The Serial Entrepreneur: Insight for Small Business Owners

A Word on Passwords and Other Sensitive Data

If you're like most people (me included, until I changed my ways), you use the same few (or one) "favorite" passwords for all your password-protected accounts, from low-security stuff like on-line newsletter subscriptions to high-security stuff like your bank or credit card accounts. And to make matters worse, your favorite passwords are likely something you can easily remember because they somehow relate to you (all the usual suspects...birth dates, middle names, pets, and so on). Just exactly the kind of passwords that hackers find easy to "crack" once they learn a few things about you.

You probably see where I'm going here already, but this "bad habit" is probably one of the riskiest things you can do--especially in this age of the ever-increasing proliferation of Internet-accessible accounts, multiplied by the ever-increasing rise in fraud and identity theft.

Let me touch on just a few of the problem areas... Using a few identical passwords across multiple accounts means that if one account is compromised, so are they all--plus you have little to no knowledge about the security practices (or even worse--the ethics) of the companies behind any of those accounts, meaning that you just might be handing the keys to your identity over to the "bad guys". Passwords that relate to you in any way are easy for hackers to crack, often with only a few tiny bits of information about you, much of which is generally available through public sources. Many "favorite" passwords are inherently insecure, in that they are short or use only letters or only numbers--such passwords can be cracked through various "brute force" techniques, without the hacker knowing anything at all about you. Bottom line, you wouldn't give out keys to your car or home to everyone you do business with, but in effect, that's what many (even most) people do when it comes to passwords.

I know what you're thinking: "I'm guilty of one or more (or all) of these transgressions, but it's just too hard to keep track of different passwords and even different logins for all my accounts. After all, what good is it to have different passwords for different accounts if there are more of them than I can remember; then I just have to write them down and carry around a list--and how secure is that?" I agree (my words exactly), but this is also the age of "good, cheap software" (and optionally, "good, cheap portable computers" , also known as PDAs and smart phones)...

The good, cheap software I'm referencing is what I would generically refer to as a "password manager", and two good examples are SplashData's SplashID (available for Windows, Mac, and a long list of PDAs and smart phones) and Ascendo's DataVault (currently only available for Windows and Blackberry's). There are others, and this isn't a review of password manager software, so feel free to search around (I will say that I've used both of these, and both are very good at what they do).

So, what is it that they do? In short, they provide a lightweight database that stores sensitive information in an encrypted format; not only passwords, but account numbers, PINs, SSNs, and so on--essentially any information that you need easy access to but don't want falling into the wrong hands. If you have a compatible PDA or smart phone, they will also allow you to sync between your computer and your PDA/smart phone, so you can carry your secure information with you wherever you go (also encrypted on your PDA/smart phone, so the information is safe if you loose the device). The two programs I mentioned, and presumably the others, also allow you to create categories (like Home, Business, etc.) and individual "classes" of information (like Bank Accounts, Credit Cards, Passport Info, etc.) that is searchable through the desktop or hand-held software, so you can quickly find what you're looking for. For example, you might create a credit card record under your home category for your personal Visa card and store in that record the bank name, card number, expiration date, on-line access URL, login, password, and maybe notes on your security questions or your credit line.

OK, so now I have a way to store sensitive information securely, how does that make me less prone to fraud or identity theft? In fact, by itself, it doesn't. The next step involves a bit of one-time legwork and a change in your behavior. What the password manager software does is make it easy to have different passwords (and even different logins, in some cases) for each of your accounts. What you have to do is actually take the time to set them up that way:

• Whenever possible, use a login or user name that is not your name or email address. Many on-line accounts won't allow this--they force you to use your email address or some variation of your name or account number. If that's the case, so be it, but when you have the option of choosing your own, do so. Make up something like "BlueVisa" or "SecureJohn".
• Create "random" passwords that don't relate to you or your family in any way. Some accounts have very specific rules that they password must conform to (such as only letters and numbers, or at least one letter and one symbol, etc.); that's usually not a problem, since you'll be making up a fresh one for every account. A format that works well and is generally considered secure is a random word, one or two random symbols, and a random number, such as "Prosper*382" (so long as your name isn't Prosper and you weren't born in March 1982, of course) or "@focus#4098". Many passwords are also case-sensitive, so "Focus", "focus", "FoCuS", and "FOCUS" are different, and this adds to the security of the password.
• Many of the password manager programs have the ability to generate "fully random" passwords, some even with various password rules (such as what kinds of elements they have to contain, how long they are, etc.) Such passwords are arguably even more secure than what I described above (they look like "3je*F2k+W"), especially because they are generated by the software and are therefore "more random" than anything you can make up. But frankly, I find these difficult to type in when you can't cut-and-paste them from your password manager, and I'm not convinced that they are that much more secure than the word/symbol/number approach. In any case, either of these approaches is far better than any of the "favorite passwords" you're using today.

Once you start keeping track of your sensitive data like this, you'll wonder how you lived without it. Not only does it increase the security of your password-protected accounts by several orders of magnitude (and in turn, protect you from fraud and identity theft), but it's also a much more convenient way to store and manage your sensitive data. And, combined with an automated on-line backup service, it's not only secure, it's also safe.

