Security Academy: A Free Compliance and Cybersecurity Resource for Your Small Business

Here at SecurityMetrics, we understand the mental and financial strain cyber attacks can cause. After all, the genesis of SecurityMetrics came from a website hack. 

Brad Caldwell–now the CEO of SecurityMetrics–owned a company whose website was compromised. He wanted to secure his website and began searching for an affordable solution, but quickly realized that there wasn’t an affordable solution available. 

In 2000, Brad created SecurityMetrics to fill that gap and offer an inexpensive solution to other companies with cybersecurity and compliance needs. 

SecurityMetrics Security Academy is an extension of that original purpose: it’s a free training resource designed to educate small businesses about their risks and explain which compliance programs they can adopt.

Security Academy is a beginner-level course that takes approximately 3 hours to complete, but it’s also a free resource you can return to when you have cybersecurity questions. 

Overview of Academy

This blog offers a quick overview of the content covered in Security Academy. The course follows this flow: 

• Policies and Procedures
• Handling Sensitive Data
• IT Security Tools
• Managing a Data Breach
• Compliance Mandates

You can study the sections in any order, but we’ll follow this order for now. 

Policies and Procedures

In reality, the data security and compliance process starts with proper documentation of your policies and procedures. Good documentation sets the stage for compliance, employee training, and creating a culture of security within your organization.

This section covers many topics that will help you solidify your policies and procedures, including: 

• Firewall Rules
• System Hardening Standards
• Data Retention Policies
• Password Policies

Completing this training section will help you understand what documentation you need to create and its purpose. As you complete this section, make sure you are honest about the areas where your organization is most vulnerable and utilize this information to fortify your security posture. 

How to Properly Manage Sensitive Data

This section outlines what counts as sensitive data and how you can secure your customer's data. Here’s a snapshot of the subsection highlights: 

• Risk Assessment and Risk Management Plan: Get a 5-step outline to conduct your own risk assessment and develop a risk management strategy. 
• Data Encryption: Gain insight into the why and how of Data Encryption, starting with the basics.
• Data Destruction: If you’re unsure of the right way to destroy sensitive data, jump here.
• Wifi: Learn best practices for wireless network security.
• Secure Remote Access: Remote access allows employees to work from home, but it can cause vulnerabilities–this section gives tips on avoiding common remote access pitfalls.

Security Tools

There’s no one silver bullet when it comes to preventing data breaches, but working to protect data and fix your network vulnerabilities is an important job—so, having the right tools can mean the difference between a data breach and “business as usual.”

Most businesses know about firewalls and anti-virus software, but there are other foundational cybersecurity tools at your disposal. This section will help you determine which tools you need and the best time to use them.  

These are the subsections: 

• Firewalls
• Anti-virus / Anti-malware Software
• Logging and Log Monitoring
• Data Breach Prevention Tools
• Vulnerability Scanning
• Penetration Testing
• Conducting Audits

How to Respond to a Data Breach

For some businesses, the fear of a data breach causes them to stick their head in the sand and hope it never happens to them. However, preparing for the possibility of a breach can save your business and reduce the damage a breach would cause. 

If you’re proactive, you can diminish bad press, limit negative impacts, and reduce potential fines. 

This section will help you prepare for a possible data breach by offering tips on creating your incident response plan and on finding the right balance between breach prevention and management. 

Compliance Mandates

Based on the kind of data your company handles, you will need to comply with different regulations. This section covers PCI DSS, HIPAA, and GDPR, and it’s a great starting point to understand your company’s compliance responsibilities. You can return to it for a refresher or for links to more detailed information. 

Conclusion

This last section outlines the possible costs of a breach, not as a scare tactic, but as a realistic breakdown of the possible consequences of a breach. Ultimately, strengthening your cybersecurity means strengthening your business. 

While cybersecurity is not a box that can be simply checked, becoming educated can give you the confidence and know-how to avoid cyber threats. We hope this free resource will give you the boost you need to identify areas of improvement in your business.