Showing posts with label #business. Show all posts
Showing posts with label #business. Show all posts

Wednesday, August 12, 2026

Stop Writing Blog Posts Nobody Reads: A Modern Guide to Getting Your Content Noticed

a man writing a blog post on his laptop
Think about how much work goes into writing a blog post.

First, you search for the right topic. You make notes on your phone, collect ideas throughout the week, and mentally test different titles while you’re supposed to be doing something else.

Then you finally sit down to write.

You rearrange your schedule, open a blank document, and begin turning your experience, knowledge, and creativity into something you genuinely believe can help people. You revise it, proofread it, select an eye-catching image, add a compelling title, and click “Publish.”

Then you sit back with a satisfying sense of accomplishment.

But your work is not finished.

Cue the sound of a record scratching.

Publishing Is Only the Beginning

Why did you spend all that time writing the article?

Presumably, you wanted someone to read it.

Yet many bloggers invest nearly all their energy in creating content and almost none in helping people discover it. They publish an article, share it once, if at all, and then move on to the next one.

A few weeks later, they look at the statistics and discover that only eight people read it. Or perhaps it was four, eleven, or fourteen.

The problem may not be the quality of the article. The problem may simply be that not enough people knew it existed.

Blog posts rarely promote themselves. If you want your ideas to reach people, you need a plan for distributing them.

DailyGreatness Planners that will change your life.

Start With a Strong Reason to Click

Before promoting your article, make sure the title gives people a reason to stop and pay attention.

A good title should clearly communicate what the reader will gain. It might:

  • Ask a question the reader already has
  • Promise a useful outcome
  • Identify a common problem
  • Create curiosity without being misleading
  • Include a number or specific detail
  • Speak directly to a particular audience
  • Challenge a familiar assumption

“Thoughts About Business Communication” is vague.

“7 Communication Habits That May Be Costing You Customers” is specific, relevant, and much more likely to earn attention.

Your title should create interest, but it must also accurately represent the article. A sensational title may attract a click, but readers will quickly leave if the content fails to deliver.

Share the Article More Than Once

When your post goes live, share it on the platforms where your intended readers are most likely to spend time. Depending on your audience, that might include:

  • Facebook
  • LinkedIn
  • Instagram
  • Pinterest
  • Threads
  • An industry-specific group or online community
  • Your email newsletter

Don’t simply paste the link and write, “Here is my latest blog post.”

Give people a reason to click.

Pull out an interesting observation, ask a related question, share a short personal story, or identify the problem the article helps solve.

For example:

Have you ever spent hours writing an article only to discover that almost no one read it? Writing may be the creative part, but distribution is what gives your ideas a chance to travel. Here are several practical ways to help your next post reach more people.

One article can support several different promotional messages. Share the same article again later with a new quotation, question, graphic, example, or angle.

Many of your followers will not see the first announcement. Reintroducing useful content is not excessive self-promotion. It is giving more people an opportunity to find it.

Don’t Try to Be Everywhere

You do not need to promote every article on every available platform.

Choose the channels that fit your subject and your readers.

A leadership or business article may perform well on LinkedIn. A parenting article might gain more discussion on Facebook or through an email list. A visual tutorial, craft project, or book-related article may be well suited to Pinterest or Instagram.

Two carefully selected channels, used consistently, can be more valuable than six neglected ones.

Use Your Email List

Social media audiences are valuable, but platforms decide how many of your followers see each post. Your email list gives you a more direct connection with people who have chosen to hear from you.

Send subscribers a short introduction to the article, explain why it matters, and invite them to continue reading on your website.

If your blog has an RSS feed, email services can even automate blog-post announcements on a daily, weekly, or monthly schedule. Mailchimp, for example, supports automated RSS blog updates.

You should also include a simple email signup opportunity on your blog. A reader who enjoys one article may be interested in your future work—but only if you provide an easy way to stay connected.

