At TELUS Security Labs we spend a lot of time working with Canadian businesses helping them build a balanced approach to information security. While the security can be complex, there are some common practices that are fairly simple.

If you’re a small business owner, here are four useful rules that work well for helping you secure your computers and data. It's probably worth noting that there are really more than four rules, but I wanted to keep things simple and hopefully easy to remember.

As with life, there's always something to worry about when it comes to information security, so we need to take care of the obvious things and not go overboard by worrying about the unlikely. Fortunately, all of the precautions (and problems) I've discussed are very real so these are the things you really want to do.

The best way for a small business to achieve balance is to ignore likelihood and instead ask yourself what am I trying to protect - for example your customer list or secret recipe are invaluable to you, their loss or disclosure would have a significant impact on your business. For the important things, be willing to make a small investment in cash or time to protect it; our research at TELUS Security Labs has taught us that there's no right amount to spend on security, and while more is typically better, what matters most is applying effort in the right places on a consistent basis.

Now for those of you who handle credit cards, there are a set of rules you may have to follow called the PCI-DSS (Payment Card Industry - Data Security Standard). You've probably already been contacted by your bank about this (or will be soon) and told whether it applies to your business. The PCI-DSS is designed to make sure retailers keep credit card data secure; the standards detailed inside are far more detailed than the rules in this posting but ultimately achievable with a reasonable investment of effort. More information on PCI-DSS is available here.

One last thing, while I didn’t explicitly call it out in Rule #2, don’t forget to also keep your operating system up-to-date with the latest security patches (it’s mostly an automatic process, you just have to let your computer install the patches).

Don't forget that we're still running the 2010 Rotman TELUS Canadian IT Security Practices survey so we're looking forward to your response at telus.com/securitysurvey.