As the target audience for this white paper, I’d appreciate HN’s take on the accuracy of this. Whether it misses something, deserves praise or any resources you can point out to make this advice even more actionable.

What’s your advice to a non-technical / non-tech savvy small business owner? Say, for example, people used to buy anti virus as a solution. What could they do now that resembles that?

—-

I work with lots of non-technical / non-tech savvy small business owners and many of them are showing concern. So, I’d love to share as much as possible with the people who are not Palo Alto networks clients.

The document gives an overview of cybersecurity aspects to consider and is pretty good with links to further study - https://news.ycombinator.com/item?id=50347164

IMHO NIST advice is highly reliable but it's often too complicated to be useful, which seems to be the case here (that's up to you, of course).

Otherwise, you need to start with an idea of what valuables you have and what threats - hackers? lawsuits? competitors? how well-resourced? - you're protecting against. No security will be perfect. You need to make it more expensive to steal your data than it's worth to the attacker.

A few general tips off the top of my head:

* As much as possible, don't store anything on a computer that you don't want to read in the news or hear read to you in court. The safest data doesn't exist. For any communications, set a retention period (e.g., delete messages in 30 days), and just save separately anything you need to keep.

* Store confidential data (passwords, credit card numbers, anything that can cost money or reputation) only in a secure database; the only exception is when the data is actually requird. Password databases, if they have long-enough fields, can work here. Do not keep it in emails - don't email around passwords, credit card numbers, etc.; otherwise when the hacker accesses your email, all is lost. This especially applies to confidential client data - you don't want to have to explain to all your clients, 'you're confidential data might have been stolen - I don't really know if they hacker found it or will use it.' With a secure database, you have peace of mind.

* Use Apple products. They prioritize security and have the resources to deliver on it; they are the fastest route to security. Windows' value is to larger organizations managing large numbers of computers. Linux is too complicated to secure for non-technical users (and probably isn't as secure as Apple). It does require trusting Apple, but you need to trust someone.

* Use Signal for communication, as much as possible.

* Security is much too hard to do yourself. Depending on need, use products that a vendor remotely manages (but then you need to trust the vendor). Use your firewall to filter viruses, though that's imperfect and you need to be careful about it slowing down throughput.