Strengthening Network Security on a Budget: A Small Business Case Study

Working for a small business can be highly rewarding, offering the chance to acquire new skills and help the company grow in various ways. However, small businesses often face limitations in terms of budget and resources. As the business expands, the need for robust physical and cybersecurity measures becomes increasingly crucial, especially when managing sensitive customer data and offering cloud services. This article shares the journey of our small team working on a tight budget to enhance the security posture of our internal and external systems.

Implementing a Strong Password Policy

A critical issue in the small business was the shared password practice for accessing internal workstations, a legacy from the days when the business was family-run. The first priority was to prevent employees from accessing systems they didn't need to. This was achieved by adopting an enterprise password management system that enabled managing and enforcing unique passwords for everyone.

Restricting Remote Access

The company uses TeamViewer to connect its internal systems and many customer systems. To prevent unauthorized access, access groups were created, ensuring employees could only access customer systems and not internal ones they didn't need.

Network Monitoring with a SIEM Solution

The most significant step in enhancing security was implementing a Security Information and Event Management (SIEM) solution for network monitoring. We set up a Security Onion server and configured all systems to report to it. Security Onion allows us to view logs from networking equipment, workstations, servers, and track network issues.

For instance, we identified Windows login attempts from a public IP address targeting one of our cloud applications. After investigating, we discovered unnecessary port forwarding on the firewall and resolved the issue. This example highlights the importance of active network monitoring in maintaining a secure network.

Physical Security Measures

As a business with extensive experience in physical security, We already had well-established measures in place to protect the premises and assets. Some of these things Include:

• Security Alarm System
• Surveillance Cameras
• Access Control System
• Server Room Security

Conclusion

Enhancing network security is an ongoing process, and we continue to improve our systems. Future plans include setting up alerts for potential issues and adding more monitoring solutions.

This article demonstrates that, even with limited resources, small businesses can take practical steps to strengthen their cybersecurity posture and protect sensitive data.