Cybersecurity For Small Businesses: The Dangers of Default Settings

When it comes to cybersecurity for small businesses, are you someone who believes that default settings are the safest, easiest choice? Well, we hate to be the bearer of bad news, but that assumption can prove dangerously wrong to your organization.

It’s an understandable decision, of course, sticking with the out-of-the-box security settings on devices and online accounts, but unfortunately these defaults are often designed for simplicity and broad use – not for protecting against the increasingly sophisticated cybersecurity threats that exist out there.

Take the recent example of a small business owner – Jane, we’ll call her. Jane trusted the default settings on her email and cloud storage, hoping they would safeguard her sensitive information. It seemed like a smart move—until hackers exploited those weak defenses, accessing her accounts, compromising client data, and causing significant financial damage.

Jane’s story is a stark reminder: default cybersecurity settings might be convenient, but they’re rarely the best defense.

In this blog post, we’ll dig deep into the issue, looking at how default settings can leave you vulnerable, and share some valuable tips to boost your digital security.

What are Default Settings?

To put it simply, default security settings are the pre-configured security measures that are standard on devices and online accounts. They are meant to provide a basic level of security by making sure that the product is user-friendly and can be easily accessed by a wide range of people. These default settings, however, often prioritize convenience over robust security.

Here’s a look at what the default settings typically entail:

Devices

For devices like smartphones, tablets, and computers, default security settings might include:

• Password and PIN Codes: Many devices come with a default password or PIN code – usually 1-2-3-4 – which users are asked to change during the initial setup. Be sure that you don’t stick with these simple or easily guessable passwords.
• Firewall Settings: Default firewalls are often set to allow many different types of traffic, which can leave your systems exposed to cyberattacks.
• Privacy Settings: Default settings may allow for more data sharing and tracking than is necessary for your online activity, potentially compromising user privacy.
• Automatic Updates: Some devices have automatic updates enabled by default, enabling the latest security patches to be applied, while others do not, thereby leaving systems vulnerable to newly discovered threats.

Online Accounts

For online accounts like email, social media, and cloud storage, default security settings often include:

• Lax Password Requirements: Initial password requirements for online accounts might not enforce strong, complex passwords, making accounts easier to breach.
• Two-Factor Authentication (2FA): As important as it is, this additional layer of security is often not enabled by default, even though it significantly enhances account protection.
• Privacy Controls: Default privacy settings may allow more public access to your information than desired, potentially exposing personal data.
• Permissions: Apps and services can have default permissions that grant more access to your data and activities than necessary.

What are the Dangers of Not Changing Default Settings?

As you can see from above, default settings are not nearly robust enough to defend against the sophistication of modern cyberthreats, leaving devices and online accounts vulnerable to a multitude of risks, including:

Security Vulnerabilities

• Default Passwords: Default passwords are often widespread knowledge, published in manuals or easily found online, making devices and accounts that retain these passwords susceptible to unauthorized access. Additionally, hackers often use automated tools to exploit known default credentials, gaining entry to cause harm or steal data.
• Open Ports and Services: Default network settings can include open ports that facilitate remote access or administrative functions, while devices often run default services that may not be essential. Both provide potential entry points for attackers and can increase the spread of malicious activity.

Privacy Risks

• Permissive Data Sharing: Default settings may allow devices and applications to share data with third parties, leading to unintended exposure of sensitive information. Similarly, many devices and online services include default settings that enable extensive tracking and profiling of user behavior, which can be used for targeted advertising or sold to other entities.
• Location Services: Devices like smartphones or smart home gadgets often have location services enabled by default, which can continuously track and log user movements and compromise privacy in the process.

Reduced Performance

• Resource Consumption: Default settings may include unnecessary background processes and applications that consume system resources, slowing down device performance, while unoptimized settings can lead to higher energy consumption, reducing battery life in portable devices.
• Update Management: Without proper configuration, devices won’t automatically receive essential security patches and updates, and the lack of updates results in compatibility issues and degrades the overall user experience.

