Simple Cyber-security Practices

Cyber-security has been a topical issue of late in the wake of headline-grabbing incidents, like the Sony hack, the theft of compromising photos of celebrities from an online cloud (“celebgate”), and the revelation of a security vulnerability dubbed “heartbleed”. Unfortunately, as technology becomes increasingly sophisticated, so do the techniques used by tech-savvy miscreants to infiltrate computer systems. Further, in this era of Big Data, the amount of sensitive information potentially vulnerable to criminal activity is vaster than ever before.

Few (if any) computer systems can claim to be the digital equivalent of Fort Knox. But there are some simple steps you can and should take to help improve the safety of your data.

•  Keep software up to date, including anti-virus applications.

Out-of-date web browsers are susceptible to cyber-infiltration, malware, and viruses, as are machines that don’t have the latest anti-virus software installed. Do a bit of research, and invest in security software from a reputable company with a solid track record.

•  Create backup copies of everything that’s important.

Even ostensibly reliable computers can sometimes crash or malfunction, causing you to lose access to information stored on the hard drive. Pay particular attention to financial and human resources documents (including credit card information and social security numbers), records of transactions and accounts receivable/payable, databases and spreadsheets, and any other files you feel might cause a major headache if it ever went missing. Store these essentials either in a secure cloud, or offsite.

•  Set up an internet firewall.

Many computer operating systems have a firewall pre-installed, and you’ll simply need to enable it; alternatively, free firewall software can be downloaded from the internet. Again, make sure the software you use comes from a reputable source.

•  Control physical access to computers.

 Set up passwords for each machine, and request that each employee create a unique user name and entry code. Aim to change passwords every few months and in the event of employee turnover. Safely stow and lock up laptops that aren’t being used.

•  Secure your wi-fi network.

Your wireless network should have a unique password that’s at least 10 to 15 digits in length, containing upper-case and lower-case letters and numbers. Try to make it not only exceedingly difficult for a person to guess, but inordinately time-consuming for a password-cracking program to break.

•  Use extra caution with payment-processing.

When setting up a payment-processing arrangement with a bank or financial institution, ask about the latest security and anti-fraud measures and best practices. Try to isolate your payment system, and avoid using the same computer to handle financial transactions and browse the internet.

•  Leave software installation to people you trust, or do it yourself.

Many computer operating systems are outfitted to require password authorization  from a system administrator in order to install new software. Make sure this feature is enabled, so that employees (and unauthorized computer users!) cannot install software without your approval.

•  Read up on cyber-security.

With the pace of technological advancement occurring in our world today, experts occasionally stumble upon previously undiscovered vulnerabilities, and new programs that can thwart even the most sophisticated network security systems. Although not everyone can or should aspire to become a cyber-security connoisseur, it is in your interest to keep reasonably abreast of the latest developments in that area.

The U.S. Federal Communications Commission (FCC) has a page dedicated to cyber security for small businesses, including advice and resources. More useful information is available here, via a campaign called Stop.Think.Connect.

Areas of Potential Liability for Website Owners

When was the last time you read the fine print on the terms and conditions of a website? Most of us don’t take the time to read them, finding the legalese too boring. We just click "I accept" so we can get to the good stuff.

However, as a business owner you don't have the luxury of skipping over that fine print. In fact, those terms and conditions might actually become your strongest defense against frivolous litigation.

This is why companies invest in experienced legal counsel to craft liability language. This will make sure your business is protected even from the casual visitor who might have "issues" with your website content. The goal is to reduce the possibility of a lawsuit.  

Here are some things to consider adding to your own terms and conditions to afford any potential liability claims.

Protect your data. If you intend to sell your email list to a third party (it can be a good source of revenue) then you need to be protected with a strong "personal information" provision that spells out your intentions. Even if you don't plan to use that information you still want to be protected in the likelihood that the data is compromised.

Errors and omissions. This is a clause that is include in most business contracts but should also be included on your website. Suppose you post content with facts or figures that prove to be inaccurate or become out of date? Hopefully, you can correct that when notified but until then you shouldn't be held as negligent for a simple oversight.

Unknown malware. There is no telling if or when your website could be attacked by an outside entity until it is too late. If a visitor picks up a "virus" by visiting your site should you be held responsible? Not if you have the right kind of language in your terms and conditions.

Transmission problems. If your server goes down and a customer's own business or service is interrupted, you shouldn't be held liable. Crashes will happen and you'll need to be protected especially when the loss of data could occur.

Copyright infringement. You should do your best not to engage in any copyright infringement but that doesn't mean it can't occur. Suppose you have a forum where a user posts something that is protected. Are you liable? What if someone considers material as defamatory? You can't predict everyone's reaction to all that you'll be posting but you can protect yourself from those reactions.

Confiscation of data. There may be instances where a user's personal information is subjected to foreign government control. In the U.S. there are many heated discussions about this very issue as it pertains to investigations sanctioned by the Patriot Act. You can let your users know they might be subjected to these types of date mining through no fault of your company.

Fortunately, businesses have worked out many of these issues in their own terms and conditions language. You can take advantage of that by obtaining boilerplates of these provisions. You'll still need a lawyer to review them before you post on your website but using boilerplate language can reduce the costs of writing up this liability protection.