Subscribe
Share
Share
Embed
Business success is dependent on a solid financial foundation & success looks different to everyone & there is a lack of equity of access to resources and information for small business owners and independent contractors & there is a societal narrative making us believe “balance” is our ultimate goal & … There are so many “&”s that impact being your own boss. Let’s have some frank discussions on the basics of business with a holistic focus on everything that helps business owners define and find success.
Molly Beyer: [00:00:08] Welcome to The Ambiguous &: Business Basics and Beyond, the podcast where we have frank discussions on the basics of business with a holistic focus on everything that helps business owners define and find success. Each episode is a reminder that success isn't one thing, it's a whole lot of ambiguous ands. Like, subscribe, or follow, and let's explore these ambiguous ands.
Molly Beyer: [00:00:34] Hello, and welcome to The Ambiguous &: Business Basics and Beyond. I'm your host, Molly Beyer, and I'm here to lead you through frank and holistic conversations on the basics of business. And today, we're jumping back into some of our outsourcing conversations, and we are going to talk about something that I honestly wish I didn't have a personal story about, and that is cyber security. More specifically, I want to talk about why I think small business owners need to stop thinking of cyber cybersecurity as an IT problem and start thinking about it as a business risk. This episode might be a little bit longer, but I really hope you stick around. I've got some truly helpful information for anybody running a business. I'm going to tell you a little bit about something that happened to us. But before I do, I want to tell you what I'm not going to do. I'm not going to give you all the technical details, and I'm not going to tell you exactly what systems were involved. I'm not going to tell you exactly how the attack happened or exactly what our security team did to respond to it.
Molly Beyer: [00:01:34] Some of that is confidential, because I have a responsibility to protect my business and the people whose information we handle. And frankly, some of it just doesn't need to be public information. So I'm going to tell you enough to explain what happened, what it made me realize, and what I think other small business owners need to be thinking about. The part of the story that really matters isn't that the attack itself was ultimately contained. It's that it got close enough to make me realize how much I didn't know. So yeah, we had a cyber attack against our business and ultimately it was contained before it caused harm. And that is the good news. But here's the thing about saying something like it was contained before it caused harm. It can make the whole thing sound a lot less significant than it actually was. Because when you think about a cyber attack, I think most of us still have this picture in our heads of a hacker getting into our computer. You know, you click on a bad link and your screen goes black, and then a ransom message pops up and your files are encrypted and now you're in crisis. And yeah, that can happen. But that's not the only way this works anymore. And honestly, what happened to us was a good reminder that some of the most concerning attacks really aren't the obvious ones.
Molly Beyer: [00:02:52] The people that are trying to get into businesses are getting a lot smarter. They're getting better at making things look legitimate. They are getting better at working around the filters and systems that we have designed to keep them out, and they're getting better at exploiting the fact that we are all busy humans who are doing our best to run a business. The attack we experienced involved things that, on the surface, could have looked like normal business activity. And that's what really got my attention. Because if you only define a cyber attack as something like, I received an obviously fake email from a Nigerian prince asking for my bank account, then you're probably thinking you're pretty safe. But that is not the world that we are operating in anymore. One of the things I really want to get away from in these conversations about cyber security is this idea that it is a problem of people being stupid, because that is not helpful. The person who falls for a phishing attack isn't necessarily careless, they are maybe tired. They are probably distracted. They are probably dealing with 47 things at once. They might just receive a message that looks like it came from a vendor that they work with every week, or they might get an urgent request from somebody who is appearing to be their boss. They might be looking at the information on their phone, but the people on the other side of that interaction, they only have one job and that job is to fool you.
