🔹 Cybersecurity basics

• Use a password manager and unique passwords for every account.
• Enable multi-factor authentication (MFA) everywhere possible.
• Keep operating systems and applications updated.
• Limit admin privileges; use least-privilege principles.
• Train staff on phishing and safe browsing habits.

🔹 Understanding the NIST Cybersecurity Framework

The NIST CSF has five core functions: Identify, Protect, Detect, Respond, Recover.

• Identify: Know your assets, data flows, and risks.
• Protect: Implement safeguards like access control, training, and hardening.
• Detect: Monitor systems and logs to spot anomalies.
• Respond: Have an incident response plan and defined roles.
• Recover: Backups and restoration plans to resume business operations.

🔹 Physical security

• Restrict access to server rooms and network equipment; lock unused workstations.
• Use cable locks and secure disposal for old hardware (drive wiping).
• Ensure visitors sign in and are escorted.

🔹 Ransomware

• Maintain regular, tested backups stored offline or in an immutable cloud location.
• Segment networks so infections can’t spread freely.
• Keep software patched and disable unused services.
• Use endpoint protection with behavioral detection.

🔹 Phishing

• Train employees to recognize suspicious emails.
• Use email filtering and attachment sandboxing.
• Test regularly with simulated phishing campaigns.

🔹 Business email impostors (BEC)

• Verify wire transfer requests through a known phone number — never by reply email alone.
• Enable strict email authentication (SPF/DKIM/DMARC).
• Limit who can approve payments; use multi-person approval for large transfers.

🔹 Tech support scams

• Never let unknown callers remote into business systems without verification.
• Maintain an approved-vendor list for remote access tools and keep software updated.
• Train staff to hang up and report unsolicited support calls.

🔹 Cyber insurance

• Keep documentation of security controls and incident response plans for claims.
• Understand coverage, exclusions, and legal/regulatory requirements.

🔹 Email authentication (SPF, DKIM, DMARC)

Set up SPF and DKIM for sending domains and publish a DMARC policy.

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com;

🔹 Vendor security

• Maintain an inventory of third-party vendors and the data they can access.
• Request security questionnaires and include minimum-security requirements in contracts.
• Use contractual right-to-audit clauses for high-risk providers.

🔹 Hiring a web host

• Choose a host that offers automated backups, TLS/HTTPS, and timely patching.
• Prefer hosts that isolate customers and provide logging/monitoring.
• Check uptime SLA, support channels, and data center locations.

🔹 Secure remote access

• Use a VPN or Zero Trust Remote Access solution — don’t expose RDP/SSH directly to the internet.
• Require MFA for remote connections and use device posture checks.
• Log and monitor remote sessions; rotate credentials regularly.

Quick checklist

• Passwords + MFA
• Backups (test restores)
• Patch management
• Email authentication
• Vendor inventory
• Incident response plan