Running a small business is no easy feat. That’s why we’ve created a forum for small business ideas, insider tips, and the industry knowledge you need to help your small business grow.
jasonmark, genieee, thommyjy, quizlet, kgrafer, ronaldmak, ronaldjanson, fajartoto, adamwess, ginnyoak, silva_beth, cyfuture, National Cybersecurity Society, trenecia5162, fayster, and markwilliamson updated avatars:
John Purcell, president and owner of Elite Orthopedics, knows passion drives success. On the latest Bank of America Small Business Podcast episode, Steve Strauss sits down with John to discuss the… (Show moreShow less)
AdventurerAdventurer
WayfarerWayfarer
Guide
Ranger
Pioneer
Navigator
Tracker
What are you forecasting for your business in 2019?
a. Better year
b. The same
c. Worst year
I would like to know how much you would pay to have a web site built? Or, How much did you pay to have your website built?
I'm considering in hiring remote sale people. I have read a lot of articles. Tried posting classified ads on indeed.com but the response rate was low. If anyone has experiences in working with remote sales people, I would like to hear your experiences. Thanks.
In this article, Steve Strauss puts the results of Bank of America's Small Business Owner Report for Fall 2018 into terms we can all understand.
New Survey Finds Entrepreneurs Love Their Life. But Hiring in This Economy? Not So Much
While some aspects of the news in this article came as a surprise to me, I was pleased and encouraged by the time I read through to the end. Generally speaking, business owners seem to be optimistic and seeking to grow their business with like-minded people who share the entrepreneur's integrity and enthusiasm.
Enjoy,
--Lisa
While most of us are busy decorating, shopping and otherwise preparing for the holiday season, the bad guys are looking for ways to steal your holiday joy. Small businesses are more susceptible to fraud than most large companies, however, there are ways in which you can help protect your business. Our experts on the Bank of America SBC Team have put together a Resource Center: Fraud and Privacy to help you protect your business. Review these great articles, listen to the experts speak, and learn how to identify potential schemes before they happen.
Do you have any special tips or advice that has worked to help your company prevent fraud? We'd love to hear your feedback!
Cheers,
-Rebecca
Hi, anyone keen to start up a boba tea in Las vegas?
This time of year, you'll find lots of posts about gratitude and saying "thank you."
But we rarely recognize the power of the ultimate business expression of thanks -- the testimonial.
As a business owner, your credibility often depends on finding clients who will publicly thank you and acknowledge your help,
usually through testimonials.
From your understanding of gratitude, you probably realize that writing a testimonial has benefits for the grateful clients, too.
But your client's testimonial will also help a third way -- encouraging your future clients to make a decision that could be life-changing.
Happy Thanksgiving.
Travel Safe
"In the latest Bank of America Small Business Podcast episode, Steve Strauss speaks with Jessica Kavanagh, founder of VetLinks.org, and Lieutenant Colonel Kirk Duncan, the military affairs director of the organization. Listen to learn about the journey to create VetLinks and discover how it empowers veterans – with tips to help entrepreneurs everywhere thrive."
Passion, Purpose, and Resources for Veterans – an Interview with VetLinks
I hope you enjoy the article, or the podcast if you prefer to listen. Please feel free to share your thoughts with the community.
--Lisa
Are you looking for some inside information on Internet name renewal? Here's an up-to-date report from Internet name renewal experts who should know.
Domain name renewal might sound simple, but with so many scams going on, it's definitely a subject worth mentioning. If you fail to renew your domain name properly or within a certain amount of time, you could lose it to someone else and never get it back - no matter how hard you've worked on your website. Here are some helpful tips to ensure that your domain name stays right where it needs to be - in your domain name account!
Multiple Domain Names
If you own multiple domain names, keep a list of all your domain names, their individual expiration dates (if each was registered at a different time), and your personal account information for your domain name registrar. You will likely need to log-in securely to an account to renew your domain name and pay the renewal registration fee. Don't let your web address come up in someone's registration whois lookup as an available domain name.
Tip! Before designing your website, be sure to create a plan on paper. Plan the layout and flow of the site before turning on your computer!
Secure Your Domain Name for Longer Periods
If you own a domain name for example paraphrase online and that you plan on keeping for many years to come, you can save money now and time in the future by signing on for a longer duration of domain name registration. For example, some domain name registrars are offering up to 10-year registration at a tremendous discount per year. You will pay a little more up front, but save dollars in the long run. Also, this frees you from the yearly domain name renewal for 10 years!
Hopefully the information presented so far has been applicable. You might also want to consider the following about renewing your web domain name:
Use Renewal Time to Re-evaluate Your Website
When your domain name renewal time comes around, use that time to re-evaluate your website situation. Perhaps you've changed to a new hosting company since registering your domain name. You might consider moving your domain name to that company to make things easier in the future. During the renewal period, this is a good time to make the switch without wasting part of your yearly fee.
Tip! As the time progressed the Web designing languages changed their faces, one of the main drastic change was the dynamicity of the pages along with the database applications. This particular change cropped up some new languages like VBscript, JavaScript, ASP.
You might also use this time to register another domain name or two that will complement your business. You can package your registrations together to save money on each domain name.
Automate to Avoid Domain Name Mishaps
Many domain name registrars allow you to automate your domain name renewals so you won't have to be reminded each time. This is an automatic credit card charge billed to you during renewal time. Be on alert still with this system. No system is flawless, so you should still be mindful of when your renewal time is to ensure that your domain name gets renewed on time.
Start with the Initial Registration
If you're brand new to this whole domain name registration process, keep the following tips in mind. Register your domain name at a trustworthy company. Cheaper is not always better. Keep your domain name account information in a safe place on your hard drive as well as in your office, written or printed as a hard copy in case you lose your computer information.
When renewal time comes, you will need your account login and password to access your domain name information for renewal. Registrar companies are usually very strict when it comes to domain name security, so you might have to give an arm and a leg to get your password back if you lose it!
Keep these tips in mind when domain name renewal time comes around to ensure lasting success online! And, take time to consider the main domain name renewal tips presented above. What you learn may help you overcome your hesitation to take action.
About author:
Eddie Hartley works as a writer at the paper editing services PapersEditing. He is fond of technology. Eddie has extensive writing experience for technology magazines. Attends exhibitions and forums.
Are you thinking of starting a new business, and unsure how to go about finding the necessary funding? You'll want to approach your prospective lender with all the necessary information, but where to start? The journey to procure the funding needed can often be a confusing maze that a new small business owner may need some help navigating, so our small business experts are here to help!
You'll find all the information that you need to know in this excellent collection of articles, videos and Q&A's about everything from how to establish credit for your new small business to how to grow your small business once you've started - and everything in between, in our Resource Center: Credit and Lending.
We hope you will find our resource center helpful, and look forward to hearing your feedback. Be sure to ask any questions you may have, as our helpful community will be glad to provide their experience and guidance.
Cheers,
-Rebecca
John Purcell, president and owner of Elite Orthopedics, knows passion drives success. On the latest Bank of America Small Business Podcast episode, Steve Strauss sits down with John to discuss the ambition and persistence that continue to propel...
John Purcell, president and owner of Elite Orthopedics, knows passion drives success. On the latest Bank of America Small Business Podcast episode, Steve Strauss sits down with John to discuss the ambition and persistence that continue to propel him forward, with tips and inspiration for others striving to succeed.
John Purcell: I love what I do, and I think that is something important for everybody to think about is, you gotta love what you do. When you love what you do, you have the passion to do it 24 straight hours if need be, but at the same time, you know, there's times when it gets really tough. And those are the times when loving what you do that really kind of helps pull you through. When you are having a situation and you're kind of wondering, am I in over my head? Is this too much, or whatever has you down in the dumps that particular day. If you love what you do, that'll keep you going.
Steve Strauss: Hi. I'm Steve Strauss, and you're listening to the Bank of America Small Business Podcast, a podcast where we speak with small business owners about their journey and uncover useful tips for entrepreneurs and small business owners everywhere.
And today we are really excited to be speaking with John Purcell, the president of Elite Orthopedics. Elite Orthopedics is an agency exclusively representing Arthrex. Arthrex is a global medical device company started in 1981, and what began as a company with a focus on emerging procedures has since pioneered the field of arthroscopy. And personally, having had a couple of those, I'm glad they've done that. Arthrex has developed over 10,000 innovative products and surgical procedures to advance minimally-invasive orthopedics worldwide.
John, it's great to have you with us.
John Purcell: Thanks for having me, Steve. I appreciate the opportunity.
Steve Strauss: So why don't we just start at the beginning a little bit, and why don't you tell us how you got started in the business and how you came to be the owner of Elite Orthopedics.
John Purcell: Sure. Well I went to Pittsburg State University in Southeast Kansas and had a couple of undergrads in business and completed my MBA, and it was time to find a job and get in the real world. I would have tried to obtain a PhD in business if my parents would have kept paying for college, because I was having a heck of a time, but they were not onboard with that idea. So real world, here I come.
I was literally chatting with a buddy of mine who was a business owner, and he turned me on to the idea of sales, and he thought I'd be good at it. He plugged me in with a guy that I knew, or a guy he knew, and that turned into an interview. And literally, a little bit of flexibility is what caused me to get the job. I think I talked enough in the interview that they were interested, but when they asked me where I needed to live, I asked them where they had openings. They named Kansas City, St. Louis, and Columbia, Missouri. All were far bigger than anywhere I'd ever lived in my life, so I told them any of the three would work, and they hired me on the spot and told me they'd tell me where I was moving to once they filled the other two spots. So it's good to be flexible.
Steve Strauss: Flexibility works.
John Purcell: It sure does.
Steve Strauss: So was that with Elite Orthopedics, or who was that with?
