SMALL BUSINESS CYBERSECURITY

Simple, Easy to Follow Help
For the Small Business

Certified Information Systems Security Professional
ISC2 CISSP #473513 Since 2013

Clean Definitions

Measuring and Manageing Information Risk,
a FAIR Approach
1st Edition

Authors: Jack Freund and Jack Jones
Published by: Butterworth-Heinemann, Oxford, UK
2015
ISBN: 978-0-12-420231-3 (Paperback)

How to Measure Anything in Cybersecurity Risk

Authors: Douglas W. Hubbard and Richard Seiersen
Published by: John Wiley and Sons, Inc., Hoboken, New Jersey, USA
2023
ISBN: 978-0-11-1989230-4 (Hardback)
ISBN: 978-0-11-1989232-8 (ePDF)
ISBN: 978-0-11-1989231-1 (ePub)

Cybersecurity

"Cybersecurity" is a newer term in the history of Enslish which combines "information security," "information system security" and "network security." I still prefer the term Information Security.

Information security has been broken up into three general catagories to consider: Confidentiality, Integrity and Availability, in that order. But, that's a suggestion by the authors of CIA. You know your business. You, and only you know which value is most important. In critical infrastructure (electricity, gas, water, etc.) Safety is added to the beginning and Availability is second, not last. Then comes Integrity and Confidentiality, in that different order, and that's OK. It works for that industry. You too, can define what your business needs first, second, third, etc.. We will write it down and act accordingly as we help you take care of the security of your information and those people and devices that process it.

Confidentiality covers how hidden from view and kept secret the information is; and, yes, it should depend on what the information is. Integrity covers whether or not the information can be trusted to be authentic, and if we can trace any acesses and change back to the person who did it. Availability is about accessibility when needed. To some, Accessibility may be number one. To another, it could be Integrity. If you are processing personal health information or secret government information, Confidentiality may be number one. It all depends on your business. You must decide what works for it and what you want.

Who Needs Information Security Anyway?

Do you own a business and use the Internet? Do you send and receive Email? Do you have a computer that you use for work? Do you have a smart phone that has work information on it that you'd like to keep private and secure? Do you have more than one computer that are connected to each other? Do you keep customer and employee information on a computer? Do you have a web page? Does that page collect information for your business? Are you in the healthcare industry, the defense industry, or the legal field? Are you an accountant or any other type of professional for which you would keep names, addresses and phone numbers of clients? Does your business keep personal information about clients in a customer relationship management program or even in a spreadsheet so you can be more personable when you meet or talk to them? Is any of that information in some application exposed to the Internet (in the Cloud)? Are you prepared to handle an instance if someone were to physcally steal your servers hosting your business information?

If you answered "yes" to any one of those questions, no matter what the regulations say today, you do need a plan, a program and some processes to protect the information, the papers, the computers, the people who work for you and your business, at least a little. I am here to coach you into finding an equitable way that is prudent for what your business does and the money it makes doing it. It will take some thought, some work and some time, but not as much as you think.

NULL at the moment.