...
Easy Mode | Get it Done | The Journey |
|---|
Read the Australian Government Small Business Cybersecurity Guide. | Decide if SMB1001 Gold self attestation may be good fit for your business. | Heading for ISO27001? Wanting to do more government Work? |
Have a read of your current Policies and Procedures. | Gather all your current policies and procedures in one place, as you will be updating them. | Think about having a centralised place to store and maintain policies and procedures. There are many options. |
Think about risk in your business. What keeps you up at night? What would you do if something happened to a key piece of software or hardware? What if you lost your phone? Can you even pay payroll?
| Start to write down some of the risk scenarios you may face as a business. | Plan to implement a risk register in the business, along with all that entails (eg updating it regularly). There are great apps to help with this. |
Step 2 - Passwords
Your passwords are the keys to your kingdom. It’s time to stop with the Admin/12345. Start with the passwords that need to be most secure.
Easy Mode | Get it Done | The Journey |
|---|
As you go through your day, think about your passwords. What is this password protecting? (your banking, payroll, client documents). Is it a good password? When did you last change it? How did you know this password? (eg memory, stored in your browser, written on a post it note). Is it unique? (yes, really unique!). Who else, apart from you, uses this same login and password? (eg do staff members who have left the business still know this password?). Does this login also have Multi Factor Authentication? What type of MFA (eg sends a text message, uses an authenticator app).
| All of Easy Mode plus… Change any passwords that are not unique. Change any passwords that have not been changed in 12 months. Turn on MFA everywhere you can. If there is an option for MFA that is not text or email based, then choose that first. Ensure all Social Media accounts, and your main Email / Office account has MFA. Make a note in your password manager for those passwords where you can’t use MFA (eg banking), but what protection do they have (eg text message for new suppliers).
| All of Get it Done plus… It may be time to start setting up Single Sign On (SSO) for your main systems. Both Microsoft and Google can be set up for SSO. |
Start using a Password Manager, even the free version of LastPass. Think about getting a team plan of LastPass or 1Password and get your whole team, and even family onboard. Set up a long passphrase for logging into your Password Manager - but don’t forget it! There is no way to re-set your password for a Password Manager if you don’t already know your existing password. Ensure passwords are not saved in your browser anymore (the setup for the password manager should help with this). Set up your Password Manager to be on your Phone and in your Browser. When you need to share a password with someone, how do you do it? (
| All of Easy Mode plus… Get onto the team plan of LastPass or 1Password. Ensure no passwords are saved in your browser. Use the change password feature of your password manager to update passwords. Shared logins are marked as such, and shared with only the team members that need them. Each team member should have their own logins to all services. Get the family onto a Password Manager also. Keep business and personal passwords separate (eg LastPass for personal and family sharing, 1Password for the team). Who has access to your business passwords in case of your death or incapacitation - especially the passwords that are needed to have the business run in your absence.
| All of Get it Done plus… Store backup login codes separately to your logins. Set up Time Based Authentication (TOTP) separately to your Password Manager. Eliminate Shared Logins where possible. Ensure Logins and Passwords are disabled as soon as a team member leaves.
|
Step 3 - People
Yes, I put People behind Passwords. The first part of educating People will be to talk about Passwords.
Easy Mode | Get it Done | The Journey |
|---|
Just as you have had to check what you didn’t understand and ask for help, start this process with your team also. https://www.cyber.gov.au/learn-basics No question is too silly, No one will be penalised for asking a question about something that looks strange, Let the team know that you are all together embarking on a journey to get the business better at cybersecurity. Talk about what ideas they have, and what areas they see as needing improvement. Come to an agreement on some baseline rules: No more hidden data - eg spinning up a spreadsheet and then maintaining it weekly forevermore. No more signing up to a new service without approval. No more emailing documents and spreadsheets to anyone, including another team member. No more taking data home on USB sticks.
Take the Quiz, share the results with the team, and talk through the answers. Talk them through the next steps. Passwords Access Control Application Control
When they groan, and complain, remind them what you discovered in Step 0 - how does getting better at cybersecurity fit with your business values?
| | |