John Purcell: No. So Arthrex is the $3 billion company today that makes the orthopedic surgical implants that we sell, and they have kind of a unique distribution model where they have distributors or agencies that cover certain states and zip codes. And at that time, the distributor that I started my career with was called TASA Medical, and I worked for them up until about 2011, and then started Apollo Surgical Group, which then became Elite Orthopedics, and essentially that was my own distributorship or agency for Arthrex.
Today my company Elite Orthopedics…we cover the east half of Missouri and the southern third of Illinois, and I think we've got 67, 68 employees now covering that area. Mainly most of those are our technology consultants, which are our sales reps, and they're in the operating room all day every day, helping orthopedic surgeons with consulting and surgical carpentry questions, I guess.
Steve Strauss: So that's really interesting. I mean, you actually went from an employee to becoming an owner of your own business within that group, and that's kind of a different model for a lot of people. Did you grow up in a family where entrepreneurship thrived? Did your parents own small businesses, or is this just something that you were fortunate enough to get into?
John Purcell: No. That's a great question, and I would say yes. I grew up in a business family. My grandfather was the president of a local banking system and the chairman of the board after he stepped down as president for a long time. My mother was actually a high school teacher who taught general business, and my father, who had a business degree and a master's in engineering from Pepperdine, owned and operated his own driving range, golf shop, golf business. So even when I was 11 years old, I was putting in about 30 to 40 hours a week working at my dad's business, helping shag golf balls and you know, dusting golf clubs. I did minor club repair and you know anything he needed me to do. I learned at a young age that work ethic is king in this world.
Steve Strauss: So far for you what we've learned is being flexible works for you, and having a good work ethic works as well.
John Purcell: Yeah, absolutely.
Steve Strauss: Nice. I'm wondering if you could tell us little bit about your journey as a business owner. You started Elite Orthopedics three to five years ago. Was it just you when you started? How big or small was it when you actually became an owner of this business?
John Purcell: Sure. So I actually started my initial company, was called Apollo Surgical Group, and we started that in 2011. I had a partner who lived in the Kansas side, and we owned the company together. And I think when we started we were about 20 million, and together we grew that business to roughly 45 million. And then ultimately decided, you know what, we've both got a great formula, and we've got our own sale's management infrastructure. We're probably best if we divide and conquer and each have our own piece to focus on. So we did that in 2015, and Elite Orthopedics was born. And essentially in 2015 ... We've had some pretty explosive growth. In 2015, I want to say we were doing close to 24 million in revenue, and this year we'll do 45. And back then I want to say I had 30 employees, and this year we'll probably end the year closer to 75.
So we've had some pretty explosive growth. It's all thanks to Arthrex and the products that they make. We cover everything in orthopedics from sports medicine injuries like ACL reconstructions, Tommy John surgeries, rotator cuff surgeries, to total joints, hand and wrist, foot and ankle. We sell a lot of the large capital equipment items that they have. You know, Arthrex has put a ton of money into the research and development, and we have the benefit of being the sales force for them. So literally every day our guys wake up and go try to educate more surgeons and customers on the Arthrex product offering.
Steve Strauss: So that's really interesting. You're doing one thing that I often counsel small business owners to do, and that is to find a great brand that they can co-brand with. One of the challenges small business people have is that they're small, and they don't have a huge brand. But what you've done, and what you've done well and right is teamed up with this amazing brand in your world, Arthrex, and together they've helped you grow your brand, and you've helped them grow their brand. Has that made a difference for you?
John Purcell: Absolutely. I couldn't have done it without them. Whatever initiatives or stock that they have of what they want me to do, I do it every time. I don't question what it is. We just find a way to get it done. They do stuff the right way, and literally they are what makes Elite who it is, their product portfolio. Our number one greatest asset is our employees, and without our employees and reps and the Arthrex portfolio, Elite wouldn't be able to do any of what it's done so far.
Steve Strauss: So it's also got to be true that there has to be a lot of competition for what you're doing in your space. So what is it though that makes Elite Orthopedics unique and different? You have a great brand and a great partner, but you must be doing something different and better.
John Purcell: Well I feel like we're constantly trying to see three to five years down the road, and I think if you think about the growth we had where we've literally doubled in size in the last three years, and then when I look at the region that Elite is, the three years before that we doubled in size. So my toughest challenge is trying to think big enough and stay ahead of the game. It's real easy to get behind when you're trying to keep up with a machine like Arthrex. The owner of Arthrex, Reinhold Schmieding, is the Steve Jobs or the Bill Gates of orthopedics.
You mentioned there's a lot of competition. There's a boatload. All of my competitors are the big boys in this industry doing you know four and five times the revenue of Arthrex for each one of those companies, and so for me, I always try to stay ahead of them by acquiring the best talent. We have a robust medical education department where I have a full-time medical education manager that literally trains new sales reps on the anatomy, surgical procedures, all day, every day. It's more than just selling to the physicians from a growth perspective. I've got to keep up with rep education, which as you can imagine, the learning curve is pretty stiff in this business.
Steve Strauss: I bet it is. It is interesting though that sales are the biggest part of your business maybe. What do you look for in a good salesman? What could other small business people who do sales learn from your explosive growth insofar as what it takes to make a sale and repeat a sale?
John Purcell: Well I think a lot of it has to do with hard work. It's easy to say, but at the end of the day, if somebody puts in the time to cover the cases they need ... Our reps are constant students of the game. They're always trying to sharpen the sword, learn about new surgical procedures, learn about new techniques with current products, learn about all the new products.
Arthrex is incredible. They launch over a thousand products a year. So literally at some places, it'd be a full-time job just trying to learn all the new stuff, and our guys are doing that in addition to servicing all of the current surgeries going on every day, and at the same time, picking up all these new ideas and these new techniques, and then disseminating them down to the physicians to determine if it's going to help them treat their patients better.
Steve Strauss: Interesting. We are speaking with John Purcell, the president of Elite Orthopedics, and we will get back to my conversation with John in a second.
But first this from our friends at Bank of America.
I want to ask you this. Have you heard about Business Advantage Relationship Rewards from Bank of America? It's a new program that rewards eligible small business owners with benefits and rewards that grow as their BofA business deposit or their Merrill Edge or Merrill Lynch investment balances increase. You can read about it at bankofamerica.com/relationshiprewards.
There are all sorts of benefits including no fees on select services from Bank of America, including monthly maintenance fee waivers on up to four checking accounts and four savings accounts. A 25% to 75% rewards bonus on the base earn of every purchase you make with your eligible Bank of America credit card. Cash rewards based on your Bank of America merchant services monthly payment processing volume. Up to 20% interest rate booster on a Business Advantage Savings Account. And interest rate discounts on new loans and lines of credit.
Interested? You should be. Learn more about Business Advantage Relationship Rewards at bankofamerica.com/relationshiprewards. That's bankofamerica.com/relationshiprewards.
Steve Strauss: So John, while you clearly have had some amazing growth, I am sure that it has also come with some unexpected challenges. Could you tell me what those have been and how you've met those?
John Purcell: Well, we get challenged every day in the operating room. There will be a patient that will present with a unique situation, and what makes our sales reps, or our technology consultants as we call them, great is their ability to think on their feet. So when I was a technology consultant or a sales rep, I felt that one of things I did well was I knew my products, I knew how they were used, and I was good at thinking on my feet. So when the surgeon wasn't prepared for something, we were able to think of a way with our widgets to help bring value and help throw-out some ideas or solutions that they could employ to try to get out of that jam.
I wish running a business was as easy as it was for me thinking out of those mechanical jams. But every day is a new challenge, and I honestly believe my biggest challenge would be trying to think big enough to keep up with the growth of Arthrex. So literally hiring, staying ahead on the hiring curve, and making sure we've got high quality individuals ready to step in when an opportunity presents. And I would say the other challenge is just my business infrastructure, and making sure that we've always got room for expansion whether it's in the operations department, the accounting and financial analyst department, operations ... I mean just trying to think large enough of where we're going to be.
I was recently at a meeting, and the president of Arthrex was talking about how we're going to plan to double in the next five years. And all of a sudden while everybody else was thinking, "Wow, that's great news!" I had this small moment of panic where I'm thinking, "Oh my gosh! I just bought a facility and a building, and now I'm going to need to have one that's double the size. I'm going to need twice as many reps." And so I start thinking through all of the layers of infrastructure and what that looks like. It's a good problem to have. I'm not complaining, but it's difficult to think that far ahead and to think that big and be comfortable with what you need to do to get there.
Steve Strauss: Well this kind of growth and expansion must have had an impact on your personal life. People always talk about the balance, and I don't think…I don’t think you really can have a great balance. At some point family takes priority. At some point the business takes priority. Balancing them is never easy. How has the growth of your business impacted your personal life?
John Purcell: You're right. It's definitely a challenge, but I have the world's most amazing wife. She's very understanding of my business and my hours. She's very supportive. She helps tremendously. But you're right. There are certainly times when I'll be gone for five or six days to a convention or on a trip for work, and I'll come back and I need to basically just shut work down for a little while and reconnect with my wife and the kids and give everybody the quality family time that they deserve. And it's a constant challenge, but in order to keep up the pace that we move at and to keep up the ability to have things keep moving the way they are, there's some sacrifices that you have to make, and it's unfortunate. But I always try to make sure that whenever I get back from one of those events that I really focus on my family and make sure they're getting what they need as well.
Steve Strauss: You know, I'm wondering the role technology plays in your business. Obviously you have a technology business. But insofar as the business-side of the business goes, do you use tech to help create this infrastructure? Do you use social media maybe in any way to grow your business? Or maybe it's all a more personal touch kind of business. You tell us.
John Purcell: Well you know, that's a good question, and I have a second company that I own a piece of that does lawn and landscaping. And in that business, you know, social media marketing, can really impact the bottom line. However for Elite Orthopedics, social media marketing doesn't necessarily impact the bottom line because I'm selling to a very specific audience of doctors.
