Beyond SolarWinds: 7 Next Steps for Business Cybersecurity

What is SolarWinds, and why is it making headlines?

It was recently revealed that SolarWinds, a prominent software company, experienced a major cybersecurity breach that impacted multiple high-level targets like Microsoft and multiple U.S. government agencies. The decision to attack a company that, among other products, sells remote monitoring software was like setting a bomb: waiting until the right moment, the shrapnel hit many targets at once. Organisations around the world are suffering from this attack, and there’s still more compromised systems to be found.

Next steps for small business cybersecurity post-SolarWinds

So what can you, as a regular person with a small business, do? We’ve complied seven steps you can take to feel more secure in your organisation’s protection:

No more compromising on cybersecurity

Cybersecurity is no longer an accessory, upgrade, or option for organisations that are serious about growth and maintaining integrity within their industries. Your IT cannot simply be, “I’ve budgeted for a few computers this year, so security is covered.” Fixing or replacing a computer isn’t the same as proactively testing for weakness in your armour.   And antivirus isn’t the “first defence” like it was in the past — it’s the last thing you want to alert you, because antivirus alerts mean someone is already in your system. It’s the equivalent of not having locks on your door but having an intruder alert set up in your bedroom.

Acknowledge that your organisation can be compromised

Let’s all say it together: “my organisation can be compromised.” Breathe. There, the difficult first step is out of the way.   Now, what do we mean when we say that? It means that no matter what excuses you have in your head, there’s opportunities for hackers. You should always be prepared for the worst (while hoping for the best). You’re no SolarWinds, you’re too small to be on anyone’s radar? Different hackers hit different targets — some hacks or hackers specialize in small businesses because they’re easier to hack. You have a cybersecurity plan in place? Well, it still has opportunities for hacks.   Yes, even a good cybersecurity plan has opportunities for hackers. But the best plans include mitigating factors that can help make your plan stronger. Your strategy should be set up in layers of security. Opportunities on one layer are blocked by other layers. And if the worst does come to pass, you’re protected with a mixture of encryption and backup.

Talk to an IT Services Provider and see if they can help

The best team to help you sort through all the complications of cybersecurity is an IT Services Provider that has a cybersecurity focus. Not all providers are alike, so make sure you scout out a few. If you’re in the Johannesburg, Cape Town, Durban or Windhoek areas, MULTi IT & Telephony Solutions might be a good fit and we’d love to chat. If you’re not, you can ask other businessowners and see if they have recommendations. Or just open up Google and take a look at some of the local providers and their websites.

Plan (and don’t dread) your cybersecurity budget

IT has costs attached, and a new cybersecurity strategy may have larger up-front project costs. What many companies don’t understand is that IT is an investment — a worthwhile investment, but an investment, nonetheless. There’s value to it that you may not initially put a sticker price on, like increased productivity via a streamlined system using products like Microsoft Teams, reduced downtime with a stronger system and regular backups, the peace-of-mind knowing you’re protected from things like ransomware attacks.  One of the biggest impacts of this year in cybersecurity is that compliance and security can actually help an organisation to make money. Showing that you have firm IT policies that are enforced through a certification or documentation improves your organisation’s reputation for doing things right, and that helps you to gain more business. Having help from your Managed Services Provider will also take the pressure off your organisation to try and figure everything out. Remember that compliance, security frameworks, and protection are a team exercise. You cannot shoulder all of this yourself. It is better to have someone that can translate everything that you need so that you can properly budget for change. A Managed Services Provider (MSP) can help you navigate technology in a superior fashion.

Know your industry and its IT security compliance requirements

If you’re in a particular industry, you know that you might be holding very sensitive information. In some cases, you may have a legal obligation to protect this information. Your IT provider should offer compliance consulting to make sure your business is protected.   Health care organisations need to conform to HIPAA regulations. New York insurance, banking and financial services need to follow The New York Department of Financial Services (NYDFS) cybersecurity regulations. Organisations that handle or accept contracts from the Department of Defence need to deal with the new Cybersecurity Maturity Model Certification (CMMC). The consequences can be very high — in the case of CMMC, failure to meet these controls, provide a certification, or maintain the certification allow agencies within the government to immediately terminate a contract.  Make sure you stay on top of industry regulation and avoid being caught by surprise.

Understand that your policy is a living document

A trap we’ve seen organisations fall into is that they’ve agreed with everything else on this list, made strides to start a strong cybersecurity platform, and then… let it fall by the wayside, as time passes and other important things come down the pipeline. It’s just policy. It’s just a document in a folder somewhere. It’s outdated, anyway.  Don’t fall into this trap! If you get to this point, you’re so close. Don’t throw it all away in the final stretch. Your cybersecurity policy should be an integral part of your organisation. It shouldn’t be ignored, and it shouldn’t be bent. It should be referred to on a regular basis, and it should be reviewed and updated when needed.

Know your vendors

If nothing else, the SolarWinds breach exposes something we’ve known for a long time. Organisations need to maintain a list of vendors and start asking their vendor’s questions. For example:

1. Does the vendor have compliance needs? How are they meeting those needs?
2. Do they know what compliance your organisation needs to meet?
3. What reports do they have available?

When you call a vendor, they shouldn’t be upset that you’re performing due diligence to protect your organisation. They should be helpful in allowing you to achieve your goal for cybersecurity. Remember that just because an organisation is not required to maintain a specific level of compliance doesn’t mean that they don’t have to follow a security framework.

The bottom line

The SolarWinds hack is alarming, but there are still concrete options for your business to protect yourself from incidents like this. We hope this helps enlighten the steps you can take, or at least gets you to begin thinking about cybersecurity. If you’re curious to see what MULTi IT & Telephony Solutions could do for your organisation, check out our approach to IT services and cybersecurity, and feel free to contact us.

Get in touch to discuss with us Today

Johannesburg – +27(0)11 435 0450, [email protected]
Cape Town – +27(0)21 879 1950, [email protected]
Durban – +27(0)31 331 0735, [email protected]

Namibia – +264(0)84 000 8310, [email protected]