The experts’ step-by-step guide to cyber security

Where does cyber security fall on your to-do list? If it’s not a priority, it should be because 60% of small businesses suffered a breach in the year leading up to October 2014. The worst of these breaches disrupted operations for an average of seven to 10 days.

We recently held a live Q&A on the topic, with a panel of experts on hand to answer your questions. From risk assessment to keeping your business safe on a budget, here are some of their suggestions:

Where can I educate myself about cyber security?

Not all small firms will have the budget to outsource their online security. The panelists pointed out that it is possible to get advice for free:

• The IASME website has a list of sites offering free help
• The government recently published a free guide on cyber security
• A free Massive Open Online Course (MOOC) developed by FutureLearn, which is owned by The Open University, offers an introduction to cyber security

What risk assessments should I carry out?

The most important thing is to make sure you understand what data and information you hold. “What are the crown jewels within the business?” asks Del Heppenstall, who leads KPMG’s cyber security teams across the southern and midlands regions. “These could be IP, financial, customer details, employee records – once you have a handle on what it is that is important to your business and where you store this data, then you can begin to assess the threats and risks that these information assets will be open to.”

Business owners should also take a look at their digital assets, such as domain names and trademarks, and ensure they have “secured all of your brand names with more common domain suffixes”, says Stuart Fuller, director of commercial operations and communications at NetNames. “You can also see if any third parties have registered domain names using your business trademark or brands that could be taking away website visitors (and potential revenue).”

How can SMEs instil a culture of information security in the workplace?

It just takes one person clicking on a dodgy link to put an entire enterprise at risk. Training staff to follow cyber security procedures could save you a lot of time and money in the long run. Emma Philpott, CEO of the IASME Consortium Ltd, suggests the following:

• Include cyber security elements in staff contracts
• Implement training for staff about the basic controls and why they need them
• Hold regular discussions about what the threats and risks might be and how these change over time

Other suggestions included launching a safe phishing campaign to track improvements following training and developing an acceptable use policy.
Should small businesses dissuade staff from bringing in their own devices to work (BYOD)?

Allowing staff to bring their own devices to work is often more affordable than buying company equipment, but businesses need to have a BYOD policy. As a minimum, devices should have anti-malware on them and be regularly patched, says Philpott. “Ideally they would also be encrypted, capable of being tracked and remotely wiped but then there may be issues about who owns the data.”

You should plan ahead for if a device goes missing. Stephen Hind, who provides cloud solutions consultation and implementation forDrPete, says: “All the big cloud providers offer mobile device management so if a device does go missing the company can wipe the account from the device. If you cannot do this you need to ask yourself the question of how you would cope in that scenario.”

There are other ways that risks can be mitigated. Dr Stephen Moody, solutions director for EMEA at ThreatMatrix, says: “If, for example, users are connecting to business assets through a web portal then services can be run when users connect to check for malware on the machine and also provide additional frictionless authentication protection (if, for example, a fraudster has gained access to a staff username and password). This doesn’t require anything to be installed on the user’s device.”

What’s the best way to make sure that remote workers do what they can to avoid a breach?

With more businesses offering staff the option of home and remote working, avoiding a breach can seem out of your control. Panelists suggested activating a two-step verification process to sign in so users do not rely on a “static password”.

Remote workers should also be aware of who is working around them in a public space. Privacy screens can help shield your computer from prying eyes. Users should also be aware of the public spaces they use to operate online, specifically using open Wi-Fi connections.

Sign up to become a member of the Guardian Small Business Network here for more advice, insight and best practice direct to your inbox.