South King County business owners should strengthen account security, test their backups and practice how they would respond to a cyberattack before one happens, experts told the Kent Chamber of Commerce’s Oct. 1 cybersecurity luncheon.
The discussion focused on practical steps for small and midsize businesses, including using unique passwords, enabling multifactor authentication, training employees and understanding what cyber insurance requires.
Speakers also warned that outside vendors and employees’ use of artificial intelligence can expose a company’s information.
“You can’t just put free antivirus on your machine and hope it’ll protect you,” said Tony Sollars, CEO of WatchTower IT Solutions. “You have to have multiple layers so that when it gets through one layer, there’s another layer behind it to defend you.”
Chamber CEO Zenovia Harris moderated the panel, which included Sollars, Raj Sidhu, founder and president of inTech Consulting, and Douglas Olsen, a partner and vice president with USI Insurance Services. Comcast Business sponsored the luncheon.
Harris said the chamber separated cybersecurity from its broader safety discussions to give business owners more time to address digital risks and leave with steps they could put into practice.
Protect Accounts and Test Backups
Sollars urged attendees to stop reusing passwords across accounts and use a reputable password manager to generate and store unique passwords. Sidhu emphasized enabling multifactor authentication, which adds another verification step beyond a password, on important accounts.
The panelists also advised businesses to act on notices that a password has been compromised while avoiding links in suspicious messages.
Sidhu said artificial intelligence has made fraudulent emails harder to recognize because spelling and grammatical mistakes, once common warning signs, are less reliable.
Backups were another priority. Sollars recommended automating them, monitoring them and testing whether stored data can be restored, rather than relying on someone to remember to copy files.
He cautioned that a business should not discover during a disaster that its backups are missing or do not work.
Ask Vendors How They Protect Information
The discussion extended beyond a company’s own computers. Panelists encouraged owners to ask payroll providers, accountants and other partners how they secure the information entrusted to them.
Sollars described a customer that lost about $32,000 after criminals compromised an outside payroll company and sent instructions to redirect a payment to a different bank account. The customer followed the emailed instructions despite earlier advice about verifying payment changes, he said.
“Never ever ever make changes to bank accounts over email,” Sollars said.
He advised contacting the bank promptly when a fraudulent transfer is discovered.
Employees also need clear rules about artificial intelligence, the speakers said. Sollars described finding instances in which clients’ accounting employees had entered financial information into public AI tools while trying to improve their work.
Sidhu recommended policies specifying which AI applications employees may use and what information they may enter. He compared those rules to policies governing personal devices used for company work.
Understand Insurance and Rehearse a Response
Olsen urged owners to review cyber insurance with an adviser who can assess their business’s needs. Coverage should reflect the company’s size, operations, information and exposure to risk, he said.
He also emphasized keeping insurers informed as a business changes, including when it adds employees, acquires another company or changes its business model.
Sollars said an incident response plan should account for the requirements of the company’s insurance policy, including whom to contact after a breach. Failing to follow those requirements could jeopardize a claim, he warned.
Sidhu recommended practicing a disaster scenario at least once a year so employees know their responsibilities and can identify gaps before an emergency.
An incident response document alone is not enough, Harris said in her closing remarks. Staff need to know how to use it when systems are unavailable and decisions must be made quickly.
The luncheon also highlighted a resource for chamber members: a complimentary cybersecurity risk assessment from inTech Consulting. Sidhu said the assessment is intended to help businesses understand their vulnerabilities and identify steps they can take themselves.
“Cybersecurity does not have to be complicated, but you do have to be intentional about it,” Harris said.
Learn more about the Kent Chamber here.
Video
Below is video of the luncheon, as filmed by Bryan Shickley and edited by Sophie Schaefer (running time 1-hour, 18-minutes):