Turn One Article Into Multiple Pieces of Content

A good blog post should not live in only one format.

You can turn one article into:

  • A series of short social posts
  • A quotation graphic
  • A one-minute video
  • A podcast discussion
  • A checklist
  • A carousel or slideshow
  • A downloadable worksheet
  • A newsletter feature
  • A discussion question
  • A short presentation

This is not laziness or unnecessary repetition. People consume information differently. One person may read a 1,000-word article, while another may discover the same idea through a graphic or a 60-second video.

Each smaller piece can direct interested readers back to the complete article.

Write for People, and Make It Easy for Search Engines to Understand

Search visibility still matters, but stuffing an article with repetitive keywords is not an effective modern strategy.

Google recommends creating helpful, reliable content primarily for people. It also recommends using the language readers would naturally use when searching for the subject, particularly in prominent places such as the title and main heading. Google calls this “people-first content.”

Before publishing, ask:

  • What question does this article answer?
  • Who is it written for?
  • What phrase might that person type into a search engine?
  • Does the title clearly describe the benefit?
  • Have I included examples from my own experience?
  • Is the article easy to scan on a phone?
  • Have I linked to other useful articles on my site?

Search engines, and AI-powered search tools, have access to an enormous amount of generic information. What they cannot reproduce as easily is your personal experience, original examples, specialized knowledge, case studies, opinions, and lessons learned.

That is what makes your article worth finding.

Encourage Conversation

End your article with a simple invitation.

Ask readers to share an experience, answer a question, subscribe, download a resource, or read a related post.

For example:

What has been your most effective way of attracting readers to your blog? Share your experience in the comments.

A clear invitation gives readers something to do after they finish reading. It can also turn a one-way article into a continuing conversation.

Pay Attention to the Right Results

Page views matter, but they do not tell the whole story.

Also look at:

  • How long readers remain on the page
  • Which promotional channels send visitors
  • Whether readers join your email list
  • Which articles receive comments or shares
  • Which links readers click
  • Whether the article produces inquiries, sales, invitations, or new relationships

An article read by 100 well-matched people may be more valuable than one viewed by 5,000 people who have little interest in your work.

It Is Time to Toot Your Own Horn

Many of us were raised to believe that drawing attention to ourselves was selfish. We were told not to brag, show off, or toot our own horns.

But sharing useful work is not the same as boasting.

If you have written something that can inform, encourage, entertain, or help another person, promoting it is part of the responsibility you accepted when you decided to publish it.

Don’t spend hours creating valuable content only to leave it sitting quietly in an unnoticed corner of the Internet.

Write it.

Publish it.

Promote it.

Repurpose it.

And give your ideas the opportunity to reach the people who need them.

Tuesday, April 12, 2016

Manage your customer password

I am continuing my series of posts on security topics of primary interest to businesses, as I mentioned in my first post on this blog. Last month, I talked about how to manage your passwords online. In this post, I focus on making sure you are managing your customer's passwords carefully.


If your company requires any kind of login to your web site, you have the major responsibility of making sure those passwords are stored in a secure way. Over the last few years, we have seen in the news many data breaches that included the obtaining of databases of user accounts, which also included passwords. As was mentioned last month, many people use the same password at multiple web sites. If your database is compromised, would an attacker then be able to use your customer's passwords to compromise other systems, including banks, etc.?

What can I do to store a password securely?

There are several ways to store passwords. One is in the clear, or "open text" which means just what it sounds like - stored as it is saved by the user. This means there is no security at all. If you reset your password on a website and that company sends your password as a clear text value in the email, that company is not doing what it should to keep your data secure. I would consider canceling your account through them immediately.

