Small businesses are particularly prone to cybersecurity threats. Verizon’s 2021 Data Breach Investigations Report says that 46% of all cyber data breaches impact businesses with fewer than 1,000 employees.
This article explains why cybersecurity is important for small businesses, what the threats are, and how to counter them.
What Is Cybersecurity for Small Businesses?
Cybersecurity for small business is when a company takes steps to protect its employees, customers, and digital infrastructure so that they do not fall victim to online attacks.
This is usually achieved by preventing unauthorized individuals from getting access to devices, networks, and data.
Cybersecurity is important because many services are now accessed online and an increasing number of people need to be connected to the Internet to do their jobs.
This means that businesses are exposed to more online threats than ever before.
These attacks can include hackers trying to steal personal information via backdoors, worms, viruses and malware, social engineering (typically phishing), brute-force attacks, and many other types of risks.
Why Are Small Businesses Attractive Targets?
Defending a business against the huge range of cyberthreats out there requires technology, skills, and expertise.
Small businesses are usually particularly easy targets for cyberattacks compared to bigger businesses. Here’s why:
- Lack of budget
Bigger businesses can afford to employ well-trained cybersecurity experts and buy high-tech business cybersecurity solutions.
But small businesses usually don’t have the budget to pay for additional resources and cybersecurity measures.
- Lack of knowledge
Small business owners usually deal with cybersecurity themselves or appoint key personnel to do it. The appointed person, however, rarely has the knowledge required to create a cybersecurity plan to protect the business adequately.
They may even have no choice but to outsource this role to cybersecurity professionals.
- Lack of time
The person tasked with cybersecurity at a small business usually has to juggle several responsibilities. This means they can’t dedicate enough time to researching the latest technologies and threats.
5 Common Threats to Small Businesses
Small business owners need to know exactly what cyberthreats are out there to know how to avoid them and keep their critical data safe.
Phishing
A phishing attack is when you receive an electronic message that appears to be from someone you know asking you to take some sort of action—but it’s actually a cybercriminal.
Examples of what they might request you to do include:
- Click on a link.
- Download a file.
- Send them sensitive information.
- Give them access to something.
A good example of a phishing scam is when you receive an email claiming to be from your bank.
The scammer will send you a link in an email that looks legitimate. This takes you to what appears to be the bank’s website to enter your login details.
But in reality, it’s a fake website designed to capture your account information.
Once the cybercriminal has this customer information they can access your account and clear it out.
How to avoid a phishing attack
Phishing is an opening move for the majority of cyberattacks. Thus, awareness is a key to avoid phishing attacks or at least, to mitigate their impact. Malicious emails are usually easy to spot as they often come from addresses that don’t look quite right.
For example:
Security@BarclaysUK.bank
They might also contain mistakes or unusual requests.
Other solutions include:
- Get good email security software.
- Use multi-factor authentication.
Deep dive into the mechanism of phishing scams and other tips for fighting this type of cyber attack can be found in our blog about Anti-phishing best practices.
Malware attacks
Malware is malicious software that installs itself on your system. It might steal from you, monitor you, lock you out of certain functions, or even damage your device and data.
Some examples of malware include:
- Viruses.
- Worms.
- Trojan horses.
- Spyware.
- Adware.
- Scareware.
A famous example is the ILOVEYOU virus from 2000. Victims would receive an email with the subject line: “I love you”. Attached to the email was a file called ‘LOVE-LETTER-FOR-YOU.TXT.vbs’.
Once it had been opened, it then started to overwrite the person’s system files, ruining their computer.
Malicious emails like this are even more common today, but very few people would click on such a blatant fake message.
Who’s to say, however, that you won’t be sent a more convincing message hiding a similar attack?
Many hackers now send these attacks in the form of invoices and other everyday messages.
How to avoid malware attacks
Similar to phishing, awareness is the best defense against malware attacks. Don’t open suspicious attachments, download unknown files, or visit unsecure websites.
Decent antivirus and anti-spam software will also help you find and avoid falling victim to these threats.
Insider attacks
This is when a person in your business performs a malicious act like stealing sensitive data or damaging systems.
Sometimes these attacks happen by accident—an employee pushes the wrong button and shares something sensitive, or deletes a critical file.
But the most common source of malicious attacks is former employees whose access has not yet been revoked.
A high-profile example of this comes from 2015. Anthony Levandowski was lead designer at self-driving car technology company Waymo. When he left to start his own company, he downloaded 14,000 files containing the company’s intellectual property.
This was discovered and his new company had to give Waymo £245 million in shares.
