Cybersecurity for Roanoke Small Businesses: 10 Steps to Protect Your Company
Small businesses in Roanoke and across Virginia are prime targets for ransomware and phishing. Here are 10 practical steps to protect your company, in the order we'd tackle them.
"We're too small to be a target"
I hear this from business owners around Roanoke all the time. It makes sense on the surface. Why would a hacker care about a 30-person machine shop in Salem or a dental practice off Electric Road?
The honest answer: they don't care who you are. Most attacks today are automated. Criminals send phishing emails by the thousands and scan the internet for any firewall with a known weakness. Small businesses get hit precisely because they tend to have fewer defenses, and many will pay a ransom just to get back to work.
The good news is that you don't need an enterprise budget to be a much harder target. Most attacks we see succeed because of a handful of basic gaps. Here are the 10 steps I'd take, roughly in the order I'd take them.
10 steps to protect your business
1. Turn on multi-factor authentication (MFA) everywhere. Email first, then your VPN, accounting software, and any remote access tools. A stolen password is far less useful to an attacker when they also need a code from your phone. If you only do one thing on this list, do this.
2. Get your backups right. Follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy offsite or offline. Then test a restore. I've walked into more than one office where the backups had quietly been failing for months.
3. Replace basic antivirus with EDR. Traditional antivirus looks for known bad files. Endpoint detection and response (EDR) watches for suspicious behavior, like a program suddenly encrypting hundreds of files, and can stop it mid-attack.
4. Patch on a schedule. Windows, firewalls, VPNs, and anything facing the internet. Many breaches use weaknesses that had a fix available for months. Pick a monthly patch window and stick to it.
5. Train your people, briefly and often. Most attacks start with an email. Short monthly phishing simulations work better than one long annual training that everyone forgets by lunch.
6. Clean up admin access. Daily work should happen on standard accounts, not administrator accounts. Remove accounts for former employees the day they leave. Review who has access to what at least twice a year.
7. Lock down email. Turn on spam and malware filtering, and set up SPF, DKIM, and DMARC on your domain. These make it much harder for someone to send email that pretends to come from you or your vendors.
8. Segment your network. Your guest Wi-Fi, your office PCs, and any shop-floor or medical equipment should not all live on the same flat network. If one device gets compromised, segmentation keeps the problem contained.
9. Secure remote access. Never expose Remote Desktop (RDP) directly to the internet. Use a VPN with MFA, and keep that VPN patched.
10. Write a one-page incident plan. Who do you call? Who can shut systems down? Where are the backups? Where's your cyber insurance policy number? Deciding this during an attack is the worst possible time.
What Virginia businesses should know
Virginia has a data breach notification law. If unencrypted personal information about Virginia residents is exposed, such as names with Social Security numbers, driver's license numbers, or financial account details, businesses generally must notify the affected people and the Virginia Attorney General's office without unreasonable delay. Encrypting laptops and sensitive files is one of the simplest ways to reduce that risk. Talk to your attorney about exactly how the law applies to you.
Your industry may add requirements. A few that come up often in the Roanoke region:
- Manufacturers supplying the Department of Defense are seeing CMMC requirements show up in contracts.
- Healthcare practices need to meet HIPAA security requirements for patient data.
- Almost everyone with cyber insurance now has to answer detailed questions about MFA, backups, and EDR. A "no" can raise premiums or lead to a denied claim.
The 10 steps above cover a big share of what these frameworks and insurers ask for, so they're worth doing even before compliance becomes a formal requirement for you.
Where to start
You don't have to do all 10 this month. Start with MFA, backups, and EDR. Those three alone stop a large share of the attacks hitting small businesses today. Then work down the list.
If you'd like a second set of eyes, SoftwarePac offers a free cybersecurity assessment for businesses in Roanoke and across Virginia. My partner Mukesh has spent 25 years in cybersecurity, and together we'll review your network, backups, and security setup. You'll get a plain-English list of what to fix first. No pressure, no jargon.