However, it has been very important for me over the past year and a half or so where we have been relying on social media between Facebook, LinkedIn, Instagram, and some subscription software pieces that I utilize to help keep up with the recruiting and the hiring ways. So I can't say that they've helped impact the revenue from bringing on sales, but it's absolutely been critical to impact the revenue from helping me find the personnel to keep up with this wave of growth.
Steve Strauss: Is there anything you would do differently having done this for several years now? What might you have changed, or what might you think you're going to change in the future?
John Purcell: You know, this past year I had a moment where we'd recently brought accounting in-house. And I had a third-party company that I was working with previously. They were unbelievable. They were incredible, but when the day arrived that we needed to bring accounting in-house, I did that and then quickly realized, "Why didn't I do this sooner?" So I think for me, a lot of times, I might not feel it's the right time to do something, or I might be hesitant about it, but once I've done it, there's been a few occasions where by the time I actually pulled the trigger on a new position or whatever it was, a couple months later I'm thinking, "I should have done that sooner."
So I think the times I just need to just trust my gut a little bit more, or listen more to what others are doing and give it a shot and get out of my comfort zone a little bit more and think bigger.
Steve Strauss: Think bigger. That's a great theme, and I love that you keep saying that. I'm wondering, any other advice you might give entrepreneurs who are listening today? Clearly you love entrepreneurship. You love your business. You've been very successful at it. What do you think people could take away from your journey?
John Purcell: Well, I feel like I got lucky in a sort, but when I was in college and I mentioned I had that conversation that my buddy plugged me in with a guy that was in surgical sales. And as I think back, you know what? I was in the right place at the right time and knew the right guy, and then when I got my opportunity, it was all about demonstrating the work ethic and essentially being flexible. And then once I got into that role and started getting to know the job a little bit, I really fell in love with it, and I love what I do.
And I think that is something important for everybody to think about is, you gotta love what you do. When you love what you do, you have the passion to do it 24 straight hours if need be, but at the same time, there's times when it gets really tough. And those are the times when loving what you do that really kind of helps pull you through. When you are having a situation and you're kind of wondering, am I in over my head? Is this too much, or whatever has you down in the dumps that particular day. If you love what you do that'll keep you going, and you can live to fight another day. It's always darkest before the dawn.
Steve Strauss: Nice. Well we here at the Bank of America Small Business Podcast love what you're doing, we love talking to entrepreneurs who are getting the job done and making a difference and helping everyone in the process. And that's clearly what you're doing. So John, if people want to find you or Elite Orthopedics, where should they go?
John Purcell: eliteorthollc.com. We're always looking for talented individuals that can help make us better.
Steve Strauss: Fantastic. Keep up the great work.
John Purcell: Thank you very much. Appreciate the opportunity.
Steve Strauss: For Bank of America, I'm Steve Strauss.
Up next:
About Steve Strauss
Steven D. Strauss is one of the world's leading experts on small business and is a lawyer, writer, and speaker. The senior small business columnist for USA Today, his Ask an Expert column is one of the most highly-syndicated business columns in the country. He is the best-selling author of 17 books, including his latest, The Small Business Bible, now out in a completely updated third edition. You can also listen to his weekly podcast, Small Business Success.© Steven D. Strauss.
Web: www.theselfemployed.com or Twitter: @SteveStrauss
You can read more articles from Steve Strauss by clicking here
Bank of America, N.A. engages with Steve Strauss to provide informational materials for your discussion or review purposes only. Steve Strauss is a registered trademark, used pursuant to license. The third parties within articles are used under license from Steve Strauss. Consult your financial, legal and accounting advisors, as neither Bank of America, its affiliates, nor their employees provide legal, accounting and tax advice.
Bank of America, N.A. Member FDIC. ©2017 Bank of America Corporation
Running a business is tough, but it can run more smoothly by simplifying operations with the right systems and processes in place. Here are six strategies to consider so that your business runs more smoothly. Get the right team...
Running a business is tough, but it can run more smoothly by simplifying operations with the right systems and processes in place.
Here are six strategies to consider so that your business runs more smoothly.
Get the right team on board
Do you have the right team? Human resources experts advise that when hiring, consider the three I’s: Integrity, initiative and intelligence. Additionally, consider hiring those with improved soft skills. A good employee should co-exist with others regardless of their title or position. Team players are assets to any organization and can make running your business easier.
RELATED CONTENT: 3 Big Problems Small Business Owners Struggle With, Part 2: Finding and Retaining Employees
Be hands-on and part of the team
Your employees already know who the boss is, so make a conscious effort to be a part of the team and lead by example. You will not only understand the challenges your employees have but you also get to learn the intimate operations of your business. This does not mean that you turn into a master of all things and micromanage everything. However, being more hands on lets your employees know you’re making an attempt to understand what they do. It also shows them that you’re also accessible and approachable.
RELATED CONTENT: 7 Traits of a Great Manager
Communicate, then communicate more
Do not assume your employees will understand all your decisions. Yet it is important to focus on the desired outcome for the business so everyone understand why they are doing what you ask. Let everyone on your team know their roles and your expectations. One of the significant sources of workplace strife is a collision of duties. When duties are not well defined, it creates conflict and unhealthy internal competition. Such problems are energy suckers and can make the work environment needlessly tense. As a leader, communicate and point everyone in the right direction. When all are walking in the same direction, conflicts decrease.
RELATED CONTENT: 7 Tools for Improving Office Communication
Involve everyone
People have different personalities. As a leader, bring everyone on board and make them feel like they are an important piece of the business. No one should feel superior to the other. Spend time with your team and get to know them beyond the office. When employees feel that you care, they will perform better at work.
Get your team’s view and advice on the operations and business. You do not need to implement everything they tell you but you will get to learn a few things from them. Doing so can help employees take charge and responsibility for the success of the business.
RELATED CONTENT: Creating a great business culture by Steve Strauss
Reward, compensate and train well
A reward is an excellent way to boost productivity and morale in the workplace. Happy employees will be more productive employees and therefore help your business run smoothly. Rewarding and compensating may not always include a financial increase.
Find out what your employees value in their lives and provide them with it. That could be time off, gift cards and even an office party celebrating their work.
Do not limit the training to strictly job-related. Other areas that will empower your employees are life skills and personal finance lessons among others. When you invest in your employees, you are the ultimate beneficiary. The leading cause of stress in individuals today is financially related. If you choose to train your employees on how to manage their money better, you will get stress-free people. As a result, they will deliver more and make their workplace a better place.
RELATED CONTENT: The importance of employee perks and how you can offer more than you think
The value of your business is directly related to how smoothly your business operates. A smoother working business leads to more engaged employees, sales teams, leadership and customers. If you simplify your business, you will also simplify your life!
About Ebong Eka
Ebong Eka is no stranger to the world of personal finance. As a certified public accountant and former professional basketball player he offers a fresh perspective to small business planning and executing. With over fifteen years of accounting, tax & small business experience with firms like PricewaterhouseCoopers, Deloitte & Touche and CohnReznick, Ebong provides practical money solutions tailored to the everyday person, the aspiring entrepreneur or the small business owner.
Ebong is the founder of EKAnomics, a sales, pricing and leadership firm. He is also the founder of Ericorp Consulting, Inc., a tax and management consulting firm. Ebong is the author of “Start Me Up! The-No-Business-Plan, Business Plan.”
Ebong is also the founder of The $250 Tax Pro, which provides tax preparation and consulting services in the Washington, DC area.
Web: www.ebongeka.com or Twitter: @EbongEka.
You can read more articles from Ebong Eka by clicking here
Bank of America, N.A. engages with Ebong Eka to provide informational materials for your discussion or review purposes only. Ebong Eka is a registered trademark, used pursuant to license. The third parties within articles are used under license from Ebong Eka. Consult your financial, legal and accounting advisors, as neither Bank of America, its affiliates, nor their employees provide legal, accounting and tax advice.
Bank of America, N.A. Member FDIC. ©2018 Bank of America Corporation
Season’s greetings from the Small Business Community! The holidays are in full swing on Main Street and it’s time to check in to make sure your small business is ready. Brent Tilson, CEO of Tilson and author of “Go Slow...
Season’s greetings from the Small Business Community!
The holidays are in full swing on Main Street and it’s time to check in to make sure your small business is ready. Brent Tilson, CEO of Tilson and author of “Go Slow to Grow Fast,” shares holiday best practices for small businesses on this episode of “The Heartbeat of Main Street.”
“The Heartbeat of Main Street” delivers timely insights tailored to the needs of small business owners and entrepreneurs. Featuring a rotating line-up of small business experts and industry leaders – and covering a range of topics – each episode explores the trends that have an impact on revenue creation for small business owners.
The series is hosted by ForbesBooks, and more information can be accessed through a dedicated home page. New episodes will appear regularly on the Small Business Community podcast page. Be sure to check back often – so you don’t miss a beat.
Brent Tilson: When you're thinking about the holiday season, start all inclusively with everybody that you're going to communicate with so that you can be sensitive to not only your employees and the impacts around what could be a morale issue in the company ultimately, but also your customers.
Narrator: Welcome to “The Heartbeat of Main Street” with ForbesBooks at forbesbooks.com and Bank of America at bankofamerica.com.
Gregg Stebben: I'm here with Brent Tilson. He's the president and CEO of Tilson, tilsonhr.com, also the author of the ForbesBook Go Slow to Grow Fast, How to Keep Your Company Driving and Thriving in a Fast-Paced, Competitive Business World.
Brent, we're thrilled you're here, and we invited you here to talk with us about some HR issues that are particularly relevant today as we're getting closer to the holidays. The holidays can have some really ... companies can handle the holidays with their teams and their employees in a very successful way, I would imagine, or they can really step in it and make some real mistakes.