How to avoid inside attacks
There are several ways to protect against these kinds of attacks.
- Limit employee access: Only allow people access to the systems they need to do their job (so called the east privilege principle which is an integral part of zero-trust network access approach).
- Enforce policies: Avoid accidents by creating a clear cybersecurity plan and ensuring employees are trained on your policies.
- Track access: Some solutions allow you to track user actions. This means you’ll know who is responsible for any data breaches.
- Cultural change: Make cybersecurity a cornerstone of your business culture.
- Deploy network monitoring system - such technology might be too expensive for SMBs.
Ransomware attacks
Ransomware is a type of malicious software (malware) that encrypts a victim's files, making them inaccessible, and demands a ransom payment in exchange for the decryption key. Cybercriminals usually demand payment for decryption or threaten users that they are about publishing sensitive information.
The malware may:
- Lock you out of your system.
- Isolate payment systems.
- Threaten to publish sensitive information.
A ransomware attack usually works by encrypting critical data on computer systems. The hacker will send the victim a decryption code once the ransom has been paid.
A recent famous example is oil pipeline management company Colonial Pipeline. Compromised credentials led to the ransomware being installed and the company had to halt operations.
Colonial Pipeline was forced to pay $4.4 million to the hackers in Bitcoin.
How to avoid ransomware attacks
Endpoint protection platforms can protect against known signatures of ransomware attacks. They examine files that enter your network devices that are connected to your business computer network to ensure they are safe.
They can stop ransomware from encrypting your data. However, it is not a silver bullet against ransomware because new ransomware variations are created every day (See the key ransomware stats by antivirusguide.com.
It’s also good practice to keep a backup copy of all your systems and sensitive data in the cloud. This allows you to recover your data if you suffer a ransomware attack.
Weak passwords
Too many employees set their password as “11111” or “Password1”. Others use the same password for everything.
This is probably why hacking passwords is one of the most common cybersecurity threats.
Once someone has hacked into your small business systems they can access sensitive information, financial files, and more.
The Colonial Pipeline story mentioned above is a good example of the damage that can be caused by password hackers.
How to avoid password attacks
The simplest way to avoid password hacking is to create policies on password strength and provide training to employees on how to password-protect access.
You can also implement a password lockout policy so that any hackers are locked out of the system after three failed attempts.
Or you can use multifactor authentication systems and password managers. Both of these make it much harder to hack your passwords.
How to Protect Your Business
Small businesses face a huge range of cybersecurity threats. As you can tell from the list above, they don’t work in isolation and are aided by a lack of awareness.
Malware can enter your system due to the use of weak passwords, while an inside attack is launched when an employee falls for a phishing email.
But most of these threats can be avoided by having some basic protections in place.
They are:
Get antivirus software
There are plenty of antivirus software options to suit your business and budget. Try to look for one that:
- Offers good protection against a range of threats.
- Is easy for you to use.
- Is business-focused.
- Covers multiple devices.
Use strong passwords
We’ve already mentioned this above. But having strong passwords is so critical to your cybersecurity strategy that it’s worth mentioning again:
- Set strong password policies.
- Train your key personnel on how to create strong passwords.
- Implement a password lockout policy.
- Use multifactor authentication.
- Use password management tools.
Secure data with a VPN
A virtual private network (VPN) is a secure network that can be accessed by all of your employees no matter where they are.
VPNs create secured tunnels between devices and servers that encrypt any critical data that is transmitted.
If your data is intercepted or someone breaks into your system, then the hacker only sees unreadable characters.
Find out how our cloud VPN can protect your business.
Is Your Business Safe?
How at risk your business is from cyber attacks can depend on its structure and how employees access your network.
The questions below will help you to determine the potential level of threat you face.
- Is your team spread out across the globe?
- Do your employees perform remote work?
- Do your employees need to access internal tools and systems?
- Do you have a limited budget to spend on IT and cybersecurity?
- Do you want to control who can access your network?
- Do you keep sensitive data?
If you’ve answered “yes” to several of the questions above then you might benefit from a VPN like GoodAccess. GoodAccess enables zero-trust remote access from anywhere in the world. You can protect all of your communications and business apps from online threats.
To find out more, set up a free account.
Keep Your Business Safe
In this article, we explained what cybersecurity is and listed five of the biggest threats facing small businesses.
We also looked at ways for you to protect your business, including using antivirus software, creating strong passwords, and using a VPN.
Finally, we listed some of the factors you should consider when gauging your small business’s cybersecurity threat level.
Or find out how our VPN service can protect your business by requesting a free trial today.
