NIST: Solo Shouldn’t Mean Less Secure

Threat actors always target the path of least resistance, and for years that’s been small-to-medium sized businesses (SMBs). Now, new guidance from the National Institute of Standards and Technology (NIST) aims to help companies with possibly even fewer resources: “solopreneurs.”For solo business owners, incidents can be a dealbreaker, with some shuttering completely following an attack. But risks also extend through the supply chain, as threat actors exploit vulnerabilities as a backdoor to hit larger enterprises.NIST has published the Cybersecurity White Paper 50 (CSWP), a series of recommendations on how to curb cyber risks for a population that makes up 81.9% of all U.S. businesses.The agency is trying to offset challenges with guidance for password hygiene, ransomware threats, and adhering to regulations requirements— areas where solopreneurs typically lack the time, money, or people to build out a security program on their own.Related:Incidents Move Too Fast for Pen & PaperNIST said the guide translates its Cybersecurity Framework into lay language for non-employer firms. But with 33 pages to work through, is it worth the investment?Most of the practical core is within reach for solopreneurs, says Martin Zugec, technical solutions director at Bitdefender. People just need to scroll to the short list on Page Two which calls for phishing-resistant multifactor authentication (MFA), a password manager, a standard (non-admin) account for daily work, automatic updates, and tested backups with one copy kept offline.”None of that needs a security background, and you can do it in an afternoon,” Zugec tells Dark Reading.What Works and What Doesn’tCompared to other NIST technical publications, Zugec says the CSWP is much easier to digest. Like NIST advertised, the language is plain and every action comes with a reason, a first step, and a note on what changes as businesses grow, he adds.NIST outlined how businesses can respond to growing contractual agreements and an increasing number of suppliers and third parties as they expand operations and it becomes even more crucial to know third-parties’ cyber postures. That means staying current with regulations and establishing a formal process to manage risks that relationships could introduce.While Bryson Byrd, cybersecurity advisor at Huntress, applauded NIST for the guidance, he says it still reads like it was written for practitioners. Terms like “least privilege,” “risk register,” and “data sensitivity classification” aren’t the language of someone running a bakery or a consulting practice, he adds.Related:Behind the Scenes of How Operation Blackout Went Down”For too long, solopreneurs have been an afterthought in cybersecurity guidance,” Byrd tells Dark Reading. “The intent is right, but the closer guidance like this gets to the language of everyday business owners, the more likely it is to actually get implemented.”But it’s not just the language, Byrd says. It also assumes the owner knows how to turn on logging, review account sessions, and work though a separate spreadsheet of worksheets. And he points to a recommendation on obtaining legal counsel’s input before notifying customers following an incident as an extra cost that often is not in the budget.The guidance doesn’t appear to take into consideration that “nobody goes into business to build the most secure company that exists,” he adds, but to build something over time. Every hour a solopreneur spends on asset inventories, backup testing, tabletop exercises, and compliance tracking is an hour taken away from running the business, which is the priority.”Asking a single person to do all of this is extraordinarily cumbersome and, quite frankly, unrealistic,” Byrd explains.More Gaps and RecommendationsByrd observes gaps in the guidance in places “we see hurt small businesses in the real world.” The first is domain registrar, which is important to address, since attackers regularly go after small business domains to launch impersonation attacks and siphon money from customers and partners. Control of the domain means threat actors assume control over email and the business’s website too.Related:Why CTF Competitions May Be More Important Than Ever”Locking down the registrar account with multi-factor authentication, enabling registrar lock, and turning on auto-renewal should be part of any baseline for a solopreneur,” Byrd recommends.The second gap he addresses is email authentication. The three core protocols — Sender Policy Framework, DomainKeys Identified Mail, and Domain-based Message Authentication, Reporting, and Conformance — are becoming more important to protect a business from being impersonated and to ensure its legitimate email is delivered, adds Byrd.The third and perhaps most impactful for a business of one is what happens when the owner is unavailable for an extended period of time due to an illness, family matter, or simply to take a well-deserved vacation.Ransomware groups target businesses during off-hours, weekends, and holidays. If something does happen that demands an immediate response, it’s essential for someone to be there. It could mean the difference between an incident and a breach.”A break-glass plan that gives a trusted person or partner emergency access to critical accounts is still needed, and it belongs in any cybersecurity plan for a solopreneur,” he advises.Why Now?Previously, SMBs and self-employers adopted the mindset that they were too small to be considered a target. That has since been disproven tenfold and is only growing worse.Advancements in autonomous tools and artificial intelligence (AI) have lowered the barrier to entry and the cost of attacks, letting threat actors target that population at scale. They realized they had a choice: go after large enterprises with strong defenses for one big payout, or target thousands of small shops with weak security that are far more likely to pay up.As the struggles evolved, so must the guidance. Daniel Eliot, lead for small business engagement at NIST, says this paper comes nearly 10 years after its predecessor, NISTIR 7621 rev.1.A lot has changed in 10 years and after the initial call for comments, “that feedback was instrumental in moving the project forward.”AI is forcing a lot of security guidance to be updated and making that guidance easier to write, Zugec notes. He noticed new additions in CSWP included a section on AI and a warning that AI makes phishing more convincing.NIST urged businesses to take a second or third look at any message that asks people to click a link, download a file, transfer funds, or log into an account.AI Guidance Doesn’t Match Real World RisksBut contrary to popular belief, AI hasn’t brought any new or novel attacks, observes Zugec. It is changing who runs businesses and what they rely on to operate.Solopreneurs are using AI assistants to read their mailboxes, run commands, write code, and use accounts under the owner’s identity, he explains. While it enables one person to do the work of a small team, it also expands the attack surface.”Many solopreneurs will use agentic AI to grow faster than their security does,” he says. “The guide gives no advice on what these agents should be allowed to reach, or on securing the code they write.”The biggest gap Zugec found in the guide is “AI that acts.” NIST treats AI as something passive that businesses need to inventory and review outputs for, but agentic AI has increasingly removed humans from the equation.As agentic AI enables more people to run a business alone, the security of those businesses matters more than ever, Zugec warns. That will warrant outside help, as people increasingly turn to vibe coding to build applications on their own. He urges solopreneurs to have their code reviewed by someone with coding and security experience before anything ships.If anything is public-facing, that means an attacker can reach it and it needs to be protected.”AI is good at producing software that works, but not necessarily software with a small attack surface,” he says. “The guide doesn’t cover this, yet it’s often the first risk solopreneurs run into.”Zugec spotted other weaknesses too. For example, NIST pushed for continuous updates, but a solopreneur can’t realistically track every legal and contractual security requirement, negotiate security terms with a cloud provider, or monitor their systems around the clock.Secondly, it never ranks tasks, which makes prioritization difficult for a one-person team. For example, it opens with governance, the least actionable task, while MFA and backup advice only starts on Page 14. It also fails to cover two common attack routes: ClickFix, which tricks people into pasting a command themselves, and a malware that steals their logged-in session, which bypasses MF”It lists around 25 actions and says outright that it isn’t a checklist, so a busy owner has to decide what comes first,” Zugec says. The guide also sets its scope by headcount, which is problematic. Technically the headcount would be one, but risk follows what information businesses hold and who targets them.It’s not just about size, it’s about what’s exposed. Risk heavily varies between someone who sells candles on Etsy as a side gig versus someone in the finance industry trading billions in cryptocurrency.”A solo crypto operator or a consultant with client secrets needs far more than the guide’s baseline,” Zugec says.


Source credits: