Due to the tight funding of small businesses, it is difficult to invest a large amount of money in network security. However, with the increasing emphasis on domestic network security regulation, small businesses can ensure network security without excessive investment by following the following steps:
- By implementing a strong password policy and requiring employees to use unique and complex passwords, small businesses can greatly reduce the risk of unauthorized access to their networks and data.
- Regularly update software and system patches.
- Use a VPN for internet access.
- Develop a plan to respond to network security attacks.
- Provide security awareness training for employees.
The above five points are sourced from: The Importance of Cybersecurity for Small Businesses | by Ismail Tasdelen | System Weakness
The above points are technical security requirements. In addition to the above five points, the following items can be added based on the domestic situation:
- Log retention that is of regulatory concern, requiring logs to be kept for 6 months. The company can set up a log server and regularly back up the logs.
- Risk assessment and level protection required by the "Cybersecurity Law". Risk assessment can be entrusted to a third-party company, and the level of protection depends on the company's business system. If it is not too important, a level 1 or 2 can be implemented. Level 3 requires the involvement of a third-party security company. If level 3 protection is required, corresponding security equipment needs to be implemented, which will increase costs.
- The asset inventory must be updated in a timely manner. It is important to be familiar with one's own assets and minimize the opening of various services to the outside by not opening unnecessary ports.
- If there are business systems, regularly use open-source vulnerability scanning tools for periodic scanning.