Third-Party Risks

Assess the cybersecurity posture of vendors and partners.
Include security clauses in contracts (e.g., liability, incident reporting requirements).
Monitor third-party access to your systems.

Step 5: Train Employees

5.1 Conduct Security Awareness Training

Educate employees on identifying phishing emails, using secure passwords, and reporting suspicious activities.
Focus on common threats like business email compromise (BEC) and ransomware.

5.2 Implement Regular Drills

Simulate phishing campaigns to test employee readiness.
Conduct tabletop exercises for incident response.

Step 6: Develop Compliance and Documentation

6.1 Align with Compliance Standards

Identify applicable regulations (e.g., GDPR, CCPA, HIPAA).
Document compliance processes and proof of implementation.

6.2 Maintain Security Documentation

Keep an updated inventory of assets.
Document risk assessments, security controls, and audit results.
Ensure policies and procedures are reviewed periodically.

Step 7: Perform Continuous Improvement

7.1 Conduct Regular Audits

Schedule internal audits to ensure controls are effective.
Engage third-party auditors for unbiased assessments.

7.2 Review and Update Policies

Update policies to reflect new threats, technologies, and business changes.
Use incident post-mortems to refine processes.

7.3 Test Security Controls

Perform penetration tests to identify weaknesses. But only run penetration tests once you have invested sufficient time and resources in defense. It would make zero sense in testing a defenceless IT infrastructure.
Use automated tools for vulnerability scanning. Some are even free and open source, like Wazuh.
Validate controls for effectiveness during real-world simulations.

Step 8: Create a Culture of Security

8.1 Empower Employees

Foster an environment where employees prioritize security. How? Well, reward them for secure behavior and control insecure behavior. You might give out benefits, gifts, public recognition for the employees who reported the most phishing emails in a year or a month. And give 'badges' to the ones who fell victim to a phishing simulation or attack. It is generally better to reward them and avoid punishing them, if you want a positive culture of security.
Encourage reporting of potential risks without fear of repercussions.

8.2 Involve Leadership

Ensure management understands the importance of cybersecurity.
Secure buy-in for budget allocations and support for security initiatives. Remember, leaders don't care about bells and whistles - they care about ROI and ROI only. Does cybersecurity provide ROI? It does if you can show it. For example, can your company sell more to its B2B client base, with a few clever slides about how secure their data will be with you and how you are above and beyond in cybersecurity than the competition?

Вижте също: Sandboxed Browsers / Alternatives for the enterprise

Как да изградите програма за киберсигурност за малък бизнес