And interestingly, as I've been reading your book, Go Slow to Grow Fast, your book actually centers around a company having what they think is a morale issue. Hint, hint, it's not really a morale issue. That's just a symptom, but it's so perfectly aligned with the idea of making sure that you do the right thing for your employees during the holidays, that I wanted to talk with you both about the book and things we can do as companies to handle the holidays appropriately.
And when I bring up the idea of the holidays and dealing with employees, is this a common conversation that companies have or should have?
Brent Tilson: Well thanks, Gregg. And it is a conversation that companies should be having, especially this time of year. I don't necessarily find where companies have written policies about what they should or shouldn't say during the holiday season, so it's important that people talk about it and that the management teams understand what's important, that they share with the employees, and really have a conversation around those pitfalls. As you said, they could really step in it, and people get really excited around the holiday season.
In fact, not too long ago, we celebrated Halloween, and, years ago, Halloween was something that was very commonly celebrated. Well there's also a little darker side to Halloween, and so companies today are starting to be mindful that certain employees don't want to have these Halloween celebrations. And it's the sensitivity issue that we ... I wouldn't have imagined years ago, but so many things I see today, I would never have imagined years ago.
And so it's important that companies have these conversations to begin to think about their employees and the excitement that they have to celebrate, but just because they may have that personal excitement at home, they have to somewhat tamper it down a little bit when they're in the office or at work.
Gregg Stebben: Well, right, I mean, one of the things is you have to make sure that these kinds of things within the office are inclusive because people have different religions, different celebrations, different customs, and different traditions. And if I'm listening to this and I'm an HR person, what kind of advice can you give me for helping me discuss this with my management team to make sure we're doing the right thing when we approach it with our employees?
Brent Tilson: Well the first thing I like to tell people to think about is to approach it both for internal and external. So when you're thinking about the holiday season, start all inclusively with everybody that you're going to communicate with so that you can be sensitive to not only your employees and the impacts around what could be a morale issue in the company ultimately, but also your customers. Because your customers have to be ... You need to be sensitive with them because they also have personal, whether it be religious or other sorts of traditions that they are mindful of.
So my advice would first be think about it from encouraging the employees to see it through the lens of the recipient, the person they're talking with. So if they're certainly in an internal employee situation, be mindful that not everybody is going to be the same faith, and that we are a melting pot, and that we need to be very mindful of the words we use, how we say them, maybe even the greetings and the goodbyes, because this is the time of year when things, people tend to say different things when they meet somebody.
And so it's about understanding through the eyes of the recipient is the first thing that they should do. And then also just be sensitive that, in the holiday season, not everyone is excited about the holiday season. So you have to be sensitive to people, how much are they really wanting you to be engaged in those sorts of discussions with them.
Gregg Stebben: You made an interesting point about ... I've been asking about internal communications and relationships between employees, but there's also employees interacting with the public or the company interacting with the public, and that's another place where, if you don't manage it well, you can really alienate some very important people in your business, which is your customers.
Brent Tilson: Well and people, they get lazy. I was in a very ... what I would consider somewhat of a high profile meeting this last year over the Easter time period. It was just a mixed group, and the individual who was hosting the meeting just was careless in comments towards the end, and this was actually an elected official who wasn't really thinking about what he was saying at the time, he was trying to be ... wishing everybody a good weekend. And afterwards, he reflected on what he said and he's like, "I can't believe I just did that." So just careless in reading and understanding the room, and the things you may say or may not say.
And so, it happens to everybody, no matter where you may be, whether it's in business or in some other situation, it's just being careful of really understanding the audience that you're in, and making sure the message is tailored for that audience.
Gregg Stebben: Well, two words come to mind as we're talking about this. One is training. I mean, there must be some ... there has to be some way of communicating this with your employees, or you're leaving it up to chance that they're going to get it right. So you need to, I would think, in some way or another, let employees know this is what we think is appropriate, and we want you to act in the following way.
Which is built on awareness, because I think sometimes people say things like this elected official you were mentioning, sometimes it's just a lack of an awareness that there could be sensitivity, and once you're aware that the sensitivity is there, you think, oh, I never would've done that if I had thought about it, but I didn't have the awareness to think about it.
Brent Tilson: Well, and many people ... and you're right, the training is very important, and the reason the training is important, or at least to make people aware of it. And it certainly should be done not just in a holiday spirit, it ought to be more from a sensitivity and diversity training that's all encompassing so that it's not just specific to the holidays. The holidays are an example, they certainly are a placeholder in the training for people to have to understand that there are different times of the year that you have to be even more aware of the activity, and what you might say or do.
So in those trainings it's important to have these pieces, but it just goes so much more than that. Think about it this way, that people are at work, are in the office, far more than they are at home. But yet they bring from their home their personal beliefs and experiences, and not everybody wants that shared in the office environment. And so it's really important to understand that there's that line that individuals have to manage and monitor themselves when they bring in their personal beliefs, if you will.
And so it's really important to understand both sides of that. There's that line that you do cross when you walk through the door.
Gregg Stebben: I'm talking with Brent Tilson, he's the president and CEO of Tilson, they're at TilsonHR.com. He's also the author of the Forbes Book, Go Slow to Grow Fast, How to Keep Your Company Driving and Thriving in a Fast Paced, Competitive Business World.
Brent, I want to change gears here a little bit and talk about another big part of the holidays in the workplace, and that is: I'm an employee, I have an expectation that I'm going to get a bonus, a gift, a raise, or maybe all three. This seems to me another place where employers have to be really strategic about what they do. I want you to talk a little bit about the things you do at Tilson, so we can then understand the kind of advice you offer to your clients around these kinds of year end issues.
Brent Tilson: These are great issues to address, because you think first about raises. It's one of those things that some people just expect it annually, I'm going to get a raise. The cost of living increase or whatever it may be, and we're always very clear to articulate in our organization that while we do try, and want to be giving raises, and certainly want to keep up with the cost of living, so there's certainly that as an element, so we make sure our staff understands there's an element of raises that are a part of the overall compensation that will happen year after year.
But then on top of that, it's going to be merit based. So if you're improving, and you're moving from one level to another level, and you've actually improved your position and/or your overall performance, then yes you will be justified to get a possibly higher raise. So we make sure it's very clear that there's a merit component to the raise piece, that way we set expectations.
Now come to bonuses, you have those performance based bonuses and discretionary. So performance based, once again, it's going to be based on the merits, so it's very clear and they should be very clearly articulated as to when those bonuses will be paid out, so that they understand how they're doing, so you're rewarding the right type of thing.
Oftentimes in the holidays, we get into the discretionary bonuses, and that's where people can get themselves in trouble, because if they do discretionary bonuses, and they've done it for five straight years in a row, it starts to be expected. And if some reason the company doesn't do well, or some change happens that that isn't paid out, then employees' expectations have to be better managed so that people know that it's not going to happen. We see that as a real problem, companies tend to just habitually do these year-end bonuses, they do it as a discretionary, they don't communicate it that this is not to be expected every year, then people start to think it's a part of their income. And it can be really problematic as people think they're going to use that money for Christmas gifts, or whatever they may be doing.
So certainly those things are an issue that management really needs to talk about, because to set expectations early, and frequently, because you can't just say it once, you're going to have to say it multiple times.
Announcer: As a professional employer organization, Tilson, and one of the services you offer are payroll and benefits administration, is this the kind of thing that you and your team end up talking with your clients about?
Want an alternative to giving bonuses? Try these 6 easy employee benefits to reward employees from Steve Strauss.
Brent Tilson: It is. Yes, our HR team will work with our clients and we'll talk about best practices, things to think about as they're getting ready to roll out their bonuses. Because it's not just a bonus, it could be ... when you get on the technical side, sometimes bonuses are tied to 401k programs, and so that's going to be money that they think they're going to get, or making sure they articulate, okay, you're going to get $1,000.00 bonus but once taxes are done, it's not going to be that full amount, so what is your real intent? Are you wanting them to take home a full $1,000.00? Well then we have to talk about the financial implications, and the taxes, and what we call grossing it up.
So yeah, we talk about everything from the tactical and technical components of how and what amount you want to give, to the strategy of what that impact is on the workforce.
Gregg Stebben: And there's another wrinkle to this, I'm referring to a statistic from the Fall 2018 Bank of America Small Business Owner Reporthttps://newsroom.bankofamerica.com/system/files/Small_Business_Owner_Report_-_Fall_2018.pdf, which reports that 83% of small business owners planned to offer holiday related perks this year, 83%. And I'm relating that to the headlines we read about there being real problems hiring talent. I would think that if you're a small business owner, and you're not offering appropriate bonuses, gifts, or raises, you probably run the risk of losing employees.
Brent Tilson: That's a real issue today. So many companies, that's one of the ... probably the number one thing we hear is keeping employees, and trying to get the talented employees to replace them when they're gone. It's a real issue. And what we're starting to see is some pressure on compensation. We're seeing companies having to put a little more money behind these roles, and these jobs that are open, and/or with the people they have today, to keep them. Because people are being pried away, and the way the world is today with the pace of things, the really top talent is being pursued.
And so giving perks, and as you said, the bonuses, or gifts are just ... when you think about it at the end of the day, it's a very small gesture, but very valuable in the eyes of the employee. And things that we can do today to help keep our teams is important. Now, we don't want to buy their happiness, that's not what we're suggesting. But what we're seeing in the economy is such a strong business environment, and the economy's performing well, profits seem to be up. And if that is then likewise shared with everyone who's contributing then there starts to be a little bit of a disconnect between the employees and the employer.
So it certainly is something that we see companies thinking more about doing this year.
