This document provides information security recommendations and best practices for small businesses. It discusses identifying critical business assets, safeguarding people, processes, and technology. Specific recommendations include implementing policies, access controls, backups, antivirus software, firewalls, wireless security, software patching, and employee training. The document emphasizes establishing a strong security foundation through assessing risks and prioritizing asset protection based on confidentiality, integrity, and availability needs.

1. Information Security For Small Businessby Julius Clark Sr., MBA, CISSP, CISA

2. About MeBDPA History2010-2012 Charlotte President2010-2012 National BDPA CISO2007-2009 Charlotte President-Elect2006-2004 VP of SITES (Education)2001-2003 Charlotte HSCC CoordinatorEducationMBA in Information SecuritySalem International University, Salem, WVMSIS in Information SecurityUniversity of Fairfax, Fairfax, VABS in Electronic EngineeringWentworth Institute of Technology, Boston, MACertificationsCertified Information Systems Security Professional (CISSP)

3. Certified Information Systems Auditor (CISA)

4. Microsoft Certified System Engineer (MSCE).Julius Clark Sr.Location: Charlotte, NCCurrent home, been residing in Charlotte, NC for over 10 yearsHometownBoston, MaProfessionInformation Security Professional.2

5. AgendaInformation Security for Small Business3

6. Agenda (Continued)Information Security for Small Business4

7. IT Security &Business Wholeness5

8. Maslow’s Hierarchy of NeedsBeing aware of one’s Wholeness keeps bad things from happening. A solid foundation must be built to advance. Understanding your environment, your health and activities helps one to continually perform risk assessments and move to the next level.Self – Actualization – Being All You Can Be

9. Esteem - Recognition for Good Work

10. Love - Acceptance

11. Safety & Security – Stability

12. Needs – Air , Food, Water, Shelter6

13. Maslow’s Business ComparisonMaslow’s Hierarchy of Needs can be applied to building a successful business. IT Security is a foundation that businesses must build upon to lower IT Security risks, which can help your business gain a competitive edge.Self – Actualization – Meeting the Mission Statement

14. Esteem - Recognition in Market Place

15. Love - Acceptance by Clients or Customers

16. Safety & Security – IT Security & Insurance

17. Needs – Capital & People7

18. Importance of Small BusinessesStatistic:There are over 26 million small businesses in the U.S.Source: NIST8

19. What Is At Stake?Your Business! Your business is at risk of being damaged due to:Financial loss

20. Lawsuits

21. Reputation loss

22. loss of market share

23. Theft of its technology , resources and products

24. Denial of service attacks

25. Blackmail9

26. What is Information Security?10

27. What Is Information Security?Protecting your information, technology, property, products and people; all vital business assets. The Information Security Triad is the foundation for Information Security and is based on concepts and principles known as CIA.Confidentiality

28. Integrity

29. Availability11

30. What Is Information Security?ConfidentialityConcept of protecting information from improper disclosure and protecting the secrecy and privacy of sensitive data so that the intellectual property and reputation of an organization is not damaged and that data related to individuals is not released in violation of regulations or the privacy policy of the organization.- From the CISSP® CBK®12

31. What Is Information Security?IntegrityAddresses two objects, which are protecting data and processes from improper modification, and ensuring the operations of the information is reliable and performing as expected.- From the CISSP® CBK®13

32. What Is Information Security?AvailabilityThe concept of ensuring that the systems and data can be accessed when required. Availability is impacted by human error, cabling problems, software bug, hardware failures, loss of skilled staff, malicious code, and the many other threats that can render a system un-usable or unreliable. - From the CISSP® CBK®:14

33. Components of information security architecture 15

34. Components of Information Security ArchitectureThe process of instituting a complete information security solution to the architecture of a business, ensuring the security of business information at every point in the architecture. People

35. Processes

36. Technology16

37. Components of Information Security ArchitecturePeoplePeople are the weakest link of a business’ process. You all know why!17

38. Components of Information Security ArchitectureProcessesThe operational aspects of small business. Safeguards can be automated or manual. 18

39. Components of Information Security ArchitectureTechnologyAll of the tools, applications, software, and infrastructure that allows a business process to work and perform efficiently. Thus as a business owner you must ensure that you have adequate logical controls in place to help you stay on track with your business’ mission or purpose.19

40. Cyber Crime In the news20

41. Who Are The Actors?Their Roles:Experimenters

42. Hacktivists

43. Cyber criminals

44. Information Warriors

45. Employees

46. Dumpster divers

47. Natural disasters

48. Terrorist activities21

49. Who Are The Actors?Malicious Code!Key loggers – Stealing your keystrokes

50. Viruses

51. Denial of service

52. Turning your computer into a zombie aka “Bot”22

53. Cyber Crime In the News23

54. Cyber Crime Statistics!Insider threats are responsible for over 80% of small business issues.There are over 70,000 active viruses ; and exponentially growingInformation Security threats can damage or destroy small business33% of businesses with 100 employees or less had a computer incidentSource: NIST24

55. Cyber Crime Statistics!Small Business Cyber Crime Report42 % of businesses had a Laptop theft44% of businesses suffered from Insider Abuse21% of businesses reported Denial of Service50% of businesses detected a viruses20% of business systems became a “Bot”Source: Computer Security Institute Survey25

56. Cyber Crime Statistics!Reported Data Breaches2007 - there were 445 data breaches reported 2008 – there were 656 data breaches reported2009 – approx. 392 data breaches reported.Source: October 9, 2009 USAToday 26

57. 27Chronology of Data Breacheswww.privacyrights.org

58. 28Chronology of Data Breacheswww.privacyrights.orgThe 354,537,108 indicates the total number of records compromised