Molly Beyer: [00:04:19] They have the time, they have the tools, and they are testing what works. And increasingly they're using automation and AI to make those attacks faster and more convincing. So if your entire cyber strategy is, I just need my employees to recognize scams, I don't think that's enough. People are definitely part of your security system, but people cannot be your only security system. And that distinction really, really matters. So we've accumulated all of these layers of technology that are supposed to protect us. We've got spam filters and firewalls and antivirus software and multi-factor authentication and password managers, CAPTCHAs as scheduling systems, security alerts. And yes, those things are all very, very useful. But none of them is a magic force field. The people that are trying to get into your business are looking for the gaps between those systems, and those gaps are constantly changing. And that is part of what made our experience truly so eye opening, because something that I might have assumed was a pretty good barrier wasn't necessarily as good of a barrier as I thought it was. And that doesn't mean the technology was bad, it just means that security is a moving target. So NIST or the National Institute of Standards and Technology describe cybersecurity as something that requires ongoing vigilance and continuous improvement, rather than something you simply install once and check off your list.
Molly Beyer: [00:05:43] And I think that is really an important concept for small businesses, because cybersecurity isn't an app, it isn't a subscription or a checkbox. It is a process, it is a system, and it's a risk management function. There's another part of this conversation that I think small business owners need to truly understand. Because when we hear the word ransomware, most of us picture someone locking up our computer systems and demanding money to unlock them. And again, that still happens. But there's another threat that can be particularly serious for businesses like mine that handle a lot of information. Because if someone gets access to your data, they may not have to lock your computers to hurt you. They may just get information that's valuable because it's confidential. So think about what information a business might have. Customer information, employee information, social security numbers, banking information, payroll records, tax documents, financial statements, contracts, health information, passwords, proprietary business information. And here is where this becomes particularly important for me. I'm a bookkeeper. I work with people's financial information. My clients trust me with things that they do not want floating around the internet. So protecting that information isn't just about keeping my computer running, it's about protecting the trust that my clients have placed in me. The FTC, or Federal Trade Commission, warns that ransomware can put sensitive customer, employee, customer, employee, and business information into criminal's hands even beyond the immediate problem of being locked out of systems.
Molly Beyer: [00:07:25] So when we talk about ransomware, I think we need to broaden this conversation because sometimes ransom isn't just "give us money and we'll give you your files back". It really becomes a threat of. "Give us money or we will release what we took". And that is a very different kind of business risk. And I can already hear somebody saying this. "Yeah, but I'm a small business. Why would anyone bother with me?" And I do understand that question because I used to think about cybersecurity somewhat that way too. Why would anyone care about my little business? But again, here's the problem. Cyber criminals don't necessarily have to personally decide that it's your business that is interesting. You know, technology is allowing them to automate. They're not just sitting there looking at my website thinking "I'd really like to steal something from Molly." They're just looking for opportunities. And sometimes your business may also give them access to information or systems that are valuable somewhere else. Small businesses are increasingly part of a larger technology and vendor ecosystem. Your business connects to your clients. Your clients connect to their vendors. You connect to your bank, your payroll provider, your accounting software, your payment processor, your email, your scheduling system, your cloud storage, your employees devices, your phone. And suddenly your little business is actually connected to a lot of things.
Molly Beyer: [00:08:43] NIST's current small business guidance specifically recognizes that even very small and non-employer businesses need to think about cybersecurity risk. So being small doesn't necessarily mean that you don't need security. It means you probably just need to be smarter about how you get that security. And that is where outsourcing comes in. So now to the real point of this episode, because I don't think every small business needs an I.T. department. I don't think every small business owner needs to become a cybersecurity expert. And I definitely don't think that you need to spend your Saturday night watching YouTube videos about network security because someone told you you need to understand it all yourself. Here is something that I say to businesses all the time. You don't need to know how to do everything. You just need to know enough to know what you need. I don't do my own legal work. I don't even do my own tax work. I don't expect my clients to become bookkeepers, and I don't think I should become a cyber professional. And that isn't failure. That is specialization. And this actually says essentially the same thing. Its current 2026 guidance for small businesses specifically talks about outsourcing cybersecurity to managed security service providers, fractional or virtual CISOs and other specialists. For many small businesses, outsourcing may make more strategic sense than trying to hire and maintain that expertise internally.
