Editorial · February 20, 2022
CISA Shields Up: A Checklist for Small Firms
CISA Shields Up is a February 2022 call from the US cyber defense agency for every organization, whatever its size, to raise its guard now. It is not only for power plants and banks. A small firm with a few laptops and a cloud account is on the list too.
CISA says the reason is the tension around Ukraine. Its page says there are no specific credible threats to the US homeland right now. But it adds that the Russian government might escalate in ways that reach outside Ukraine. So CISA wants every office to get ready before anything happens.
What CISA is asking for
The page says CISA "recommends all organizations, regardless of size" adopt a heightened posture. Then it gives a short list in four groups. Most of the steps cost little. Many cost nothing at all.
The groups are: cut the odds of a break-in, spot a break-in fast, be ready to respond, and be able to recover from a bad one. The rest of this checklist follows those four groups.
CISA also says its experts are available to help, and that it has a catalog of free services from government partners and the open source community. Small firms that cannot hire a security team can start there.
Step one: make a break-in less likely
This is the longest group, and it is the best place for a small firm to start.
- Turn on multi-factor authentication. CISA asks you to confirm that all remote access to your network, and all admin access, needs a second proof of identity, such as a code from a phone app.
- Update your software. Install updates fast, and do the ones that fix known exploited flaws first. CISA keeps a public list of those flaws.
- Close what you do not use. Ask your IT person or provider to turn off any ports and protocols your business does not need.
- Check your cloud settings. If you use cloud services, review the strong controls in CISA's cloud guidance.
- Sign up for free scans. CISA offers free cyber hygiene services, including vulnerability scanning, that show where you are exposed.
Step two: spot trouble quickly
Quiet break-ins do the most harm. The faster you see odd behavior, the less damage it does.
- Ask whoever runs your IT to watch for unexpected or unusual network activity and look into it fast.
- Turn on logging. Logs are the record that lets you work out what happened later.
- Make sure antivirus or antimalware software covers the whole network, and that its signatures stay current.
- If you work with Ukrainian organizations, CISA says to take extra care. Watch, inspect and isolate the traffic that comes from them, and review who can reach what.
Step three: plan who does what
When something goes wrong, people lose time asking who is in charge. A short plan fixes that.
- Name a crisis team. CISA suggests a team with clear contacts and roles for technology, communications, legal and business continuity. In a small firm, one person may wear two hats. That is fine, as long as the names are written down.
- Check who is available. Know who can be reached on a weekend, and where you would get extra help.
- Run a tabletop exercise. This is a talk-through of a made-up incident. Everyone says what they would do, so roles are clear before a real event.
Also decide now who you will call. CISA asks organizations to report incidents and odd activity to CISA or the FBI. The FBI's 24 hour CyWatch line is (855) 292-3937.
Step four: be able to bounce back
The worst cases are ransomware and attacks meant to destroy data. CISA's answer is simple: have a copy you can restore.
- Test your backups. A backup you have never restored is a guess. Try restoring key data, and time it.
- Keep backups apart. CISA says backups should be isolated from network connections, so an attacker who gets in cannot reach them.
- Test manual controls. If you run industrial control or operational technology equipment, check that critical work can go on by hand if the network is down or cannot be trusted.
CISA also points to StopRansomware.gov, a single government page with ransomware resources and alerts.
Where to read more
Start with the Shields Up page itself, since CISA may add to it as the situation changes. The agency also points readers to its January 2022 joint advisory with the FBI and the NSA, called Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure (AA22-011A). Its summary asks for four quick actions: patch all systems, turn on multi-factor authentication, use antivirus software, and build internal contact lists and surge support.
None of this needs a large budget. A good first week is to turn on multi-factor authentication, install pending updates, test one backup, and write down who to call.