Remote Online Backup

It probably goes without saying, but most businesses today rely on computers. Even if you don't consider your business to be a "high tech" business, technology basics like email, contacts, word processing, spreadsheets, and so on have become critical elements of even the lowest-tech businesses. And if you are a higher-tech business, your dependency on computers obviously runs even deeper. But really, it's not so much the computers themselves that make up your "digital assets", it's the data they store. After all, a failed (or stolen) computer can be replaced fairly easily, but your contact list, business plan, accounting data, and so on--that's another story.

So--and we've all heard it before--back up your data! Historically (and still pretty much today) that meant using some sort of backup software to make a periodic copy of your data onto a tape of some kind, or more recently, maybe onto a CD or DVD. Nothing magical about that, in fact Windows comes with simple but effective backup software built in, and if you wanted something more elaborate, a long list of software vendors was ready to step in and help, ranging from pretty good freeware/shareware solutions to more expensive enterprise backup software. That's all well and good, but the issue has never been a failure of the technology--frankly, it's the failure of the human. I've seen various statistics quoted here and there, but the sad truth is that relatively few people have the discipline to run backups on a regular, consistent basis.

But that's not you right? You are religious about backup, making incremental copies of your laptops (and/or servers) on a nightly basis, full backups weekly and monthly, rotating those tapes in a typical multi-generational rotation plan, and storing the two copies (yes, two) of each tape in separate physical locations. (That's a quick overview of a "good" backup plan, but one that few small businesses follow). But let's say you do follow a backup plan, albeit a "lesser" one, that affords you some level of protection. It's a lot of work, and frankly falls into that category of "administrivia" that takes your attention off running your business. Beyond that, "lesser" plans are just that--the reason for the more elaborate plans, the rotation scheme, the two copies of each tape, the off-site storage, and so on is because the technology itself is not perfect. I've heard more than one story of critical business data being lost forever due to a faulty, damaged, lost, or stolen tape.

So what's the good news? Remote Online Backup. This is a service that's been coming for a long time (I want to say I remember announcements on this topic over ten years ago), but now it's mainstream. Why now? Two technology trends have converged to make this simple idea viable: cheap storage and cheap Internet bandwidth. Storage costs have plummeted over the years (almost exactly 20 years ago, I remember buying what was then the largest hard disk available in the world; it stored 500 megabytes, weighed over 100 pounds, and cost just over $20,000--today, even at retail, you can buy a 500 gigabyte hard disk that fits in the palm of your hand for well under $500). Other storage technologies, like tape, have also experienced similar cost-down/capacity-up trends. This is what has made it viable for companies to offer remote online backup at a price-point that makes sense to individuals and small businesses. And of course, cheap high-bandwidth Internet connections make it possible to actually transmit the data from your computers to the service provider's facility (not so practical on a 28.8kbps dial-up connection).

There are a number of providers out there today that offer remote online backup services, including Mozy, Carbonite, eSureIT, and others. As you'd expect, each offers their own twist on the basic concept--different service levels, the ability to easily interface to different kinds of computers (and even specific software, like Exchange or SQL Server), and such. What they all do is back up the data on your computers (from laptops to servers) automatically over your Internet connection to their remote secure data facilities. Once you install their downloadable software on the computers you want to back up, there's nothing else to do. The service provider takes care of all the "dirty work" and presents to you a web-based administrative interface for retrieving backed-up data in case you loose something. My personal favorite is Mozy (and the fact that they were recently acquired by EMC--a large and well-established data storage company--makes me feel even more secure with them). For basic backup of a Windows laptop or file server, Mozy is hard to beat, and their Mozy Pro version has a long list of advanced features for "power users". But it's not necessarily the best solution for everyone, so take the time to explore the options and find what works best for you and your environment.

I won't try to go into all the features or benefits of remote online backup here (I'm not selling it), but I will mention a few of the key points below that apply to all or most of the providers. Bottom line, unless you have or are planning to have a fairly well-staffed IT department, remote online backup is hard to beat (and even then, it should still be considered). I highly recommend it--the peace of mind that comes with this solution is well worth the very reasonable monthly service charges.

• Once installed, it just works (although most solutions let you choose between fully automatic and various scheduled backup strategies); so unless you want to, you don't have to think about it. Even for laptops, as long as you connected to the Internet every once in a while, all the changes you've made since your last connection will be backed up.
• Unlike most simple in-house solutions, the backup is near-real-time (assuming you're connected to the Internet when making changes), so all those updates you made to your new marketing plan this morning won't get lost if your hard disk crashes before your traditional nightly backup. Many of the services also provide you with "snapshot" backup, where you can go back and retrieve (via their website) the version of that presentation you were working on three weeks ago, after you've made dozens of revisions, saving over the original file on your local hard disk each time.
• After the initial "sync" (where all the relevant data on your hard disk is backed up in its entirety), the Internet bandwidth needed for incremental changes is relatively low, so as long as you have typical DSL or cable modem Internet service, there's no need to increase your bandwidth.
• Your data is encrypted before it leaves your computer, so it can't be intercepted or compromised in any way while it's en route to or stored at the remote backup provider's facilities. This ensures that your data will remain safe and let's you comply with HIPAA, PCI, and/or other privacy/security requirements.