Molly Beyer: [00:10:13] And that was really a nice confirmation for me. And I really think that outsourcing does often get framed as "I can't afford to hire someone, so I have to settle for outsourcing." And I also don't think that that's true. Sometimes outsourcing really is the better business model. And here's another thing I want you to think about, because you might already have an IT department or an IT person, and that is great. But I want you to ask yourself, is what is that person actually doing? Because they may be keeping your computers running or setting up new employees. They may manage your Microsoft 365 and fix your network, troubleshooting your printers and installing software. And those are all very valuable services. But I want you to go a step further and really ask who is responsible for cybersecurity in my business because IT and cybersecurity aren't necessarily the same job. You can have somebody who is fantastic at keeping your technology functioning, who isn't specifically responsible for monitoring cybersecurity threats, investigating suspicious activity, managing your security posture, testing your backups, developing an incident response plan, or helping you understand what happens if your IT systems are compromised. And that isn't an insult at all to your IT person. Again, it's really just specialization. Your mechanic can keep your car running, but that doesn't mean they're your insurance agent. Your bookkeeper can keep your books organized, but that doesn't mean that you're your attorney.
Molly Beyer: [00:11:40] Your IT person can keep your technology working, and that doesn't automatically mean that they are your cybersecurity team. So what should you actually outsource when it comes to cybersecurity? And this is where I want to make this more practical. Because if I tell you, go hire a cybersecurity company, you might reasonably ask, okay, but what am I hiring them to do? And honestly, that's a really good question. Before you even start talking to providers, I think there are five things that you should understand about your own business. First, what do we have? What systems are you using? What information do you store? Where does it live? What software connects to it? What devices access it? You really may be surprised how many systems that your business actually depends on. Second, who has access, who can get into your email, your accounting software, your payroll system, your bank, your cloud storage, your client files? And what happens when somebody leaves? Do you know exactly what access gets removed? Third, what would happen if someone got in? Not just, "would my computer stop working?" What could they actually see? What could they change? What could they steal? Could they impersonate you? Could they access your clients information? Could they move money? Could they lock you out? Could they use your systems to get somewhere else?
Molly Beyer: [00:13:14] Fourth, how would we know? This one is huge. If something suspicious happened at 2:00 in the morning, who would know? And more importantly, who would do something about it? And fifth, what happens if something goes wrong? Who do you call? What gets shut down? What gets preserved? How do you communicate with your clients? How do you recover? How do you get your business operating again? And that is the part that people don't like to think about. But that's exactly why you should think about it before something happens. If you're looking for outside help, I want you to ask better questions too. Don't just ask, "do you provide cyber security?" Instead, I want you to ask, what are you actually monitoring what happens if you detect something suspicious? Who gets notified and how quickly? What happens if it's 2 a.m.? How are my backups protected? Have you actually tested restoring them? Who has administrative access to my systems? How do you handle compromised credentials? What happens during an actual security incident? And maybe my favorite question, can you explain to me what you're doing in language I can understand? Because if somebody's security strategy requires you to understand 47 acronyms before they can explain what you're paying them to do, I'm not saying they're bad, but I am saying you probably need a better conversation. And there's one really important caveat here. Just because you outsource, cybersecurity doesn't mean you outsource responsibility.
Molly Beyer: [00:14:58] And this is very clear about this. You can hire somebody else to protect your systems. You cannot hire somebody else to care as much about your business as you do. You really need to understand what they're responsible for. You need a contract. You need to find expectations. You need to know what they're monitoring and what they aren't. You need to understand what happens during an incident, and you need to make sure that the person you hired is actually providing the level of service that you think you're paying for. And this is another place where my normal business philosophy comes right back around. Outsourcing a system doesn't mean you stop managing the system. It means you stop being the person responsible for doing every single task inside that system. And that is a big difference. If you've listened to this podcast for any length of time, you've heard me talk about systems, I talk about systems constantly. And I think cybersecurity is actually one of the best examples of why. Because a system isn't one that assumes everyone is always going to be alert. A good system really assumes that people are human. You are going to be tired. You are going to be distracted. You're going to get busy. You're going to have a client call at the exact moment an email comes in, you're going to have someone go on vacation. You're going to hire someone new, you're going to have somebody leave.
