IMO this misses the mark. Yes, it’s a decent attempt at simplifying cybersecurity, but if this is aimed at entry-level, non-technical people, it’s not gonna work.
One of my earliest jobs was to redesign training materials for one of the worlds largest companies. I stripped the training to its core, the true basics, and started there. The results were remarkable. I feel the urge to do the same with this document…
https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.50.pdf
https://www.cisa.gov/sites/default/files/publications/fact-s...
https://www.cisa.gov/sites/default/files/publications/MFA-Fa...
I do a lot of explaining to non-techy people. My approach would be to print out the document and walk through it with them. Have the goal first be understanding of why certain things are a priority. Like it’s a baseball game: the three outfielders and three infielders are important to covering all your bases. We’re talking about this angle, in this context, and once the “why” is understood it’ll help them interpret the document correctly.
Not only are there links to go deeper into each subject matter but also a part telling the employer how to hire help if they need cybersecurity help and with a link to the "Small Business Cybersecurity Support Programs Finder" directory. Ideally they should be asking around in the small business community for a local vendor, but this document does a lot of things right.
I think this is an excellent document for small business and doesn't really talk down to them.
It’s a darn fancy algorithm and a cool tool. Putting it on a pedestal instead of grounding it to reality is not going to help anyone. My condolences to the authors.
You could say the president is just joking about such things; I don't think this will actually be acted upon, but the political/legal situation is quite rough.
Requests for comments from career security experts: is this any good?
As a "solo" anything you are going to fail sooner or later. At minimum one requires a gray-beard IT person/consultant with a vested interest in your survival, legal consultant in corporate contract/employment laws, legal consultant in Intellectual Property (Copyright/Trademarks/Patents), a commercial Accountant familiar with tax laws, and a customs broker to handle international shipping rules.
No one is an "expert" all the time, but without key people a small firm will get squashed pretty quickly. =3
What’s your advice to a non-technical / non-tech savvy small business owner? Say, for example, people used to buy anti virus as a solution. What could they do now that resembles that?
—-
I work with lots of non-technical / non-tech savvy small business owners and many of them are showing concern. So, I’d love to share as much as possible with the people who are not Palo Alto networks clients.
Otherwise, you need to start with an idea of what valuables you have and what threats - hackers? lawsuits? competitors? how well-resourced? - you're protecting against. No security will be perfect. You need to make it more expensive to steal your data than it's worth to the attacker.
A few general tips off the top of my head:
* As much as possible, don't store anything on a computer that you don't want to read in the news or hear read to you in court. The safest data doesn't exist. For any communications, set a retention period (e.g., delete messages in 30 days), and just save separately anything you need to keep.
* Store confidential data (passwords, credit card numbers, anything that can cost money or reputation) only in a secure database; the only exception is when the data is actually requird. Password databases, if they have long-enough fields, can work here. Do not keep it in emails - don't email around passwords, credit card numbers, etc.; otherwise when the hacker accesses your email, all is lost. This especially applies to confidential client data - you don't want to have to explain to all your clients, 'you're confidential data might have been stolen - I don't really know if they hacker found it or will use it.' With a secure database, you have peace of mind.
* Use Apple products. They prioritize security and have the resources to deliver on it; they are the fastest route to security. Windows' value is to larger organizations managing large numbers of computers. Linux is too complicated to secure for non-technical users (and probably isn't as secure as Apple). It does require trusting Apple, but you need to trust someone.
* Use Signal for communication, as much as possible.
* Security is much too hard to do yourself. Depending on need, use products that a vendor remotely manages (but then you need to trust the vendor). Use your firewall to filter viruses, though that's imperfect and you need to be careful about it slowing down throughput.
Hopefully the Canadian, Australian or some European governments have a better and functionally equivalent guide that can be better trusted not to mislead the reader.