Gregg Stebben: Well and I would imagine at Tilson, one of the things, one of the conversations you're having with clients is even helping them quantify the cost of losing someone, or to say it another way, what's the cost of hiring somebody else? Again, in the Fall 2018 Bank of America Small Business Owner Report, 24% of small business owners said they have lost at least one employee in the last year, and 58% said they were having difficulty finding qualified candidates. So you have to factor those kinds of statistics into if we lose someone, particularly a key employee, someone with great talent, it's ... you're not only losing a person who's doing some work today for the team, you also have to factor in the time and the amount of money that it costs to replace them, if you can replace them.
Read Rieva Lesonsky’s article, 6 Things Entrepreneurs Can Do to Attract and Retain Good Employees.
Brent Tilson: Well, if you can replace them then the ramifications last for years. If you have really top talented people, when they leave, it's not just getting to that next person in the seat, it's all that knowledge that they walked out the door with. And especially if they've been there years with the company, and someone comes and kind of takes them away for a better opportunity, then the cost of turnover is substantial, and we do, we work with our companies and our clients to help them understand what are they doing, what are they putting in place to really make sure that they're keeping their top talent.
In my book I talk about building a high performance team, and to do that you have five major categories for working with employees. How do you find them, develop, direct, motivate, and retain, and those five pieces are so critical. And companies need to make sure that they have things in place at each place along the way so that retention at the very end, is you're retaining, you actually have a strategy and a program to retain employees.
And of course, those that are not performing, well, that falls under how do you direct them, eventually you direct them out if they're not the right people, because they can cost you dearly as well, if you have the wrong people. But those five pieces of the employment lifecycle or so critical to have it right.
Gregg Stebben: I'm talking with Brent Tilson, the book he mentioned is Go Slow to Grow Fast, his new book, How to Keep Your Company Driving and Thriving in a Fast Paced, Competitive Business World. Brent is the president and CEO of Tilson at TilsonHR.com, on Twitter and Facebook @TilsonHR.
You know, one of the things we're talking about, we can talk about here as we talk about the holidays, is how to use the power and the spirit of the holidays to actually inspire and motivate employees. Do you have tips there so that we can actually take that spirit of the holidays, and the togetherness, and use it to make our company even stronger?
Brent Tilson: Absolutely. I think what we like to do, I know what I like to do, and encourage others, is this is a great time to reflect on the successes. There's so many negative things that we see in the news every day, and people ... If we just came out of an election cycle where we're all just beat up over all the negativity that can be out there, and this is a time in the holidays where people are excited. They're ready for celebration, at least you can't assume everybody, but there's a sense of that in the air.
And so, what I like to do is let's look back and celebrate the successes we've had over the last year. Let's make sure we call these people out, and explain, and share, and celebrate with them. Whether we do it publicly in holiday parties, or you do it with a little private note that you write to them individually. But there's also things that people can do, encouraging to give back, because oftentimes when people give back, they get more out of it than just receiving. So we like to recommend, and we do internally, we do a number of different programs where we help maybe a family in need, they have different programs, I think they call them Christmas Angel type environments where a family that's in need will have a list of all the things that they could really use to help their family, and so we've done that. And people ... the generosity that flows from the staff to help these other groups just warms them, and makes them feel better about it. And it just helps create this sense of pride, as well as fellowship and kinship when people are participating in activities such as those.
Gregg Stebben: Within an organization, can that kind of participation in a program kind of come from the bottom up, or the top down? I mean, could it be HR saying, "We've identified this program and we're going to participate," or is there a way to encourage employees who have ideas of their own, here's how to suggest a program that the company or your department might want to participate in?
Brent Tilson: Well, in fact it is both ways. So in our company, we do have things that we suggest corporately, "Hey, this is something that we want to get involved in," typically we put it out for discussion and see kind of what we would like to celebrate and participate in this year, whether it's simply making donations to certain charities on behalf of employees, or possibly it's actually, like I just mentioned, actually doing an event where we're gathering donations.
But what we also have is we actually have a program that we implemented in our company, where we allow people to basically, they submit a request, they can do it individually, but they get a day of paid time off for them to go to a ... either a local charity, or something that they want to give back. So they just submit it, it gets approved. It can be individually or they can do it as a group effort. And so they go and find these things, because we want people to be involved in the community, because we know the value that it provides to them and to the community. So it can be done both ways.
Gregg Stebben: Well I really like the sound of that, because I ... when someone, a team or an individual sources it, and then it gets embraced by the company, even if it's just a few people within the company, that then is going to be very empowering to that person, beyond the spirit of giving, but making them feel like, "Wow, I made a real contribution both to my community, but also to my company."
Brent Tilson: Oh, that's absolutely true. There's so many different programs that we've done over the years, it's fun. When they're ... when the employees and the team choose to do something, then you can see the spirit, because they have a little competition amongst themselves, they make it more fun, they ... who's going to out donate who, and you find that they've been hiding some of their donations so no one really knows how much they have until the last day, and everything shows up and one department's so thrilled that they've outdone everybody else. And it's just ... it's a camaraderie, there's so many things that it does, over and above and beyond merely just the time of giving, but there's also so many other things that just really help employees and people feel a part of something bigger than just themselves.
Gregg Stebben: Brent Tilson is with us on “The Heartbeat of Main Street” with Forbes Books and Bank of America. He's the president and CEO of Tilson, they're at TilsonHR.com, he's also the author of the Forbes book, Go Slow to Grow Fast, How to Keep Your Company Driving and Thriving in a Fast Paced, Competitive Business World.
I think we need to talk about people within your organization who, frankly, may be dreading the holidays. For one reason or another, this may not be a time of happiness for them, but it may be a time of sorrow, or struggle. And what's the best way for us as individuals, as managers, even as ... a C suite executive, to make sure those people are being acknowledged and helped in whatever way that they may need?
Brent Tilson: It is a tough time of year. Many people talk about how, or you see reports, where depression actually goes up during the holidays, because possibly someone ... this is the first holiday, first Thanksgiving, without Grandma, the first time that they're not going over to somebody's house to celebrate one of the holiday events and parties. And there are so many things that are personally tough this time of year, sometimes there are great celebrations, other times they're not so.
And I think the first thing we have to do as organizations is not be ... make things mandatory, and all inclusive, you have to allow people to make decisions on what they want to participate or not participate in. Because just purely mandating may put somebody in a really awkward situation, or trying to encourage ... we want to ... 95% participation at the company's holiday party, well, who's doing that? Is that because you want the bottom line to justify the money you spent? Or are you trying ... what's the intent there? So as managers and leaders, we really need to acknowledge that some people in the organization really just want their space, and their time.
The other part is being sensitive to that. So if you're a manager of an organization, of employees, you may be aware, personally aware, that somebody's going to go through a tough time, so maybe it's a handwritten note, just offering them words of encouragement, without getting into specifics and details, let them know that you're thinking about them during this upcoming year, and holiday season, and just offer that open hand of a gesture of just being here to help if there's anything we can do to help.
So it's more of just being aware, and just good, human kindness.
Gregg Stebben: Is there a way, or should we be thinking about a way to make sure everyone in our organization knows that there's an easy, risk free way to ask for help if they need it? Is there a way to offer that, that's ... that will be effective, and not ... not intrusive?
Brent Tilson: Well, there are. There are many programs that are just available, companies offered, often known as employee assistance programs, EAP programs, that's a little more structured, but they're designed to allow because our professionals who can actually participate in ... and you can say, "Okay, you're going into this time of year, recognize that there may be a need for you to reach out and have a conversation," and so the counselors, through these EAP programs, can talk with the employees, let them kind of work through. So it's not something that's being done internally, it's not being done by the HR manager, or really ... it could be, but really oftentimes this is such a personal thing, it needs to be done in a manner that is supportive of them, and help them, and that's why those programs are important to have for employees. Because you just really don't know all the things going on in somebody's life. And to be able to extend, and remind people, "Hey this is a time of year, don't hesitate to reach out to the EAP group and they can help you."
And certainly there's fliers, and a lot of times there's documentation. I know we have some in our office that we circulate around, just reminding people of this information so that they receive it in multiple fashions, not just like somebody standing up, or telling people, it's actually, hey, it's on the bulletin boards, it's on the intranet site, or wherever. "Hey, don't forget about these tools that are available for you."
Gregg Stebben: That way you are never singling someone out, you let them self-identify as, "Oh yes, that would be valuable to me, and I get to approach it, or take advantage it in whatever way makes sense for me, and is private, or public, a way that I want to."
Brent Tilson: Well that's exactly right, I mean you may have an employee in the office going through a divorce and nobody knows about it, they've kept it quiet, but it's being very disruptive, and it's like during the holidays, and everybody's trying to figure out who's doing what, and when, and where, and that's not something you would want to single out.
Brent Tilson: But if they knew they had the availability to go to ... through a program, or have somebody to talk to, to work through those needs and issues that are professionals, it certainly allows those individuals that to work through their items and not make it a part of the office.
Gregg Stebben: He's Brent Tilson, he's the president and CEO of the professional employer organization, Tilson, at TilsonHR.com, on Twitter and Facebook @TilsonHR. He's also the author of the ForbesBook, Go Slow to Grow Fast. It seems counterintuitive.
Brent Tilson: Well, and that's why the book title, I think works, is people want to say, "What does that mean? What do you mean go slow to grow fast?"
Gregg Stebben: That's what I'm asking, what does that mean?
Brent Tilson: What it means is people really need to slow down, understand their surroundings, what they're doing, where they're going, making sure they're doing the right planning, have the right things in place, put the right measurements, and tools, and think about their business before they just try to grow. I see so many companies go out and try to grow as fast as they can, only to become just a wreck on the side of the road because they just weren't prepared for what they were doing.
So the idea of going slow is to really take the time, understand the business, understand those forces around you. I like to tell people that every year you should ask yourself what will put you out of business? And really think about those issues, so you can better prepare, because once you've thought about that, and you've done the right planning, then go grow as fast as you can.