Ideally, the recommended way to store a password is to store a "hashed password". This essentially means using a mathematical function that takes your clear text password and runs it through to get a result with a constant length. For example, your password: "SillyDog" may run through a hash function to produce "aP;v77a7blskda;fbblskd--". The great thing about hash functions is they are one-way only. You can't decrypt a hash function result, but instead the only way to know you have the right password is you compare the entered password by the user with the hash function result to verify it matches what was saved the first time you saved the hashed password. This makes sure the only person who knows the password is the user and not anyone else. Some other considerations is to use a random value with the user password, for example: 

hash ("random value" + "user password") = "hashed password" 

This will introduce some randomness in the collection of hashed passwords in case there are any duplicate passwords in the database that would resolve to the same hashed password. The way to know if a web site is using a method like this is they won't be able to send you your password for a password reset, but instead will ask you for other information to identify you and then let you create a new one. Remember, a secure password solution is one-way only and only the user, not the company, would and should know the password.

What else can we do?

Another great technique for protecting user accounts and logging in for the user is to use what's call two-factor authentication. The idea behind this is to use two or more methods of verifying a user account. Ideally this means using one of these two:

1. What you know (password)
2. What you own (a code sent to your mobile phone)
3. Who you are (biometric such as a thumbprint)

Lots of banks, Amazon, Google mail, and other services are using this method. For example, you would enter your password, and then a code is sent to your mobile phone that you must also enter to finally be logged into the system. There is a web site that lists what companies are providing two-factor authentication services: 

https://twofactorauth.org/

The details for how to set this up for your company is beyond what I can describe here. If you are concerned about the possibility of someone using your customer's password from another web site against your web site, using two-factor authentication will put a stop to it because they will also need to have that user's mobile phone in their possession as well. 

Next steps

Whatever method you use to store passwords securely for your customers, think carefully about how you manage those passwords and how you request them from the user. Give it some thought and consider the recommendations above. If I can be of help in setting up your own password policy, or evaluating it, please get in touch. If you have any general questions about passwords, please let me know below.


About Robert Hurlbut

Robert Hurlbut, owner of Robert Hurlbut Consulting Services, based in Enfield, CT, provides software security consulting, architecture, and training. This includes software development, threat modeling, secure code reviews, and other kinds of security audits for your company. If Robert can be of assistance to your company, please get in touch through the below contacts.

Web: https://roberthurlbut.com
LinkedIn: https://www.linkedin.com/in/roberthurlbut
Twitter: @RobertHurlbut

Saturday, March 12, 2016

Managing your passwords

I am continuing my series of posts on security topics of primary interest to businesses, as I mentioned in my first post on this blog. In this post, I focus on making sure you manage your online passwords carefully.


If you spend any time online, you will probably encounter many websites that require some kind of username and password in order to log into the website. This includes websites for e-commerce, financial institutions, social media, blogs, and other websites that require credentials in order to protect the data contained within and/or identify you in order to complete some kind of transaction. 

Your username is usually pretty easy to determine:  most websites use your email address as the username. What's not so easy, or at least it shouldn't be, is determining your password. If someone else knows your password with your username / email address, they can gain access to a website and potentially cause havoc. So, managing passwords carefully is one of the most important things we can do for personal and business security.

What's your password?

For several years, reports have been published each year about the worst passwords of the previous year. This data is mostly collected from data breaches and other leaked password information. The amount of this leaked data now totals around 2 million passwords. Out of this data, the top 25 common and insecure passwords are noted. As you might imagine, the top two bad passwords of the list for many years have been "123456" and "password". These are obviously not very secure as anyone can guess these passwords. You can read of the reports yourself: top 25 worst passwords of 2015.

Obviously, if any of your passwords are similar to what's on the list, you need to change them immediately. We understand passwords are necessary, but there are complaints about using them as well.

One of the biggest complaints about passwords is they are not easy to remember if we try to make them secure. Easy passwords are easy to guess or look up in dictionaries or online encyclopedia articles (think Wikipedia). This includes passwords with substituted numbers for letters (think "passw0rd" or "s3cr3t" (instead of "secret"), for example) or well known sentences or phrases from books or articles. Many books and articles are online now so it would be easy for an attacker to check possible passwords and password sentences from those resources.

