After going through the business I advised them to put in place a number of steps that would go a long way towards protecting them. It must be noted that the business in question did not deal with any payments card information (PCI), personally identifiable information (PII) or personal health information (PHI) if your business is dealing with the above then you will need to put more controls in place.
My plan for the business was pretty simple and I will lay it out below.
1) Education:
This is one of the fundamental roles that small businesses neglect, there are hundreds of services out there that will do training days on different areas in an easy to understand and education manner. If you can train staff to identify Phising, Smishing and other everyday threats then you are starting to win a war on the front line. Education helps get employees to think before opening an attachment or giving out "harmless" information over the phone. For the more adventures small business there are packages available for you to run harmless attacks that contain educational videos when clicked. PhishMe would be one such company that comes to mind in that regard.
2) Backups:
This one is quite simple but often forgotten, with the rise of ransomware every small business should keep daily or weekly backups. These backups should be occasionally tested to ensure that they can restore systems in the event of an emergency such as a ransomware infection.
3) Business Continuity Plan:
Every business should have one and should test it, you can work on building this up over a period of time but you need to start somewhere. EG. if the building floods are our desktops on the floor? Maybe we should elevate them to mitigate this problem. During this flood do employee have the ability to work from home? Yes we have remote access to the building over our companies VPN.
The above are just suggestions but you get the drift if you start to disect your company and compare it to potential events you might be surprised what you come up with. Fail to prepare then prepare to fail.
4) Virus and Anti- malware protection:
Again this is simple but neglected in many small businesses, buy a good antivirus and anti-malware package and set the updates to times you know your employees wont shut them down eg lunch time or after working hours. A good antivirus and malware solution is like having a security guard in your network throwing out all the bad guys.
5) Enable Bit-locker or the equivalent:
Bit-locker encrypts your disk so if someone breaks in and robs your physical machine in theory bit-locker will keep that information safe, unless of course the thief is Homeland security or the equivalent in which case your data is the least of your worries.
6) Password Policy:
Put in place a robust password policy that includes the rotation of passwords regularly and password history check to prevent the re-use of passwords.
7) Third party checks:
If you are using a third party to store data or to provide remote support ask them to provide you with a list of controls that are in place to protect you from a security point of view. If they tell you they are super secure and you need to trust them get worried because this means they haven't got anything to give you and your cloud solution is some guy with a laptop and 15 housemates that use it to stream illegal movies.
8) Document everything!
You should document all of your procedures and workflows because if one guy has all this information and gets hit by a bus your knowledge is dead. Good documentation is key to smooth transition and helps aid security through clarity.
If you get all the above in order you will have made a decent move towards securing your business at a minimal cost, of course there is plenty of room to do more but the hardest part is always to make a start.