Gregg Stebben: It's interesting, as I'm reading the book, one of the things that I've really been left with, the book is called Go Slow to Grow Fast, he's Brent Tilson, he's the author. One of the things that it's really left me with that, frankly, I had never completely thought through for myself, is that growth has consequences. It has rewards, of course, but it's also not without consequences, and so if you grow too fast without the planning, that growth can actually kill you. You think it's the thing that's going to make you successful, but it may actually be the thing that kills you, because you didn't plan for it, and therefore you can't handle it.
Brent Tilson: And I've seen it time and time again. And maybe it doesn't put somebody completely out of business and cause them to fail, but they grow to a certain level, they outgrow the capability of the organization, the customers get upset, they start leaving, morale starts dropping. And all the sudden the company has to move backward to re-establish itself, to try to get its feet under it again, and then they start growing. But they lost all that time because they tried to grow too fast, and they just got ahead of themselves. And it happens time and time again. And it's the idea of let's anticipate the future. If you're going to grow at 30% a year, well, what do you have to have planning wise done, you have to do even more than what you're doing if you're growing at 10% a year.
But that doesn't happen. And so my encouragement is people really do go slow to understand, so that you don't have that high growth put you out of business.
Gregg Stebben: Yeah, and the kind of problems you can have if you're not prepared for the growth is anything from cash flow to client satisfaction and losing your clients, which again, can be devastating.
Brent Tilson: Absolutely.
Gregg Stebben: So my last question, and this is a fun one. I hope. You've seen a lot of things in your years, and we've been talking largely about the holidays, and how to approach them from an HR perspective. Have you seen any just like really funny, or common but they shouldn't be, HR gotchas around the holidays that you can share with us? Both to entertain us, but also frankly, so that we can learn something from the story.
Brent Tilson: Yeah, well one of them is I remember walking in an office, and they had mistletoe hanging, and I thought, "No, no, no, no, get that out of here." We don't need mistletoe hanging around the office.
Gregg Stebben: Especially in 2018 it sounds like a really bad idea.
Brent Tilson: Bad idea. So certainly that's an easy one, but that did happen, I just had to laugh.
We all know the holiday parties, those are the things that get people in trouble. They maybe have a few too many drinks, maybe a little too comfortable in the environment, forget who they're talking to. The attire that they wear, I mean, I've been places where it's like, "Oh my goodness, I cannot believe somebody showed up wearing what they're wearing," and it's just, everybody's embarrassed by this whatever, and however.
Gregg Stebben: Everybody but the person wearing it, because they don't even understand that it's embarrassing.
Brent Tilson: Well, yeah, they thought that was a fun outfit for the evening.
Gregg Stebben: Yes.
Brent Tilson: It's like, "No, that was not quite right." So certainly you get into the gotchas of just unwelcome affection, where people just get comfortable, they think it's a fun time of year, maybe they do have an attraction to somebody, and they just kind of ... just a little overzealous, so we see those types of things happening, certainly.
The gotchas from an HR perspective is just you want everybody to remember to keep their ...
Gregg Stebben: It's a work event.
Brent Tilson: It's a work event, this is not a party. This is not a night club event, and just remember that. And so, but I think the businesses owe it to themselves to make sure ... you know, like for us, we have a holiday party, we'll do a two drink ... you know, "Here, everybody gets two tickets, that's all the company's providing." And one of the things that's being recommended this year for companies is to use shared services, like the Ubers, and the Lyfts, and those types of things. And say, "Hey, go ahead as a company and pay for it." If somebody shows up, don't even hesitate to give them the opportunity, why would you want your employee to take a chance even if you're not participating in the purchase of anything, you don't want to put yourself on the front page of the paper because somebody made a mistake and it comes back on you. And so take those necessary precautions so you don't get yourself in trouble. And just don't hang the mistletoe up.
Gregg Stebben: Yes. And I think Uber and Lyft is a really great idea for holiday parties. The last thing I want to ask related to this, is do we as the people at the top of the company, or the organization in the C suite, should be assume that we should be very explicit about, for instance, what is appropriate attire? Or what is appropriate behavior? So that no one can come back and say, "Well, I didn't know."
Brent Tilson: Well, that's best practice. The best practice is when we have these events, and it's clear to what the attire is, what's appropriate, what's not appropriate, oftentimes that's in the dress code. But we have ... when it says that it's evening attire, or black tie, or festive, or whatever, there's so many different varieties of names, you can Google them and look. And then you can get lots of different outfits. So it's really good to be very clear as to what's expected. It just takes the pressure off of everybody.
Also what's expected at the event. Whether or not ... be mindful, this is going back to the alcohol reference, but you are at a company event, and some companies don't have alcohol, they just, they avoid it, they don't want the issues at all. But that doesn't mean the employee's not going to have some cocktails maybe sitting there before everyone gets there. So there's elements you can't control.
Gregg Stebben: Yeah.
Brent Tilson: So it's important to really communicate, and that's a best practice. For all of us who are the leaders of the company, we also set the example. So while we're at these events, we also have to be mindful, everybody's watching us. And from the clothes you're wearing, to the things you're saying, to the things you're doing. So it's very important for the leaders to set the example. And the staff will follow. And I've seen certain leaders who have a little too much fun, well it doesn't take long for the staff to follow in that front. And so I think it's important for us to exhibit it.
Gregg Stebben: It's funny how culture has a way of showing up everywhere, isn't it?
Brent Tilson: That's why it's called culture.
Gregg Stebben: Exactly. Well Brent Tilson, that's for joining us on “The Heartbeat of Main Street” with Forbes Books and Bank of America. He's the president and CEO of the professional employer organization, Tilson, at TilsonHR.com, on Twitter and Facebook, @TilsonHR. He's also the author of the Forbes book, I, I highly recommend it, How to Keep Your Company Driving and Thriving in a Fast Paced, Competitive Business World.
Brent, thanks so much for joining us, and happy holidays.
Brent Tilson: Thanks Gregg, appreciate it so much. Have a great holiday season.
Narrator: Thanks for listening to “The Heartbeat of Main Street” with Forbes Books at ForbesBooks.com, and Bank of America, at BankofAmerica.com.
CYBER CRIME You’ve been hacked – do you know who to call? Cybercrime can be particularly difficult to investigate and prosecute because it often crosses legal jurisdictions and even international boundaries....
CYBER CRIME
You’ve been hacked – do you know who to call?
Cybercrime can be particularly difficult to investigate and prosecute because it often crosses
legal jurisdictions and even international boundaries. According to the 2015 Verizon Data Breach
Report, intrusions go undetected more than 200 days from the actual event. Some criminals
disband one criminal operation — only to start up a new activity with a new tactic — before an
incident even comes to the attention of the authorities. Once you believe you have been the victim
of a cybercrime, it’s important to report it and to protect the evidence.
FACT 1: WHO TO CONTACT
Seek Legal Advice. If you are a business owner, seek legal advice to guide you in addressing
whatever liability and reporting requirements govern the breach. Protecting sensitive employee
data, health data, or credit card data have various governing regulations and notification requirements.
Local law enforcement. Even if you have been the target of a multi- jurisdictional cybercrime, call
your local law enforcement agency (either police department or sheriff’s office). They have an
obligation to help you, take a formal report, and make referrals to other agencies. Report your
situation as soon as you find out about it. Some local agencies have detectives or departments
that focus specifically on cybercrime.
IC 3. The Internet Crime Complaint Center (IC3) will thoroughly review and evaluate your complaint
and refer it to the appropriate federal, state, local, or international law enforcement or regulatory
agency that has jurisdiction over the matter. IC3 is a partnership between the Federal Bureau of
Investigation and the National White Collar Crime Center (funded, in part, by the Department of
Justice’s Bureau of Justice Assistance). Complaints may be filed online at
http://www.ic3.gov/default.aspx.
FACT 2: WHAT TO COLLECT
Even though you may not be asked to provide evidence when you first report the cybercrime, it
is very important to keep any evidence you may have related to your complaint. Keep items in a
safe location in the event you are requested to provide them. Evidence may include:
And most importantly, don’t shut down your computer or erase any files. Law enforcement
and/or a computer forensic specialist will need the evidence stored on your hard drive and memory
storage locations.
FACT 3: MALWARE
Many cybercrimes start with malware—short for “malicious software.” Malware includes viruses and
spyware that get installed on your computer, phone, or mobile device without your consent—you may
have downloaded the malware without even realizing it! These programs can cause your device to
crash and can be used to monitor and control your online activity. Criminals use malware to steal
personal information and commit fraud. If you think your computer has malware, you can file a complaint
with the Federal Trade Commission at www.ftc.gov/complaint. Often malware is embedded in links to
emails or attachments. Don’t open an attachment from someone you don’t know!
DID YOU KNOW…
Download a PDF of this fact sheet.
Still have questions, need help?
Contact us at our “Ask-an-Expert” service, web@thencss.org or visit us at the link below.
©2018 National Cybersecurity Society, All Rights Reserved
www.nationalcybersecuritysociety.org
JOIN THE NCSS
Become a member of The National Cybersecurity Society today and learn more about how to protect your business from a cyber attack.
About The National Cybersecurity Society
The National Cybersecurity Society is a non-profit organization focused on providing cybersecurity education,
awareness and advocacy to small businesses. The NCSS provides cybersecurity education tailored to the needs of
the small business owner; helps small businesses assess their cybersecurity risk; distributes threat information to
business owners so that they will be more knowledgeable about the threats facing their business; and provides advice
on the type of services needed to stay safe online.
WHAT ARE THE CYBER RISKS TO MY BUSINESS? Cyber risk can be defined as the risk of financial loss, disruption or damage to the reputation of an organization through a failure of its information technology systems. Information technology has...
