Image: Unsplash
Cyber threats are a real problem for all sectors — healthcare, finance, business, academe — you name it.
Once hackers successfully break in and steal valuable data and assets, who knows what felonies they can commit with them?
If you’re a business owner, you can’t afford for that to happen. Here’s an infographic about protecting business data that would help you see how it is crucial to ensure that such risks are not to occur in the first place.
Besides stolen assets and recovery costs, your company’s reputation could be tarnished. You can also lose or diminish your customers’ trust.
If you haven’t taken cybersecurity measures to bulletproof your business, allow me to share with you eight best practices you can begin implementing.
Let’s get started.
1. Enable SSL encryption.
Enabling SSL encryption is one of the first steps to lessen your website’s vulnerability from cyber attacks.
You can do this by applying for an SSL certificate so you can have encrypted connections between your server and browser.
Once you’ve been certified, your website URL turns from HTTP to HTTPS. You will also have a “padlock” icon appear before your URL.
Here’s what it looks like:
Image Source: HSBC
Most e-commerce site prefers subdomain to manage the website effectively. Some more common subdomains are admin.example.com, login.example.com, and blog.example.com, etc. A wildcard SSL certificate is the best option to ensure an unlimited subdomain hosted in a primary domain. SSL encryption will protect your confidential information like credit card numbers as they are being transmitted.
2. Run pen tests.
Have you heard of the cyber kill chain?
A cyber kill chain is an approach that allows you to trace the steps happening in a cyber threat — from the reconnaissance stage to the attacker’s ultimate aim.
Reconnaissance is the first stage of the cyber kill chain. It is where the cybercriminal surveys information from its victim through email phishing, brute force attacks, etc.
Fortunately, in this first step, you can already foresee social engineering, cyber threats, and other kinds of possible malicious tactics.
To help you prevent foreseen cyber attacks, an excellent place to begin is to run penetration tests.
Also known as pen tests, these are simulations of cyber attacks aimed at gauging the strength of your cyber defenses and recommending appropriate measures.
While you can run a pen test yourself, doing so may be disruptive or detrimental to your business if you’re not proficient in IT and computers.
Hence, it’s best if you tap third-party service providers to help you.
They have the right equipment to run pen tests properly and the expertise to enlighten you on your current cybersecurity situation and what you should do next.
3. Create robust passwords.
If your business website contains sensitive data, you can’t have weak passwords that hackers can easily crack.
Robust passwords, therefore, are a must to secure your business website.
Strengthen your password by making them unique and long. It should contain at least 14 different kinds of characters.
Combine letters in lowercase and uppercase, special characters, and numbers. For example, instead of “sherlockholmes,” use “sh3rLocK^HoLme$*.”
Plus, to be sure your password is robust, use tools like My 1Login Password Strength Meter.
Enter your proposed password, and voila, you get instant feedback, like this:
It tells you how weak or robust your password is, and the time it takes for hackers to crack your password.
Knowing this helps you revise your passwords so you can help secure your website.
4. Implement 2FA.
Two-factor authentication or 2FA helps make your business website or email extra tricky for hackers to access.
It requires more than the username and password. After entering those details, it requests you to verify your identity further by typing a code to you sent via SMS, phone call, etc.
Email sites like Google give you the option to implement 2FA for your account.
Here’s how you can enable the setting:
Type in your phone number and select from among the options how you want to receive the codes from Google.
In this way, 2FA systems can validate that you, the account owner is the one trying to access and not a hacker — therefore securing your business information.
5. Beware of phishing through spam.
Have you ever received out-of-the-blue emails from unknown users and companies with services you didn’t subscribe to, like this screenshot below?
If you have, then you’ve most likely received spam emails, which are unsolicited messages.
Some spam emails are merely commercial, but others are used for phishing tactics.
These suspicious emails may sound trustworthy, and usually, require you to provide sensitive information and click a link or download an attachment.
When you receive that kind of communication, beware. Do not do as the email says.
The link or file may be infected and used to access your account using the information you provided.
On the other hand, if you’re delivering promotional emails to your subscribers, you can help assure them that your message is legitimate.
When promoting your blog posts via email, for example, make sure your subject line, email address, and account name sound official.
Refrain from requiring your subscribers to disclose sensitive information via email or other unsecured channels.
That way, your subscribers can feel safer when receiving your promotional emails and engaging with your business.
6. Protect your WiFi networks.
Even WiFi networks can be hacked if they are not secure.
As such, one way of protecting your business’ WiFi network is through robust passwords.
It would also be best if you only share the password with employees whose assignments and needs are directly related to that network.
For instance, employees from your IT department should have a separate WiFi network from those in the administrative department, especially when they’re not on the same floor.
Should you provide free WiFi access for your customers and clients, provide a separate network and password for them as well.
Remember also to change your passwords regularly, especially for the public network.
Cybercriminals can pose as customers, and unchanged long-time passwords make hacking extra painless.
7. Set up reCAPTCHA.
CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart.
Google employs a user-intuitive tool called reCAPTCHA to help defend your business site from spam and abusive activities.
Google activates the reCAPTCHA whenever it notices suspicious occurrence on your website or while you’re searching on the web.
reCAPTCHA can distinguish if your website visitor is a real human or a possibly malicious bot.
It does this by asking the user to solve math or photo identification puzzles. Humans can quickly solve this, but bots can’t.
The first step to a reCAPTCHA looks like this:
When you encounter that reCAPTCHA prompt, tick the box to tell Google that you’re not a robot, and Google will allow you to pass through and continue your activity.
To enable reCAPTCHA on your website, register on Google, get your keys, and embed a given code on your site’s frontend.
Bulletproof your business.
Prevention is better than cure.
These defenses may seem small and simple, but they are a big step to defending your website, emails, and digital assets from being stolen.
With these best practices, you thwart the hacker’s attempts from succeeding and bulletproof your business at the onset.
Be the first to share this post with your network. Cheers!