Another complaint is because it is hard to remember a lot of passwords, most people use one password in many places. This introduces the problem that if one website is compromised and passwords are obtained, the attacker would know your password (and probably username = email) at all of your other websites, including, perhaps, your bank. So, what can we do?

Managing your passwords

There are a couple of good recommendations for managing passwords. One recommendation is to use what's called a "passphrase" that is made up of mixed words not usually found together. This kind of password provides enough characters in order not to be easily guessed and it is not easily found in dictionaries or online encyclopedia articles. Here are some examples:

FishWearsBrownShoes3%

or

ElephantJumpsBluePaper#5

Here, I take words you would never suspect or imagine to be together and put them together in something easy enough to remember (mainly because they are silly - we tend to remember the silly things!). I included the "3%" and "#5" to match a password policy you may see sometimes that require passwords to contain: a capital letter, a lower case letter, a symbol, and a number. You could come up with several of these pass phrases with variations of words and symbols and numbers - the possibilities are nearly endless! Be creative!

Another recommendation is to use what's called a "password manager". These are applications allowing you to create one password which in turn unlocks all the generated passwords you may have and can use with different websites. All the generated passwords are considered to be secure - all you need to do is remember the original one password to unlock the password manager vault of passwords. Generally, this method is considered to be the safest way to keep track of the many passwords you may use. There are lots of options for password managers. You have to evaluate each company to determine how they are storing your passwords (on your machine or somewhere in the "cloud"), how or if they track when you are re-using passwords or keeping the same password for a long time, and price (most passwords managers are not free). One example of a password manager is 1Password.

Next steps

Whatever method you use, think carefully about how you manage passwords. They really are one of the most important security tools you use on the internet today. Give it some thought and consider one of the recommendations above to better secure your own passwords and password usage. 

Next month, I will continue to talk about the kinds of policies your company should use for passwords as well as how two-factor authentication can be used for further increased password security. If I can be of help in setting up your own password policy, or evaluating it, please get in touch. If you have any general questions about passwords, please let me know below.


About Robert Hurlbut

Robert Hurlbut, owner of Robert Hurlbut Consulting Services, based in Enfield, CT, provides software security consulting, architecture, and training. This includes software development, threat modeling, secure code reviews, and other kinds of security audits for your company. If Robert can be of assistance to your company, please get in touch through the below contacts.

Web: https://roberthurlbut.com
LinkedIn: https://www.linkedin.com/in/roberthurlbut
Twitter: @RobertHurlbut

Friday, February 12, 2016

Watch out for social engineering

I am continuing my series of posts on security topics of primary interest to businesses, as I mentioned in my first post on this blog. In this post, I focus on making sure you watch out for one of the most serious security threats facing businesses.

The news seems to mention a new data breach or a set of compromised identities affecting businesses almost on a monthly or weekly basis. We all know we should pick good passwords, make sure we use secure websites for transactions (i.e. see my article on HTTPS), and other important security guidelines. But, one of the main reasons for the data breaches happening is because of an initial social engineering attack.

What's Wrong With Being Social?

The term social engineering refers to the technique of getting around security systems, not by breaking through or exploiting vulnerabilities in a system, but instead by exploiting the vulnerabilities in humans using the systems. Generally, humans trust other humans.  And attackers will use that trust in order to circumvent our boundaries.

There are plenty of examples of social engineering. The most common is when you receive an email that seems legitimate but it is isn't. For example, the email says it is from your bank (something you trust) and there seems to be a problem with your account. The email wants you to click on the link in the email to login into your account, provide your username and password, and help resolve this issue. The link is usually a link to an attacker website that looks like the legitimate website. It is waiting for you to enter your username and password, and now the attacker has your bank information, in this case.

