Cyber Security for ordinary businesses

In this day and age, every thing your company does is on the company computers somewhere.  Email is forever.  First off, you need to identify the things that you need to keep secret from hackers and competitors.  Start with personnel records.  Those must be secret to keep competitors from pirating your best people.  Pay and salary is particularly sensitive because when that gets out, everyone in your company gets bad feelings about everyone who make more than they do.  And it points headhunters toward your less well paid people.  Production information; mechanical drawings, electrical schematics, parts lists, software source code, test procedures, recipes and formulas.  With this stuff someone can set up to make your product and compete with you.  That's legal in places like China.  At the very least they can make a good guess at your cost of production.  Sales and marketing; your customer lists and customer contact information.  If the competition gets to your customers and wins them over, you are hurting.  Email; there is bound to be damaging information in someone's email.
    To keep the hackers out, first consider keeping stuff OFF the hard drives.  Back it up to CD-ROM and keep the CD's in a locked room.  There is a lot of old stuff on hard drive that you don't use today, but could do a lot of damage in the wrong hands.  If the stuff is really valuable, now is the time to establish an off site backup location.
    Set up a secure network.  This is a small number of computers, kept in locked rooms,  and NOT connected to the general company network or the public internet, or the public phone network.  By not connected we means NO wires or wireless connections to anywhere.  Don't rely on "firewalls", some of them have caught fire in the past.  Snip off the wires going to the USB sockets to prevent Flash drive virus invasion.  Remove all floppy drives to prevent invasion by merely inserting a boot floppy in the "A:" drive. Keep all your sensitive stuff on the secure network.  When you do Engineering Change Orders, pull the master drawing off the secure network, give it to the engineer, and have him return the updated version to the secure network.
   Now we come to training your personnel.  Start with email.  Make sure everyone understands that email lasts forever, and will be used against you in court, and by hackers.  Tell them to never put anything in email that they would not post on the bulletin board at the local super market.  If the matter is sensitive, handle it face to face or over the phone.  And delete old emails after 30 days.
   You want to run an anti virus scan once a week on every computer in the company.  Virii can do the damnedest things, just ask the Iranians about Stuxnet.  Commercial virus scan programs are pretty good, and they get better every week.  Keep your anti virus updated.  Even if you have a deal that permits IT to run the virus scans remotely, you still want everyone to understand how important they are.
   All your creative people want to keep their stuff on their machines, just in case.  Encourage them to encrypt it, and/or back it up to CD and keep it  in a locked drawer.  And make sure the latest version is stored on the secure network as well as on their private hard drives. 
   Consider getting rid of Windows company wide.  It can be done.  Linux works, and isn't too difficult for your people to learn.  Windows is totally, but totally, insecure.  Anything stored on a Windows computer is vulnerable to small children, let alone adult hackers.

Obama does an Op-Ed in the WSJ

Nice big half a page with am illustration Op Ed piece.  "Protecting US Innovation From Cyberthreats". Sound great.  Only trouble is, the Op-Ed contains zilch about protecting anything.  Lotta nice empty words, typical Obama speak, but nothing of substance.  He does promise to spend money,  $19 billion on the "Cyber Security National Action Plan" what ever that might be.  And another $3 billion on federal IT.  And a new bureaucrat,  the Chief Information Security Officer, salary unspecified.  And another unfunded effort to "build a corps of cyber professionals" to "push best practices at every level".   And a new "cyber security Center of Excellence".  And a new "bipartisan Commission on Enhancing National Cybersecurity".
   Does anyone really think adding more bureaucrats, more funding, and more bureaucracy is gonna keep the hackers out?
   The real situation is this.  Any computer connected to the public internet or the public phone system is vulnerable to invasion and plundering.  Windows computers are ten time more  vulnerable than any other sort of computer.  We must never store valuable information on computers connected to the public internet.  And we should never store valuable information on any sort of Windows computer. They are like Swiss cheese, full of holes.  If we made this nation wide policy we would be a helova lot more secure than we are now.
   Obama doesn't understand any of this.  In fact I doubt that Obama knows how to boot up his laptop.