For large organizations with deep pockets, an information security breach is an expensive and embarrassing debacle whose ramifications can last years. But for small and medium-sized businesses (SMBs), a severe incident could mean the end of their business entirely. Centered around people, processes and technology, there are steps organizations of any size can and should take to protect themselves and their clients.

According to Global Market Insights (registration required), the cybersecurity industry was worth over $120 billion at the start of 2017, and it grows by the minute as more frequent and more sophisticated attacks are reported. With data breaches in large corporations and government agencies getting the most attention in the press, it would be easy to think that a smaller company doesn’t have much to worry about. Unfortunately for many SMBs, the growing number of security attacks says something very different.

In 2018, SMBs were the target of 43% of cyber attacks, according to the small business mentor group SCORE. Often, hackers use smaller, more vulnerable companies as a way into larger targets that they do business with. This can ruin the smaller organization’s reputation and its ability to partner with other businesses in the future.

It’s not all bad news, though. Most attempted security breaches can be thwarted with some planning, vigilance and basic precautions. Here are some tips that you can follow as a business owner to get the most out of your information security efforts:

1. Bake security into your systems and software.

Security shouldn’t be an add-on or an afterthought, but rather a fundamental part of your organization’s information assets from the outset. It should be part of the foundation of both end-user product design and internal system architecture. Whenever feasible, your systems should be secure by design, following (among other practices) the “principle of least privilege,” where system users only have the access rights needed to do their jobs. It’s never too late, though, to beef up your existing systems. From minor tweaks to total redesigns, it’s worth the effort to protect your company’s assets and reputation.

2. Embed cybersecurity in your company’s culture.

Unfortunately, even the most secure systems in the world have one Achilles’ heel: people. People are almost always the weak link in the chain when it comes to cybersecurity. Whether due to a lack of awareness or an unwillingness to follow security practices, one non-compliant employee can potentially render all of your security efforts useless. For SMBs without the capital to recover from a major incident, everyone’s jobs are on the line. Training and frequent refreshers are critical, but you should also strive to embed good cybersecurity into the culture of your organization by setting a good example at the management level, as well as emphasizing best practices in all aspects of your operations. Employees should not only be trained on what to do but also why they are doing it. It’s important to remind them of the consequences of a data breach.

3. Plan your incident and disaster response.

Part of being proactive is being ready in the unfortunate event of a cybersecurity incident, or a disaster (natural or man-made) that compromises your systems. No organization’s information security strategy is complete without formal, in-depth incident management and response plans, as well as a disaster recovery plan (DRP). Although your IT department is not typically your cybersecurity team, it is closest to your systems and often at the tip of the spear in the event of an incident. They should be prepared, both through training and through involvement in response planning, to work closely with cybersecurity experts during response and recovery. Consider including other departments as well in your response and recovery procedures — and hold mock incidents or drills to prepare everyone for their role.

4. Monitor and patch your security.

Hackers can, and do, strike from anywhere at any time. Constant network monitoring is critical for not only detecting and potentially thwarting attacks but also for fast and effective recovery from a breach. Network monitoring software produces event logs that help your security team identify where and how hackers are focusing their efforts. Part of this constant vigilance is to consistently update and maintain the latest versions and security patches of all software on your systems. Software patches shore up known vulnerabilities — servers with out-of-date software become easy prey for opportunistic hackers who are always on the lookout for such an opportunity.

5. Think like a bad guy.

Securely designed systems can still have vulnerabilities. Hackers always seem to be a step ahead of both law enforcement and information security professionals, but they also prefer to take the path of least resistance. They are constantly probing their targets for weaknesses and waiting for their moment to strike. You don’t want cybercriminals to be the first to discover a vulnerability that compromises your business, partners or customers. By taking a proactive security approach — with thorough penetration testing — you can use the same tools as malicious hackers, beating them to the punch by finding and closing security gaps in your systems.