Cyber risk can be defined as the risk of financial loss, disruption or damage to the reputation of an organization through a failure of its information technology systems. Information technology has fueled rapid growth to small businesses, which can help you -- reach more customers, tap into new markets, grow faster, and create more jobs. With that increased reliance on information technology and access to data, new risks to your businesses’ financial, customer data and reputation can occur.
The process of cyber risk assessment includes identifying your organization’s important data (financial data, customer data, and intellectual property), potential vulnerabilities for the systems that store or handle that data, and the potential impacts to your organization associated with a loss of confidence, integrity, or availability to that data.
Assessing and managing cyber risk is no different than managing other types of risk. If you were to manage the risk to your business from flood damage you would -- identify the most important assets that could be affected; consider how vulnerable those assets would be to a flood; consider the likelihood of flooding in the area; and determine what responses make the most sense based on the corresponding costs of responding to that risk. (Eg: invest in measures to protect those assets, move the assets, transfer the risk through insurance, or accept the risk.)
There are many available resources to assess cyber risk. How extensive to analyze risk – is based on a range of factors --- business priorities, regulatory standards or cost considerations. The National Cybersecurity Society provides a free survey that helps small businesses assess cyber risk called NCSS CARES (Cybersecurity Assessment and Resiliency Evaluation for Small Business). The assessment methodology was adapted from two main sources: The NIST Cybersecurity Framework and Carnegie Mellon’s Software Engineering Institute, CERT, Resilience Management Model.
NCSS CARES measures small business risk based upon the level of maturity of the business’ organizational cybersecurity and resiliency processes as defined by CMMI. CMMI (Capability Maturity Model Integration) is a process level improvement training and appraisal program, developed by Carnegie Mellon University. NCSS CARES can be found at: https://nationalcybersecuritysociety.org
Assessing your cyber risk is an important consideration for any organization’s overall evaluation of risks. Many insurance providers are using an assessment to set rates for policies; therefore, an understanding of your risks and how your organization manages risk are a critical steps in ensuring your business is resilient. Begin now by assessing your risk through the NCSS CARES.
The American Bar Association is recommending all vendor agreements include a section on assessing the risks of an organization’s partners. NIST 800-171, Protecting Critical Unclassified Information in Non-federal Systems, is requiring contactors who do work with the government assess their risk and provide an affirmation statement that they have complied with addressing and mitigating known risks.
The NCSS has mapped NCSS questions in the survey, NCSS CARES, to the cybersecurity framework. The mapping can be found elsewhere on our site.
HERE ARE SOME RISKS TO CONSIDER:
Download a PDF of this fact sheet.
Still have questions, need help?
Contact us at our “Ask-an-Expert” service, web@thencss.org or visit us at the link below.
©2018 National Cybersecurity Society, All Rights Reserved
www.nationalcybersecuritysociety.org
JOIN THE NCSS
Become a member of The National Cybersecurity Society today and learn more about how to protect your business from a
cyber attack.
About The National Cybersecurity Society
The National Cybersecurity Society is a non-profit organization focused on providing cybersecurity education, awareness
and advocacy to small businesses. The NCSS provides cybersecurity education tailored to the needs of the small business
owner; helps small businesses assess their cybersecurity risk; distributes threat information to business owners so that they
will be more knowledgeable about the threats facing their business; and provides advice on the type of services needed to
stay safe online.
Every day in the news, we hear about data breaches. Are you concerned your sensitive business, customer and supplier data is not protected? STEP 1: DATA OWNER All data needs someone in your organization to determine...
Every day in the news, we hear about data breaches. Are you concerned
your sensitive business, customer and supplier data is not protected?
All data needs someone in your organization to determine how valuable the data is that you want to protect. In the
cybersecurity business, we call that person a data owner.
The data owner could be the inventor who created your secret sauce, your CEO who devised your unique business
strategy, or the customers who depend on your services.
Not all data needs protection. The data owner can be called upon to determine which data to protect, how sensitive
it is, who can access it and use it and the severity/criticality of the data if it is lost or stolen.
It’s easy to say that your payroll data is critical for your business, but what about the age of your equipment and warranty
schedule? It may not be critical now, until you need to replace it or ask the manufacturer to repair it. The business/data
owner can help you decide how “critical” various data elements are that you need to protect.
STEP 2: DEVICE MANAGEMENT
Data protection can include protecting the data by preventing access to the device (via passwords or other authentication
methods) even while it is stored on a laptop or memory device. Ensure that any critical data stored on removable device
(memory stick, disk, hard drive, laptop, tape) is password protected. These devices and the data that resides on them can
be easily stolen and compromised. If the device is password protected, it will be harder to gain access to the data stored.
STEP 3: CYBER SAFE BUSINESS PRACTICES
Simple cyber safe business practices can help protect your data. Your employees are often your best defense in protecting
your data. They know the ins and outs of your business, when deliveries are made, who the suppliers are, who your critical
customers are, profit and loss data and many more unique business facts. Don’t let that information get leaked, stolen or
posted on social media.
tips to prevent data loss.
Have you downloaded the latest updates? Does the vendor still support the applications you are using for your business?
It is important to know where you stand in your inventory life cycle and whether it might be time to update your hardware
and software. This is one of most overlooked cyber safe practices that criminals often use to gain access to your data.
problems. These utilities can prevent little problems from becoming big problems, and will keep you in business.
Before you make changes to critical data, always make a duplicate. Even if you just made a backup yesterday, make another
and label it. If you or your employees create a backup on a removable drive, have the drive or memory device password
protected.
Something you probably never thought of, but what happens if there is a fire at your facility and your only backup was on-site
and was lost in the fire? Keep a copy of your critical data offsite. If you use a managed service provider to store your data and
applications, ensure that they provide you the ability to recover your data if it is compromised at their site. Know what is in the
fine print before you sign the agreement. If they don’t provide a guarantee - find another provider. Another option - one service
provider may not be enough - you might need another provider in another region of the country to ensure your data is backed
up – based upon your needs for recovery.
Did you know…
Here is a set of cyber safe business practices that you can easily implement:
and save.
originated.
scanned it first for viruses.
media. Adversaries can use facts posted on public sites to conduct social engineering scams to trick your employees and
compromise your operations.
Download a PDF of this fact sheet.
Still have questions, need help?
Contact us at our “Ask-an-Expert” service, web@thencss.org or visit us at the link below.
©2018 National Cybersecurity Society, All Rights Reserved
www.nationalcybersecuritysociety.org
JOIN THE NCSS
Become a member of The National Cybersecurity Society today and learn more about how to protect your business from a
cyber attack.
About The National Cybersecurity Society
The National Cybersecurity Society is a non-profit organization focused on providing cybersecurity education, awareness
and advocacy to small businesses. The NCSS provides cybersecurity education tailored to the needs of the small business
owner; helps small businesses assess their cybersecurity risk; distributes threat information to business owners so that they
will be more knowledgeable about the threats facing their business; and provides advice on the type of services needed to
stay safe online.
Your reputation depends on securely connecting to your customers and suppliers via the Internet. Do you know how to create a secure website? STEP 1: HOSTING SERVICE Unless you’re a technology security company, we don’t...
STEP 1: HOSTING SERVICE
Unless you’re a technology security company, we don’t recommend you host your website on your company or
home server.
Purchase website hosting services from a commercial service provider. There are many available. Ensure the
company can support SSL/TLS encryption, security monitoring, and a back up copy of your website.
Commercial Website hosting companies have the ability to provide:
STEP 2: ENCRYPTION
SSL/TLS are protocols used for encrypting information between two points. SSL Certificates are issued between
the two entities, usually between server and client, but there are times when server-server and client-client encryption
are needed.
By selecting the feature of SSL/TLS encryption, your company and customer’s private information such as passwords,
credit card numbers are encrypted. What that means, if someone were to hijack the data transmission the data would
be encrypted and the bad guys won’t be able to steal it or read it. Without this feature, your data is transmitted in the
clear, and anyone can read it, steal it or manipulate it.
Customers can buy with confidence, knowing their info is safe, and your website url will have the https:// qualifier,
meaning their web experience will be safe.
Most hosting companies provide a backup copy of your website content and the ability to restore your site to an earlier
version if you get into trouble. This is usually a standard feature – but check the plan to ensure you have this provision.
Ask how long it will take to restore your site to an earlier version. If you can be down for a day or two, then at least you will
know in advance. If you can’t be down for a day or two, select a service provider who can restore your site within your time
constraints.
This is a premium service, but well worth the cost. Ever wonder if a hacker could interfere with your site and redirect
users to a site that looks just like your site, but they steal all of your customers and business? Domain Name Server (DNS)
converts your URL (www.howtoguide.com) to a series of numbers (an IP address) that a browser uses to locate a website.
When you type a domain name into your browser, the DNS looks through a huge database to find the right IP address you
requested and directs your browser to the correct website content. DNSSEC or DNS Security stops hackers by securing
the look up process and verifying the visitor is actually arriving at your site.
Select DNSSEC as a service with your website hosting contract. This will improve performance, accessibility and security
by placing you DNS information in a secure location. The hosting company will place your DNS information in multiple
servers around the world, so visitors searching for your site can get connected to the closest server location for a faster
response. It eliminates the error, “website not found”, which usually happens when a server is slow to respond. With this
feature, hackers won’t be able to redirect your customers to their website to steal user names, passwords or credit cards
numbers.
When you establish a website account, you will be asked for a user name and password. Simple, right? Not so simple,
your password shouldn’t be password! Passwords should be between 10-20 characters – the longer the password, the
harder it is for someone to crack.
married, your business name, your business owner, kid’s names or birthdays.
Having a website owner or “system owner” is one of the critical steps in managing a website or any critical system or service.
He/or she can manage the account, keep up to date on the latest changes, and interface with the website hosting company.
He/she is responsible for keeping up-to-date records of changes made to the website, contract details, restoration details,
etc. He/she is the go-to person for keeping the website up and operational and interfacing with the hosting provider. This
can be a part-time job, but because it is such a critical function for your online business and reputation, it’s important to have
the responsibility defined and assigned.