Another example is the phone scam when someone calls you to say you have a problem with your company and they are calling to help. We like when people are friendly and willing to help, and many will automatically trust this scam. The attackers want you to give them access to your computer so they can install some software on it to "fix it". Unfortunately, what is happening is they may be installing malware on your computer which is compromising your system, or worse stealing your username and password entered at sensitive sites like bank websites, etc.

What Can I Do?

There are several things you can do to protect yourself:

1. Always check the email address to make sure it is legitimate. Even then, check the contents of the email, because many emails will use a generic form of salutation rather that address you by name. And by the way, even legitimate looking emails (say from a friend) may not be legitimate because attackers will also send emails that look like they are from our friends.

2. Don't click on links in the email. Instead, go to the website directly and enter the URL by hand. Be careful of hovering over the link because some emails have scripts in them that even hovering over the link could cause the link to execute.

3. Don't open any email attachments you receive from someone unless it was agreed upon ahead of time. By opening the document, you could be installing malware on your computer.

4. If you get one of these scam calls from someone who wants to fix your computer, ask them who they represent and say you will call the company directly to verify. Or, better yet, hang up. You should be in charge of fixing your computer and taking it to someone reputable, not someone who cold calls you.

5. Be careful of people wanting you to copy or print a file from a USB drive. Don't ever put a USB drive in your computer you don't know its origin. These USB drives could have malware on them. This is another form of social engineering. Many companies have been compromised by an employee picking up a USB drive in the parking lot and putting it in their work computer "just to see what's on it".

These are a few recommendations to keep you safe, but the best advice I think is from the Russian Proverb "trust, but verify". Be very careful and make sure your business staff are also watching out for the above issues.

About Robert Hurlbut

Robert Hurlbut, owner of Robert Hurlbut Consulting Services, based in Enfield, CT, provides software security consulting, architecture, and training. This includes software development, threat modeling, secure code reviews, and other kinds of security audits for your company. If Robert can be of assistance to your company, please get in touch through the below contacts.

Web: https://roberthurlbut.com
LinkedIn: https://www.linkedin.com/in/roberthurlbut
Twitter: @RobertHurlbut

Tuesday, January 12, 2016

Do you have Security Champions in your company?


Happy New Year 2016! I am continuing my series of posts on security topics of primary interest to businesses, as I mentioned in my first post on this blog. In this post, I focus on making sure you have some security-minded people on your team(s).

Starting the New Year Right

If you are like me, when the new year rolls around, you reflect on the past year and determine what worked and what didn't. You also make goals and plans for the coming year.


Because I focus on security, application security in particular, I usually think about the application security needs of my business and those of my clients. None of us wants to be in the headlines for a security breach. We know security is still important in 2016, but how do you make sure it happens? How do you make sure security is a priority in your products and services?

Early in 2015, there was a role mentioned in a few places around the internet that every software development team in a company should consider having: A Security Champion.

What is a Security Champion?


I first heard this term early in 2015 from Dinis Cruz in his blog post Does your team has a Security Champion? If not, get this Mug and Library and later What are Security Champions and what do they do?. There were a few others who talked about the role in 2015, including Gunnar Peterson in his blog post Security Champions Guide to Web Application Security.

Essentially, a Security Champion is someone on your software development team who takes on the responsibility of coordinating and tracking security issues and efforts. They are not responsible for implementing all security features in your products or services, but instead they help lead the efforts. They report status on security issues to the team leads. They also make recommendations and/or help make security decisions that impact your products and services.

Why do I need one?

You need a Security Champion on your team because security does not happen by accident. Also, while everyone should be thinking more about security in their everyday lives (i.e. don't blindly open that email attachment even if it seems like it came from someone you know, etc.), everyone can't focus on it exclusively. It helps to have someone or several people in your company who are more aware of security issues and who are willing to lead others in best practices.

