Top 10 security best practices for SMBs

October 2013 Information Security

Cybercrime in South Africa is increasing at epidemic proportions and small to medium businesses have turned into key targets for cyber-criminals. Small businesses rarely recover from cyber-attacks, but there are some very simple steps you can take to protect your business.

Doros Hadjizenonos
Doros Hadjizenonos

Doros Hadjizenonos, sales manager at Check Point South Africa highlights his top 10 security best practices for the South African SMB space.

1. Common passwords are bad passwords

Passwords are your first line of defence when it comes to security. Cybercriminals trying to break into your network will start their attack by trying the most common passwords. Ensure your employees and users are using long (over eight characters), complex (include lower case, upper case, numbers and non-alpha characters) passwords.

2. Secure every entrance

All it takes is one open door to allow a cybercriminal to enter your network. Just like you secure your home by locking the front door, the back door and all the windows, think about protecting your network in the same way.

* Ensure strong passwords on laptops, smartphones, tablets, and WIFI access points.

* Use a firewall with threat prevention to protect access to your network.

* Secure your endpoints (laptops, desktops) with security software such as anti-virus, anti-spam and anti-phishing.

3. Segment your network

A way to protect your network is to separate your network into zones and protect the zones appropriately. One zone may be for critical work only, where another may be a guest zone where customers can surf the Internet, but not access your work network.

4. Define, educate and enforce policy

Actually have a security policy (many small businesses don’t) and use your threat prevention device to its full capacity. Spend some time thinking about what applications you want to allow in your network and what apps you do not want to run in your network. Educate your employees on acceptable use of the company network.

5. Be socially aware

Social media sites are a gold mine for cybercriminals looking to gain information on people, improving their success rate for attacks. Attacks such as phishing, spearphishing or social engineering all start with collecting personal data on individuals.

6. Encrypt everything

One data breach could be devastating to your company or your reputation. Protect your data by encrypting sensitive data. And make it easy for your employees to do so.

7. Maintain your network like your car

Your network, and all its connected components, should run like a well-oiled machine. Regular maintenance will ensure it continues to roll along at peak performance and hit few speed bumps.

* Turn on automatic updates where available: Windows, Chrome, Firefox and Adobe.

* Use an Intrusion Prevention System (IPS) device like the Check Point 600 Appliance to prevent attacks on non-updated laptops.

8. Cloud caution

Cloud storage and applications are all the rage. But be cautious. Any content that is moved to the cloud is no longer in your control. And cybercriminals are taking advantage of weaker security of some cloud providers.

* When using the cloud, assume content sent is no longer private.

* Encrypt content before sending (including system backups) and check the security of your cloud provider.

* Don’t use the same password everywhere, especially cloud passwords.

9. Don’t let everyone administrate

Laptops can be accessed via user accounts or administrative accounts. Administrative access allows users much more freedom and power on their laptops, but that power moves to the cybercriminal if the administrator account is hacked.

* Don’t allow employees to use a Windows account with Administrator privileges for day-to-day activities.

* Make it a habit to change default passwords on all devices, including laptops, servers, routers, gateways and network printers.

10. Address the BYOD elephant in the room

Start with creating a bring-your-wwn-device (BYOD) policy. Many companies have avoided the topic.

* Consider allowing only guest access (Internet only) for employee owned devices.

* Enforce password locks on user owned devices.

* Access sensitive information only through encrypted VPN.

* Don’t allow storage of sensitive information on personal devices (such as customer contacts or credit card information).

* Have a plan if an employee loses their device.

For more information contact Check Point South Africa, +27 (0)11 319 7267, [email protected], www.checkpoint.com





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
Upgrade your PCs to improve security
Information Security Infrastructure
Truly secure technology today must be designed to detect and address unusual activity as it happens, wherever it happens, right down to the BIOS and silicon levels.

Read more...
Open source code can also be open risk
Information Security Infrastructure
Software development has changed significantly over the years, and today, open-source code increasingly forms the foundation of modern applications, with surveys indicating that 60 – 90% of the average application's code base consists of open-source components.

Read more...
DeepSneak deception
Information Security News & Events
Kaspersky Global Research & Analysis researchers have discovered a new malicious campaign which is distributing a Trojan through a fake DeepSeek-R1 Large Language Model (LLM) app for PCs.

Read more...
SA’s strained, loadshedding-prone grid faces cyberthreats
Power Management Information Security
South Africa’s energy sector, already battered by decades of underinvestment and loadshedding, faces another escalating crisis; a wave of cyberthreats that could turn disruptions into catastrophic failures. Attacks are already happening internationally.

Read more...
Almost 50% of companies choose to pay the ransom
News & Events Information Security
This year’s Sophos State of Ransomware 2025 report found that nearly 50% of companies paid the ransom to get their data back, the second-highest rate of ransom payment for ransom demands in six years.

Read more...
Survey highlights cost of cyberdamage to industrial companies
Kaspersky Information Security News & Events
The majority of industrial organisations estimate their financial losses caused by cyberattacks to be over $1 million, while almost one in four report losses exceeding $5 million, and for some, it surpasses $10 million.

Read more...
Digital economy needs an agile approach to cybersecurity
Information Security News & Events
South Africa is the most targeted country in Africa when it comes to infostealer and ransomware attacks. Being at the forefront of the continent’s digital transformation puts South Africa in the crosshairs for sophisticated cyberattacks

Read more...
SIEM rule threat coverage validation
Information Security News & Events
New AI-detection engineering assistant from Cymulate automates SIEM rule validation for SecOps and blue teams by streamlining threat detection engineering with automated testing, control integrations and enhanced detections.

Read more...
Cybersecurity a challenge in digitalising OT
Kaspersky Information Security Industrial (Industry)
According to a study by Kaspersky and VDC Research on securing operational technology environments, the primary risks are inadequate security measures, insufficient resources allocated to OT cybersecurity, challenges surrounding regulatory compliance, and the complexities of IT/OT integration.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.