Training employees is a critical step in ensuring your site is functional and resilient. Your employees can be the first line
of defense – by knowing your website, and whether it’s functioning as it should. They need to be advised they should notify
your website “system owner” and website hosting provider if the site is not functioning as it is intended.
Employees need to understand the value of protecting customer data, and to stay watchful and speak up. Customers who
call in and need help navigating the company website could actually be hackers trying to steal critical data. Employees need
to be trained not to give out critical information over the phone. Employees should also be advised not to write down
customer credit card data – but rather instruct the caller on how to enter the information on line.
At least every quarter remind/train employees on how to protect customer data, and to stay watchful of your critical asset –
your website.
DID YOU KNOW?
Compromised websites are used for a number of reasons:
To redirect traffic to a hacker’s spurious website; steal customer data including payment and email information; host
malware, spam pages, and/or porn; advertise illicit products; or simply vandalize the site.
or vandalize the website and demand a ransom before the website can be put back into use.
Download a PDF of this fact sheet.
Still have questions, need help?
Contact us at our “Ask-an-Expert” service, web@thencss.org or visit us at the link below.
©2018 National Cybersecurity Society, All Rights Reserved
www.nationalcybersecuritysociety.org
JOIN THE NCSS
Become a member of The National Cybersecurity Society today and learn more about how to protect your business from
a cyber attack.
About The National Cybersecurity Society
The National Cybersecurity Society is a non-profit organization focused on providing cybersecurity education, awareness
and advocacy to small businesses. The NCSS provides cybersecurity education tailored to the needs of the small business
owner; helps small businesses assess their cybersecurity risk; distributes threat information to business owners so that they
will be more knowledgeable about the threats facing their business; and provides advice on the type of services needed
to stay safe online.
Do you know what organizational assets you need to protect? Is it only your IT assets? Are you unclear where to start? These are the first questions in developing an asset protection strategy. All that is needed is an understanding ...
These are the first questions in developing an asset protection strategy. All that is needed is an understanding
of your business and some time to develop an outline.
The Carnegie Mellon Risk Management Methodology (RMM) (which the NCSS CARES questionnaire is based
upon) lists asset definition and management as the first step in a cyber secure business strategy. It is
recommended you identify the organizational assets (people, information, technology, facilities) and assign
responsibility of those assets in order to protect them appropriately.
Once organizational assets are defined, the next step is to define the relationship between these assets and the
high value services they support. It requires a process be established that examines and validates this relationship
through periodic reviews. Lastly, it requires your organization to maintain and sustain an inventory of these assets
and high value services. It is important to keep this information up to date and modified when events change.
Inventory – create an inventory of your people – not just your employees, but your suppliers and partners; the data
you need to run your business; the technology assets you need (computers, servers – the entire infrastructure); and
the facilities needed to house and operate your business.
Listing of High Value Services – create a list of high value services that keep your business functioning – logistics,
financial, service delivery, assembly, manufacturing. Define what are the key services you need – those services that
if lost, delayed or compromised would impact your business.
STEP 3: MAPPING
Mapping – create a mapping of people, data, technology and facilities to the high value services they support. Define
the relationship between these assets and the high value services. Validate the relationship through periodic reviews.
As an example, if the supplier for your medical equipment changes, and this supplier has been identified as key
personnel, have you updated your mapping relationships? Did you review the contract with the new medical supplier
to determine if anything has changed that would affect your service delivery? Leveraging your people to take
responsibility for certain high value services and keeping the critical information current is key to protecting your assets.
STEP 4: INVENTORY PLAN
Inventory Plan – a plan is only useful if it is kept current and up-to-date. Schedule an annual inventory and mapping
exercise to ensure that the protection mechanisms you employ support valid assets. A good rule of thumb – once a year.
STEP 6: CONTINUITY PLAN
Continuity Plan – A sound business strategy includes continuity plans. For all your high value services that depend on
critical people, data, technology and facilities, you will need a contingency plan in place in the event any of these assets
is compromised. See our “How-to-Guide” to develop a Continuity Plan.
RESOURCES NEEDED:
Inventory of Organizational People, Data, Technology, Facilities
Listing of High Value Services
Mapping
Inventory Plan
Continuity Plan
THE NUMBER ONE PREVENTION METHOD TO COMBAT RANSOMWARE --- HAVE A BACKUP AND RECOVERY PLAN
Download a PDF of this fact sheet.
Still have questions, need help?
Contact us at our “Ask-an-Expert” service, web@thencss.org or visit us at the link below.
©2018 National Cybersecurity Society, All Rights Reserved
www.nationalcybersecuritysociety.org
JOIN THE NCSS
Become a member of The National Cybersecurity Society today and learn more about how to protect your business
from a cyber attack.
About The National Cybersecurity Society
The National Cybersecurity Society is a non-profit organization focused on providing cybersecurity education,
awareness and advocacy to small businesses. The NCSS provides cybersecurity education tailored to the needs of
the small business owner; helps small businesses assess their cybersecurity risk; distributes threat information to
business owners so that they will be more knowledgeable about the threats facing their business; and provides advice
on the type of services needed to stay safe online.
Passwords, passwords, too many to remember… Ever wonderhow to create a safe and secure password that is impossible to crack? STEP 1: Imagination – we know you are busy and don’t have time to think up unique and creative...
Imagination – we know you are busy and don’t have time to think up unique and creative passwords, so
here’s a suggestion:
Use a random word generator. Like the link below:
http://www.textfixer.com/tools/random-words.php
Pick 2-3 words add some numbers, unique characters and a capital letter – and you are ready to go!
Like this: noble3$kitten72True – 19 characters!
Safe storage – we know you can’t remember all these passwords, and you have a lot more important things
to remember to keep your business running. If you have to write them down, don’t store them in a file on
your computer!! Write them down and lock them up, just like you would for an extra set of your car or
warehouse keys, or lock combinations. These should be treated as any other “critical data” that needs to be
kept in a secure location.
There are commercial products to store passwords, such as KeePass and backup services such as SpiderOak
or Dropbox – all can be used to keep your password backed up and encrypted.
Did you know…
Longer the better – 10-20 characters – the longer the password, the harder it is for someone to crack
Don’t use words or phases that link to who you are, where you have lived – street, city you were born, date
you were married, your business name, your business owner, kids names or birthdays
Change your password every three months or when prompted by the service you are using
Each password should only be use for one service. Don’t reuse passwords
Consider using a password manager – such as Dashlane or KeePass
Download a PDF of this fact sheet.
Still have questions, need help?
Contact us at our “Ask-an-Expert” service, web@thencss.org or visit us at the link below.
©2018 National Cybersecurity Society, All Rights Reserved
www.nationalcybersecuritysociety.org
JOIN THE NCSS
Become a member of The National Cybersecurity Society today and learn more about how to protect
your business from a cyber attack.
About The National Cybersecurity Society
The National Cybersecurity Society is a non-profit organization focused on providing cybersecurity
education, awareness and advocacy to small businesses. The NCSS provides cybersecurity education
tailored to the needs of the small business owner; helps small businesses assess their cybersecurity
risk; distributes threat information to business owners so that they will be more knowledgeable about
the threats facing their business; and provides advice on the type of services needed to stay safe online.
WHAT IS A WHITELIST AND A BLACKLIST? Whitelisting and blacklisting are two methodologies to control access to websites, email, software and IP addresses on networks. Whitelisting denies access to all resources and only the...
WHAT IS A WHITELIST AND A BLACKLIST?
Whitelisting and blacklisting are two methodologies to control access to websites, email, software
and IP addresses on networks. Whitelisting denies access to all resources and only the “owner” can
allow access. Blacklisting allows access to all with the provision that only certain items are denied.
FACT 1: WHITELISTING
Whitelisting has advantages in that you control access to the website or virtual resource you want
your business to use, however, is less dynamic and more restrictive in terms of ease of use and
versatility. This is a control mechanism where you deny access to all resources by default then allow
access to resources by name. Think of your home, where only you and your family can get access
the front door. Everyone in your family would have a front door key, but some individuals don’t have
keys to every door. You may have a shed out back that only you have they key because dangerous
chemicals are stored there. The disadvantage is that not everyone in your family has open access to
the shed and would have to ask permission to get something out. Now, that may work for a small family,
but would be unworkable unless the number of employees requiring access is small. This type of access
control is useful for financial or personnel records, where a business might have only 2-5 employees
who access these files, software or websites.
Blacklisting is advantageous in that it allows free and open access to any email, website, IP address or
software as long as it’s not a security risk. This is the concept that all web traffic is allowed, and certain
items are disallowed by name or circumstance (aka security risk).
Download a PDF of this fact sheet.
Still have questions, need help?
Contact us at our “Ask-an-Expert” service, web@thencss.org or visit us at the link below.
©2018 National Cybersecurity Society, All Rights Reserved
www.nationalcybersecuritysociety.org
JOIN THE NCSS
Become a member of The National Cybersecurity Society today and learn more about how to protect
your business from a cyber attack.
About The National Cybersecurity Society
The National Cybersecurity Society is a non-profit organization focused on providing cybersecurity
education, awareness and advocacy to small businesses. The NCSS provides cybersecurity education
tailored to the needs of the small business owner; helps small businesses assess their cybersecurity
risk; distributes threat information to business owners so that they will be more knowledgeable about
the threats facing their business; and provides advice on the type of services needed to stay safe online.
Join our small community for expert insights, insider tips, and the industry knowledge you need to see your small business grow.
Get Started Become A MemberTake part in the conversation and post your own question to the community.
Not a member yet? Register now
Ways to Make Your Search More Accurate
Most of the time, you just want to find content that has a particular phrase. Here are the easiest ways to find the content you want.
