NIST Releases Version of Cybersecurity Framework for Small Businesses

Researchers offer a step-by-step approach for covering the basics of cybersecurity.

NIST has been working closely with the Small Business Administration on cybersecurity issues for small business since 2003.
Now, as a follow-up to years of collaboration, NIST recently released a streamlined version of its
Cybersecurity Framework
geared to small businesses owners.
Released earlier this month,
Small Business Information Security: The Fundamentals
, runs 54 pages and offers small businesses a snapshot of the core concepts of the framework, which include the following: identify, protect, detect, respond and recover.
Patricia Toth, a supervisory computer scientist and co-author of the report with Celia Paulsen, says the guide came out of numerous workshops NIST held in tandem with the SBA over the past several years.
“We wanted to get some of the main points of the Cybersecurity Framework to the small business audience, but realized that the average small business owner wouldn’t want to pour through the entire framework,” Toth points out.
Frank Dickson, an analyst with IDC who covers security, says the streamlined document NIST put together for small businesspeople does a good job covering the basics of security.
“The only point I would add is that the document stresses strong passwords and while that’s good cyber hygiene, I’d like to see people look more toward stronger authentication,” Dickson says.
Toth adds while stronger authentication makes sense for more mature organizations, the average small business is generally just starting to think about stronger security, so they decided to get people focused on stronger passwords.
Even though it’s streamlined at 54 pages, small business owners may still not know where or how to get started security. Here’s a thumbnail that outlines six steps:
Manage risk.
Small business owners should start by asking what information is most important to the business and what’s essential for them to protect. For example, if a marketing booklet gets leaked it’s probably not as sensitive as if a customer list was exposed.
Train the staff.
Run a lunchtime seminar on how to identify phishing attacks and how to notify suspicious email and report it to the owner. It’s also important for the staff to be aware of the company’s policies on using Facebook, YouTube videos or general Internet browsing time. If there are no policies, then make your wishes known to the staff.
Stay up to date.
Keep in mind there are small businesses with close to 100 employees and those with under 10. For the companies with under 10 employees, they may have a tech person who comes to set up the network, but they don’t always have that person handle software updates and patches. We understand there’s a lot going on at your company and you are focused on sales, but don’t let updates and patches sift through the cracks. Automate as much as possible, but try to do the updates when they come out.
Run backups routinely.
So many small businesses don’t do this and with ransomware as much as a threat as it is today, running offsite backups has become more important than ever. Decide if backups need to be run once a day or once a week, but once a month won’t keep your company safe.
Investigate cyber insurance.
Cyber insurance may or may not be worth it to your company. However, it makes sense to talk to some insurance brokers and see where you stand. Whatever you do, don’t call about cyber insurance without having your security program in place. The rates you pay and how much cyber insurance your company qualifies for will be based on your overall security posture. A ratings system has been evolving and has not been standardized yet, and be prepared to do some homework before asking a broker about cyber insurance.
Seek out a professional IT company.
Even larger small businesses tend to have an IT person or outsourced contractor who comes in and sets up and manages the network. Use business contacts or your trade association to find out technology companies with experience running network security, preferably in your industry if possible. These companies can set up individual password accounts, secure the routers, install firewalls and web filters and explain how the system runs to the owner or the owner’s designated in-house tech person. Too many companies try to go it alone and then complain about spending money on a professional IT company. Don’t be that company. One breach of a prized customer list or sales results that get into the wrong hands and it could cost you your business. Working with professional IT people is well worth the expense, especially in this threat landscape.
Related Content:
Most Small Businesses Lack Response Plan For Hacks
Majority Of SMBs Would Not Pay Ransomware Attackers
Security 101 For SMBs

Last News
▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security	▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
NIST Releases Version of Cybersecurity Framework for Small Businesses