Molly Beyer: [00:16:18] You are going to have a day or many days when you are not operating at your absolute best, and your systems need to protect you on those days. And that is really what I mean when I talk about systems that save sanity. I don't want a 47 page cybersecurity manual sitting in a binder somewhere that nobody ever reads. I want systems that are quietly doing the right thing. I want access to be removed when someone leaves. I want backups to exist and actually work. I want suspicious activity to be noticed. I want multiple layers of protection. I want someone who knows what they're looking at. And I want to know who I'm calling when something goes wrong, because that is a system that saves sanity. And maybe this is the part I really want you to take away from this episode. Cyber security is not just an IT issue. It is a business continuity issue. It is a financial issue. It is a client trust issue. It is an operations issue. It is a risk management issue. And if you handle any confidential information, it is also part of your responsibility to the people that trust you with that information. And so that is why I don't think the answer is I need to learn about cybersecurity. Maybe you do. I think we all do. I did. But I think the better question is, what do I need to understand about my risk and who should I have helping me to manage it because that's what good business owners do.
Molly Beyer: [00:17:52] We don't personally become experts in everything. We identify what matters. We understand enough to make good decisions, and then we bring in the right people to handle it. And yes, this is also a sustainability issue because this does directly connect to something I've been talking about in a lot of our recent episodes, and that is that idea of sustainability versus scalability, because I don't want you building a business where you are personally responsible for every single thing. I don't want you being the bookkeeper or the HR department, the IT department, the cybersecurity department, the marketing department, the person who remembers to buy toilet paper. That isn't sustainable. And sometimes the most sustainable decision isn't another piece of software. It's getting another human being with specialized knowledge involved. Cybersecurity is a perfect example of that. You don't need to know everything. You need to know where your limits are, and then you need to build a system around those limits. Now our attack was contained before it caused harm, and I'm extremely grateful for that. But I don't want to walk away from that experience thinking, we got lucky, everything's fine, because that's not the lesson. The lesson is that the threat was real. The people trying to get into businesses are getting better.
Molly Beyer: [00:18:57] The technology is changing. The ways they reach us are changing and the information that we hold is valuable. So I'm not interested in creating fear. I'm interested in creating awareness because fear says something terrible could happen. Yeah. Awareness says, okay, so what can I do about it? And that is a much more useful place to be. So remember, you don't have to become a cybersecurity expert. You don't have to understand every acronym. You don't have to build the system yourself. But you do need to understand that cybersecurity is part of a running business. And sometimes the smartest thing you can do is just recognize this is important. I don't know enough about this myself, and that's okay, because knowing when to ask for help isn't weakness. It is a business system. And sometimes the best system isn't the one you build yourself. Sometimes the best system is just knowing who to call. And to answer that, some of you may be asking, yes, I have an outsourced cybersecurity firm and I credit them and the systems they have in place for me and my employees with keeping this attack contained before it caused harm. For many years I thought I was too small, but thankfully I heeded my own advice and outsourced this system. And I'm going to shout them out because they can support people virtually and remotely, regardless of vocation. So my trusted partner is Vertiance IT support services.
Molly Beyer: [00:20:15] You can find them at vertiance.com, that is vertiance.com. The team is amazing. And when I had to call, not quite at 2 a.m., but at 8:30 at night, I was supported until almost midnight and then again first thing the next morning. So get a good partner, find one, reach out to this one, ask them questions. I do also need to add a quick disclaimer here that this episode did discuss a real cyber incident involving my business. There were certain details, technical details, names, systems, and circumstances that were intentionally omitted to protect our business, our clients, and our security. But the information in this episode is just for general education purposes, and it's not a substitute for that professional, cybersecurity, legal insurance, or incident response advice. So please go find your people if you don't already have them. And if you have them, ask them some of those critical questions and make sure that they are managing in the way that they're supposed to. So I want to thank you again so much for hanging out with us today. I'd love to hear your feedback on today's episode, as well as any requests for future content. Drop a comment or suggestion and join us next time for more frank and holistic conversations on the basics of business. Please also like, subscribe, or follow so you never miss an episode. And until next time, I'm Molly Beyer and this has been The Ambiguous &: Business Basics and Beyond. Have a wonderful day.