CYBERTHREAT RECOGNITION & MITIGATION: A GUIDE FOR SMALL & MEDIUM SIZED BUSINESSES (SMBs)This document is provided for educational and informational purposes only and is not intended and should not be construed as providing legal advice. U.S. Government and the IC Private Sector Public Sector Analyst exchange program partners (the “Exchange Program Partners”) do not warrant or assume any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process discussed in this document. U.S. Government and the Exchange Program Partners do not endorse or recommend any commercial products, processes, or services. The views and opinions expressed in this document do not necessarily state or reflect those of the U.S. Government or the Exchange Program Partners, and they may not be used for advertising or product endorsement purposes.2016 PUBLIC-PRIVATE ANALYTIC EXCHANGE PROGRAMPPAEP_406db18c-bbd4-11e6-985b-d6d3f7e90587This program enables intelligence community analysts and private sector partners to gain a greater understanding of how their disparate, yet complementary roles can work in tandem to ensure mission success.SMBsSmall and medium-sized businesses.Cyber Threat Recognition and Mitigation Group ContributorsDepartment of DefenseDefense Intelligence AgencyFederal Bureau of InvestigationAmgenHewlett Packard EnterpriseStratusCyber Small Business SecurityVirginia Department of TaxationArmera Cyber SolutionsImproved cybersecurity_406db2ea-bbd4-11e6-985b-d6d3f7e90587To provide a path to improved cybersecurity_406db380-bbd4-11e6-985b-d6d3f7e90587PreparationPrepare for cyber-attack._406db402-bbd4-11e6-985b-d6d3f7e905871Small businesses must prepare for cyber-attack. The first three steps to prepare for a cyber-attack on your business involve PEOPLE, SYSTEMS, and BACK-UPS.PeopleEducate employees about the threat._406db48e-bbd4-11e6-985b-d6d3f7e905871.1Step one, PEOPLE. Educate employees about the threat, starting with use of strong passwords and learning about threats like phishing.SystemsProtect your systems and data._406db51a-bbd4-11e6-985b-d6d3f7e905871.2Step two, SYSTEMS. Protect your systems and data by using some of the many software tools available, starting with Anti-Virus and a Firewall.Back-UpBack up your data._406db59c-bbd4-11e6-985b-d6d3f7e905871.3BACK-UPS, step three, gives you a do-over, after an attack instead of going out of business, it allows you to start again from where you left off.PreventionPrevent cyber-security breaches._406db632-bbd4-11e6-985b-d6d3f7e905872Some of the most affordable yet effective prevention techniques that SMBs can employ to prevent cyber-security breaches include: firewalls, intrusion prevention software and Anti-Virus software, strong passwords with expiration timers, disabling and uninstalling any unused services and software to limit entry points into the system, application whitelisting/black listing and physical access controls (e.g. locked doors, offices, cabinets). Software should also be patched with the latest vendor releases so that known security flaws are closed.Firewalls_406db6b4-bbd4-11e6-985b-d6d3f7e905872.1Intrusion Prevention_406db740-bbd4-11e6-985b-d6d3f7e905872.2Virus Protection_406db7d6-bbd4-11e6-985b-d6d3f7e905872.3Password Protection_406db862-bbd4-11e6-985b-d6d3f7e905872.4Entry Points_406db8ee-bbd4-11e6-985b-d6d3f7e905872.5Whitelisting/Black Listing_406db9c0-bbd4-11e6-985b-d6d3f7e905872.6Physical Access_406dba60-bbd4-11e6-985b-d6d3f7e905872.7Software Patches_406dbaf6-bbd4-11e6-985b-d6d3f7e905872.8DetectionMonitor the network for advanced persistent threats._406dbb8c-bbd4-11e6-985b-d6d3f7e905873Consider using a managed security service provider to monitor your network for advanced persistent threats. An endpoint security solution will provide additional security for your endpoints (laptops/workstations/servers). This defense-in-depth strategy enhances the security tools and best-practices in your prevention strategy. Your diligence is critical!Signs & SymptomsFamiliarize yourself with the signs and symptoms of an infected system._406dbc2c-bbd4-11e6-985b-d6d3f7e905873.1Emerging Threats & Security UpdatesUse security resources and information channels to keep current on emerging threats and security updates._406dbcc2-bbd4-11e6-985b-d6d3f7e905873.2Security Service ProvidersKeep the contact information of security service providers that manage your security._406dbd6c-bbd4-11e6-985b-d6d3f7e905873.3Security Service ProvidersOther ProfessionalsIdentify other professionals that you can call to help you recognize and respond to security incidents and breaches. _406dbe0c-bbd4-11e6-985b-d6d3f7e905873.4ResponseRespond thoroughly to incidents._406dbeac-bbd4-11e6-985b-d6d3f7e905874When an incident is detected, it is important to respond thoroughly and timely.ContractsWork with pre-established contacts to contain, mitigate, and eradicate the threat._406dbf56-bbd4-11e6-985b-d6d3f7e905874.1Alerting & ReportingAlert affected parties and provide progress reports throughout the incident._406dbff6-bbd4-11e6-985b-d6d3f7e905874.2RemovalEnsure all the attacker's artifacts are eliminated from affected systems._406dc0aa-bbd4-11e6-985b-d6d3f7e905874.3Causes & SymptomsDetermine cause and symptoms of the incident._406dc186-bbd4-11e6-985b-d6d3f7e905874.4PatchesPatch all vulnerabilities._406dc258-bbd4-11e6-985b-d6d3f7e905874.5RestorationRestore data appropriately from backups._406dcab4-bbd4-11e6-985b-d6d3f7e905874.6EvidencePreserve evidence so law enforcement action can potentially be taken against the perpetrator._406dcb18-bbd4-11e6-985b-d6d3f7e905874.7Law Enforcement OfficialsRecoveryCreate a disaster recovery plan._406dcb19-bbd4-11e6-985b-d6d3f7e905875Internet Service ProvidersHardware VendorsTrade AssociationsReady.govNISTSBAYou've been hacked, you've responded appropriately to the incident and now you need to recover. The extent of your recovery may include the computer room and environment, the hardware, connectivity to a Internet Service Provider (ISP), software applications, and restoration of your company's data. Help from your ISP, hardware vendor, trade associations or major clients may be available. A number of helpful ideas can be found on the Ready.gov, NIST, SBA and other official websites. If you have not yet created one, a disaster contingency planning policy or reference book can be crucial in times of crisis._406dcb1a-bbd4-11e6-985b-d6d3f7e905872016-12-06http://files.constantcontact.com/311cbc2c401/29358b0c-5a58-4ba1-8aa4-0716037493b5.pdfOwenAmburOwen.Ambur@verizon.net