Require Device Updates from Your Team

In Part I, we recommended you toggle updates to happen automatically for your mobile devices, laptops, and other devices. This will still be the case for the devices you use now as a small business, except with the added complexity that you are not the only one using or controlling those devices. If staff are using personal devices, there is even more complexity, as you might not be able to legally tell them what to do with that device even if they are using it for work.

Think of it this way: every copy of business data we have, the more security risk we introduce. That makes sense, because you are increasing the chances of it getting lost or stolen. Every copy of data therefore needs to be protected with the same level of security to prevent this from happening. When you are a small business, the resources needed to scale that security can be a challenge. Access to data is the same as duplicate copies of data—the more ways you can access the data, the more security risk you have.

If your staff log into work accounts from their personal devices, ensure that there is a way to protect the work data that device has access to—in the same way you would protect the data on a work device with anti-malware software or an up-to-date operating system.

If your staff take their work devices home, be sure that your staff can apply good physical security controls to protect that device—in the same way you would physically protect it at the office by keeping it behind locked doors.

Let’s be real here too: the assumption we made at the start of this part was that your staff are not necessarily technical experts. They might not know how to digitally or physically protect a device. If their job does not require them to have these skills, this is a fair assumption to make. You will need to consider if it is fair to put the burden of that security risk on them, or if things in your business need to change.