Incompatibility and Malfunctions

• Generic Configurations: Default configurations are typically designed for general use and may not be suitable for specific needs or environments. They might also not be compatible with other systems or devices, both of which can cause a number of issues, including suboptimal performance and functionality, integration challenges, and malfunctions.

Lack of Customization

• User Experience: Default settings may not take advantage of all the features a device or service offers, while interface preference might prevent users from customizing the interface and functionalities to better suit their personal preferences and workflows.

Regulatory and Compliance Issues

• Data Protection Regulations: Most data protection laws, including GDPR or CCPA, require stringent privacy and security controls. Relying on default settings could result in non-compliance, leading to legal repercussions and fines.

What Network Security Controls Should Small Businesses Implement?

It’s imperative that cybersecurity for small businesses includes a wide range of robust network security controls to protect against cybersecurity threats. To be effective, these measures need to go beyond the default settings.

Here are 13 crucial network security controls to consider:

1. Strong Password Policies

Implement policies requiring complex passwords that combine letters, numbers, and special characters, mandate periodic password changes, and use password managers to store and generate strong passwords securely.

2. Two-Factor Authentication (2FA)

Make sure that accessing critical systems and accounts requires two-factor authentication for an extra layer of security.

Pro tip: Use authentication apps over SMS-based 2FA.

3. Network Firewalls

Set up and properly configure firewalls to control incoming and outgoing network traffic and deploy next-generation firewalls (NGFW) to tap into features like deep packet inspection, intrusion prevention, and application awareness.

4. Regular Software Updates and Patching

Enable automatic updates for all software, operating systems, and firmware and implement a patch management system to track and deploy updates promptly.

5. Endpoint Protection

Install and regularly update antivirus and anti-malware software on all devices, and utilize Endpoint and Detection and Response (EDR) solutions to monitor and respond to suspicious activities on endpoints.

6. Secure Wi-Fi Networks

WPA3 encryption for wireless networks can protect data transmitted over Wi-Fi, while it’s advisable to create separate networks for business operations and guest access to limit exposure. You can also configure Wi-Fi networks to hide their SSID to make them less visible to unauthorized users.

7. Virtual Private Network (VPN)

Require employees to use VPNs when accessing the business network remotely, and be sure that the VPN is configured securely and uses strong encryption protocols.

8. Access Controls

Implement Role-Based Access Control (RBAC) to make sure employees only have access to the information and systems necessary for their roles. Also, be sure to grant the minimum level of access required for users to perform their job functions.

9. Intrusion Detection and Prevention Systems (IDPS)

Conduct regular security audits and penetration testing to identify and address vulnerabilities, deploy IDPS to monitor network traffic for suspicious activities, and take automated actions to prevent attacks.

10. Data Encryption

Utilize encryption and secure key management to protect sensitive data both in transit and at rest.

11. Backup and Disaster Recovery

It’s important to perform regular backups of critical data and to store the backups in a secure, offsite location. And in the case of a cyberattack, a strong disaster recovery plan will ensure business continuity.

12. Employee Training and Awareness

Conduct regular cybersecurity training sessions to educate employees about common threats and safe practices, and run phishing simulations to test and improve employees’ ability to recognize and avoid phishing attacks.

13. Network Segmentation

Divide the network into smaller, isolated segments to limit the spread of malware and implement Virtual Local Area Networks (VLANs) to separate and secure different types of traffic within the network.

By implementing these network security controls, small businesses can significantly enhance their defenses against cybersecurity threats, ensuring a more secure and resilient network environment.

Computer Resources of America (CRA) is one of the top cyber security companies in New York, offering managed IT support and cloud security services that go far beyond the default settings to ensure that your company and its data are protected from cyberattacks.

Reach out to CRA today to discover all we can do to help keep your business safe!