6. Get an external view of your current security posture.

Large, prominent companies can afford to throw substantial amounts of money at cybersecurity, often employing a Chief Information Security Officer (CISO) and other support personnel to handle all aspects of cybersecurity. Despite recognizing the importance of information security, not all organizations can afford or even need to have the expertise in-house. Consider getting a third party to assess your cybersecurity needs and help you determine what threats and vulnerability your SMB faces or could face as you grow. With this information, you’ll be best equipped to make decisions regarding how to proceed in protecting yourself.

The bottom line is that smaller organizations can no longer afford to put information security on the back burner — the risks are too real and the stakes are too high.

CREDIT: Jaime Manteiga, Forbes

BALTIMORE — A Maryland congressman said on Friday that the National Security Agency had denied that one of its hacking tools, stolen in 2017, was used in a ransomware attack on Baltimore’s government that had disrupted city services for more than three weeks.

The statement, made by Representative C.A. Dutch Ruppersberger, came in response to an article in The New York Times last weekend. The Times was told by people directly involved in the investigation in Baltimore that the N.S.A. tool, EternalBlue, was found in the city’s network by all four contractors hired to study the attack and restore computer services.

Investigators are still trying to determine the exact chronology of the attack. The leading theory is that hackers broke in through an open server in Baltimore’s network, installed a back door and then used EternalBlue to move across the city’s computers searching for valuable servers to infect, said the people involved in the investigation.

This week, the contractors discovered an additional software tool, called a web shell, on Baltimore’s networks. They believe the web shell may have been used in conjunction with EternalBlue and another hacking technique known as “pass-the-hash,” which uses stolen credentials, to spread the ransomware.

The people involved in the investigation spoke to The Times on the condition of anonymity because they were not authorized to discuss it on the record.

N.S.A. officials are naturally sensitive to reports of continuing damage done by their hacking tools, stolen and released on the internet in 2017 by a still-unidentified group calling itself the Shadow Brokers. EternalBlue and other N.S.A. tools were used in attacks by North Korea and Russia later that year that caused billions of dollars in damage to corporations and governments around the world.

More recently, according to cybersecurity experts, EternalBlue has turned up in attacks on local governments in the United States, which often used aging equipment and fail to keep their software up to date. A patch issued by Microsoft in 2017, but apparently never installed in Baltimore, should have made Windows secure against EternalBlue.

An N.S.A. spokesman declined to comment on the congressman’s statement or the Times article, which was published online on Saturday. A spokesman for Baltimore’s mayor’s office also said he could not comment on the continuing investigation.

Mr. Ruppersberger, a Democrat whose district includes the N.S.A.’s Fort Meade campus south of Baltimore, said in his statement that he had been briefed by “senior leaders” of the N.S.A. They told him that “there is no evidence at this time that EternalBlue played a role in the ransomware attack affecting Baltimore City.”

He added: “I’m told it was not used to gain access nor to propagate further activity within the network.”

The statement did not explain how N.S.A. learned the details of the forensic investigation in Baltimore, which is being carried out by the private contractors. The Federal Bureau of Investigation has also opened an inquiry but has not commented publicly on any findings.

The N.S.A. routinely hunts for security flaws in widely used software and uses them to penetrate foreign computer networks and gather intelligence. It used EternalBlue for such spying for at least five years before the Shadow Brokers stole the tool and posted it on the web to be grabbed and used by foreign states and criminal hackers.

“Our country needs cybertools to counter our enemies, including terrorists, but we also have to protect these tools from leaks,” Mr. Ruppersberger said. “We can’t ignore the damage that past breaches have done to American companies and, possibly, American cities. Now, our focus now should be on Baltimore’s recovery.”

Some former N.S.A. officials have suggested that Baltimore bears some responsibility for the attack, because it evidently had not installed updates to Windows that might have kept its system safe. But Mr. Ruppersberger said “the reality is that patching can be hard and requires resources that many municipalities don’t have.”

He said he thought the federal government “needs to do more to help municipalities better protect their networks.”

CREDIT: Scott Shane and Nicole Perlroth, The New York Times