Listen, you’re a hard-working freelancer who has learned how to defy all the odds and chase your
dreams by doing the work you love. But hopefully, at this point, you’ve realized your limitations.
You don’t have the means to keep a lawyer on retainer, but that doesn’t mean you should sign
any contract that is put in front of you. In the same way, you don’t have an IT person on staff,
but that doesn’t mean you should neglect how you secure yourself, your data and your business.
As I share these 6 important security tips with you, keep in mind that the
ramifications here are big. Most freelancers aren’t set up to handle even the most basic
hack or attack, and it doesn’t take much to protect yourself.
Welcome to All Things Secured, my name is Josh and as a small business owner myself,
especially one with high visibility here on YouTube,
I’ve had to navigate the challenges of securing against what’s really just a lot of unknowns.
I don’t expect you to know all the threats you could possibly face,
but I am glad that you’re taking the time understand a few of the best
practices you can put in place to lower your risk as a freelancer or small business owner.
So let’s dive in!
I know how it is! When you’re starting something on your own,
you have to work with what you have. Often, that means giving out your home address and
your personal cell phone number since you don’t have a separate office or work phone.
That may have been fine before, but this is now…and there’s a better way.
Consider this, if I’m an unhappy client who wants to make your life hell, or a hacker who
thinks that you might be a valuable target since they’ve seen all the success you’ve had online,
all I have to do is look up your business records on a government website to find your registered
address or even reverse lookup your website to see all the WhoIs information. Or, perhaps
you just list your home address straight on your invoices since you have nothing else to add there.
What the case, you’ve now given them a piece of information that is extremely
hard for you to change. I mean, once your home address has been compromised,
one of the few options you have left is to move and that’s not fun.
So what if I told you that in less than 30 minutes you could set up a virtual business address
and a virtual phone number so that anytime you received mail to your freelance business address,
even if it’s a DBA, you could open and scan it on your phone and never give out your home address.
Or that in less than 5 minutes you could have a new business phone number that works through an
app on your phone where you can screen calls without giving out your real phone number.
That’s what I’ve done using services like PostScan Mail for my address
or Hushed for my virtual phone number. There’s a little bit of an extra cost, though not much,
but it’s something you can expense that adds real protection for you and your family.
If you run any kind of marketing campaigns or an online social presence,
you know how tempting it is to simply send over your login details for Twitter,
Facebook, Pinterest, Quickbooks, or one of any number of software services.
And I get it - as a small business owner you don’t want to pay extra for the team
plan as opposed to the individual plan. And you’re hopefully not going to hire
somebody you don’t trust, but there’s an inherant and uneccesary danger here.
In the best case you’re leaving your account security to chance and in the worst case
you may even be giving away your password strategy that can be used to access other accounts.
For most social media platforms, there is some kind of team feature that allows you
to add another team member without giving them access to your admin account. In every case,
you’ll need to make sure that you’ve set up a business account instead of an individual account,
and then find where you can add other people who have editor permission on your page or profile.
For other SaaS services, it’s really up to you. I would evaluate whether or not
access to a particular account could be used to cause you damage somehow.
For example, if I’m using Hootsuite but I don’t want to pay for additional users,
would giving out my login information to my admin assistant give him or her access to accounts that
I may not want them to post on? That’s something you’ll have to figure out on your own.
Speaking of account logins, it’s vitally important that you enable two-factor authentication or
2FA, whenever it’s offered. So, for example, if you have a YouTube channel
like this to market your services, it’s not even an option anymore. You have to set up 2FA.
Facebook is starting to force this through it’s Facebook Protect program that I walked
through a couple months ago. All I’m trying to say here is that if these major
companies have realized the importance of protecting your accounts with 2FA,
so much so that they’re forcing you to use it, that should clue you in on how important this is.
But you have so many other online accounts where 2FA is optional to setup.
Paypal, your domain registrar, your web host,
your email provider. The list goes on and on but hopefully you get the point.
Setting up 2FA now is easier to do than trying to recover from a devestating account hack later.
Another cost-cutting measure for most freelancers and small businesses is data backup.
Secure cloud storage costs money so unless it comes free with your email plan,
like Google Drive does with a business gmail account, then you might not want to for it.
Again, there’s no judgement from me since I’ve been in the same boat. But I had one
scary moment a few years ago where I had a break in at my office and all of my hard drives were
taken. I had a freak out moment when I realized that some of my important multimedia files not
been uploaded to the cloud and, as far as I knew, that hard drive was the only place I had put it.
Thankfully there was one old backup that I had accidentally stored somewhere else - I’m not
even going to try to pretend I was smart enough forsee this - and I was able to recover most,
but not all, of my files. I realized just how easy it is to think that I’ve duplicated
all my data backups, but to not actually do that.
So do this exercise for a moment - imagine that I
steal your computer or that somehow your cloud storage files get deleted.
How big of a deal is that for your business? And what can you do to have a secure backup
if you need to elsewhere? It could be a simple extra hard drive, it could be a whole NAS setup,
a network attached storage, but the point here is that you don’t want this kind of single fail
point in your business, where one stolen device or corrupted file could set you back months or years.
Along that same line, I find that it’s been useful to run a “what if” scenario on my small business
every once in a while. What do I mean by that? Well, take this for example: what if my website
experiences a DDOS attack, so it goes down and people can no longer access my site? What do I do?
Or what if YouTube decides that this channel does
not meet their guidelines so it suddenly gets taken down?
What if my computer gets hit with ransomware?
There are probably hundreds of other questions you could ask that apply to your specific situation,
so I’m not going to try to address any of them here, I simply advise you to run
through that exercise at least once to see what reaction measures you have in place.
If you’ve spoken with a reputable tax attorney or CPA, you’ve probably heard the phrase “corporate
veil”, particularly used in the phrase “piercing the corporate veil”. This, if you didn’t know,
is referring to the legal liability protections afforded to your business that disappears if
you start mixing your personal finances and life with your business finances and life.
That’s very specific to taxes and legal liability, but for the sake of your security and privacy,
I would say that the same corporate veil needs to exist
for you. Going back to the virtual address and phone number is an easy
example. I want to create a separation between my personal life and my business,
even as a freelancer or small business owner, so that the two don’t get confused.
I want a separate address, separate phone number, separate bank account, separate credit card,
separate PayPal account - I don’t care if you’re running your business out of your basement or
even as a side hustle, creating this kind of separation may not seem to matter right now,
but it will provide you a lot of protection in the future as you grow.
Finally, I want to share this final note about giving out your personal data. For US residents
this could be things like filling out a W2 or W9, or even just filling out a vendor form. One
advantage of having a registered business is being able to use my business ID instead of my
personal ID for all of this stuff, which in my case would be my social security number.
But even how we transmit this kind of information is important. Doing so on a
secured website is fine, but keep in mind that if you send all this information via email,
it gets stored in both your email archive and the recipient’s archive.
And in some cases that’s your address, your full name, your date of birth and your ID
number. Don’t be afraid to request an encrypted method to send this kind of data or to use an
encrypted email service like ProtonMail or SendThisFile to send these documents.
If you think I’ve missed anything on this list, please leave a comment below. Same with
questions. I’d love to answer as many questions as I can. Of course, if you like this idea of a
virtual address and want to know more about it, you can watch this entertaining video where I
actually went to inspect three different virtual addresses in person to see what it was all about.