My goals for 2016 and a challenge for you

This past year, and for several years, I have served as a Security Champion for my clients on several development teams and for several projects. I look forward to continuing to do so. In this past year, I also had opportunity to speak to more software developers in user groups and conferences about the Threat Modeling process and as I did I also tried to encourage a few to consider becoming Security Champions on their own teams.  I plan to keep speaking on these topics. In addition, I will also provide training for those who are also interested in being effective Security Champions.

My challenge to you: If you don't already have Security Champion(s) on your team(s), think about hiring one or determining who may take on that role. If you already have Security Champions, then by all means encourage them and help them be as effective as possible.

If you have any questions or comments, please leave them below or get in touch through my contacts below.

About Robert Hurlbut

Robert Hurlbut, owner of Robert Hurlbut Consulting Services, based in Enfield, CT, provides software security consulting, architecture, and training. This includes software development, threat modeling, secure code reviews, and other kinds of security audits for your company. If Robert can be of assistance to your company, please get in touch through the below contacts.

Web: https://roberthurlbut.com
LinkedIn: https://www.linkedin.com/in/roberthurlbut
Twitter: @RobertHurlbut

Upcoming security talk: Robert is speaking on February 9, 2016 on "Threat Modeling" at the OWASP Hartford Chapter meeting in Hartford, CT.

Saturday, December 12, 2015

Your Website: If you like it you should put an S on it


As I mentioned in my first post on this blog, I will be writing each month about security topics that will primarily interest business owners. I find now more than ever businesses and business owners are thinking about security, but they aren't sure where to get started. This post talks about one of the first places to start if you have or want to set up a business website.

Do You Have a Website?

When I help a new customer with their business, one of the first questions I ask is "Do you have a website?". Unless you don't want your business to be found (fewer people use the yellow pages these days), you really need to think about putting up a website. There are many great options for website hosting - I won't go into all of those today.

The next step is to determine how you want your customers to communicate or do business transactions with your business website. Will you create private client accounts? Will you process credit card transactions for purchases? Will you host your own company blog that will need to allow many people to log in? If you do any privacy-related business operations with your website, the next item you should consider is putting an S on that website.

Putting an S on your HTTP

As you may know, in order to navigate to a website you usually put in something like "www.your fabulous company.com" and don't think about the resulting website address at the top of the browser. But, take a look at the top address line on your browser. By default, each website uses either "HTTP://" or "HTTPS://" for the browser to know how to display your website. What's the difference between these two?

Essentially, the "HTTPS://" (notice the added "S") usage means your website is generally more secure than the alternative "HTTP://" usage. The "S" means the website is using encryption to send your, and especially your customers', data from the browser to the company website. By encrypting the data (encrypting is a means of encoding or changing a message so only the authorized parties can read it), you make sure no else can see your login credentials, your credit card information, or other sensitive and private data as it is being sent from your browser to the business website.

Without the usage of "HTTPS://", ALL data being sent from your browser to a website is sent in the clear and could potentially be read by other people on the internet.

Better Search Results and Building Customer Trust

On August 6, 2014, Google published a blog post titled "HTTPS as a ranking signal". In the post, Google indicated the importance of using HTTPS for encrypting data as part of their "HTTPS Everywhere" campaign. The post also mentioned when your website is using HTTPS, it will have a slightly better ranking in their search ranking algorithms. Remember what I said earlier about being found on the internet? We can all use an advantage like that.

Beyond the search engine rankings, the most important aspect of using HTTPS for your business website is building customer trust. More and more customers won't interact with your business website if it doesn't have the green padlock (one indication HTTPS is enabled in the browser address). This is especially true if they need to make a purchase using their credit card. Customers should and will also be wary of entering any kind of sensitive information into a website (login credentials or other sensitive data) unless that website is using HTTPS.

Getting it Right and Testing

Now that you know you should put an "S" on your business website, how do you make it happen? Not all HTTPS solutions are the same and you should be wary of someone selling you an HTTPS certificate without verifying your business information.  The key items needed for a good HTTPS solution are:

  • Determine if you need a single, multi-domain (more than one website), or a wildcard (many websites and sub-domains) certificate 
  • A strong 2048-bit key (at least) certificate 
  • Make sure to support TLS 1.1 or ideally TLS 1.2 (avoid TLS 1.0 and SSL 3.0 and below)
  • Make sure RC4 and other weak ciphers are not supported on your website hosting server
Understandably, that's a lot of technical information to parse through, but it is a good checklist to get you started in the right direction.

Once you have your HTTPS solution in place, or already have one, you can test the security level of your business website using the Qualys SSL Labs SSL Tool.  This test will indicate if you have the right levels of security as well as let you know if you should update your HTTPS certificate. Websites using older and outdated certificates will start to be penalized by Google in their search engine results starting in mid-2016. As the new year starts, now would be a great time to take a look and plan accordingly.

I hope this post has been helpful to you and your business in thinking more about security. If you have any questions or comments, please leave them below and I will be glad to help.

About Robert Hurlbut

Robert Hurlbut, owner of Robert Hurlbut Consulting Services, based in Enfield, CT, provides software security consulting, architecture, and training. This includes software development, threat modeling, secure code reviews, and other kinds of security audits for your company. If Robert can be of assistance to your company, please get in touch through the below contacts.

Web: https://roberthurlbut.com
LinkedIn: https://www.linkedin.com/in/roberthurlbut
Twitter: @RobertHurlbut

Upcoming security talk: Robert is speaking on January 12, 2016 on "How To Make Threat Modeling Work For You" at the Tech Valley .NET User Group meeting in Albany, NY.

Thursday, November 12, 2015

Thinking about security in your company

This is my first blog post here and I thought I would introduce myself to you as well as talk about what to look forward to in future posts.

Who am I?

I am an independent software security consultant and owner of Robert Hurlbut Consulting Services based in Enfield, CT.

For over twenty years I have helped companies with their software projects in roles such as software developer, software architect, and project manager. About twelve years ago I shifted my attention to focus more on the security aspects of software development and architecture.

Since then I speak at user groups, conferences, and provide training and workshops to clients on software security and other security topics.

Speaking of security

Earlier this year, I joined the Hartford Springfield Speaker's Network in order to network with other professionals who have made speaking a part of their career. I have found the group to be welcoming and encouraging. This past Saturday, November 7, I had the opportunity to be one of the spotlight speakers.

I spoke briefly on how security issues impact every company. Your company may be listed as a Fortune 50 or you may be a single-person company - in all cases, you need to think about security. This includes how you setup your website, how you store data, how you collect online payments, how you or your staff responds to email, and so many other issues facing companies. It all matters because even the smallest company deals with customers and their data in some way.

Thinking about security

In the coming months, I will write posts about these important security topics to help you run your company in a secure way.

I will cover why you should use a certificate for your company website (HTTPS instead of HTTP - it really matters). I will cover what to look for in an email to avoid viruses and other malware. I will also talk about passwords and the best ways for you and your staff to manage them.

My goal is to help you start thinking more about security and ways to make sure you are safe for your business and for your customers.

Are there other topics of interest?

If there are other security-related topics you have wondered about for your business, please feel free to ask about them in the comments below. I will try to answer your questions, and perhaps address them in future posts.

About Robert Hurlbut

Robert Hurlbut, owner of Robert Hurlbut Consulting Services, based in Enfield, CT, provides software security consulting, architecture, and training. This includes software development, threat modeling, secure code reviews, and other kinds of security audits for your company. If Robert can be of assistance to your company, please get in touch through the below contacts.

Web: https://roberthurlbut.com
LinkedIn: https://www.linkedin.com/in/roberthurlbut
Twitter: @RobertHurlbut

Upcoming security talk: Robert is speaking on November 19 on "Threat Modeling for Secure Software Design" at the Western Mass Development Technology Group meeting. See details here: http://www.meetup.com/Western-Mass-Microsoft-Technology-Users-Group/events/226104540/