Cyber Security for Small Business

Phishing

One of the biggest, lethal, and common web security threats facing small businesses is phishing. A phishing scam is where the threat actor, pretending to be a legitimate and reputable institution/individual, drafts and sends email/SMS or other communication to obtain sensitive information, gain access to networks, infect systems with malware, and so on.

In 1/3 of the cases, threat actors crafted communication impersonating senior managers or vendors, mostly requesting payment. In half the cases, employees took the bait and ended up transferring company funds!

Phishing causes serious damage to the business from causing downtimes, network/ system takeover, data theft, and so on. Data suggests that these attacks cause financial losses to the tune of $50,000 – 100,000 to small businesses in the US. This does not include reputational damage, customer attrition, and other costs. What makes this threat even more dangerous is that 91% of current cyberattacks begin with phishing!

Even though phishing has been a persistent cybersecurity threat for small businesses for several years, the pandemic has made it worse. Attackers are exploiting the fear and uncertainty associated with the COVID-19 pandemic to run phishing scams and trap innocent employees to do their bidding.

Ransomware Attacks

According to 85% of Managed Security Service Providers, ransomware attacks are the biggest malware threats to small businesses. One in every five small businesses falls prey to ransomware attacks!

Ransomware is a type of malware that typically gets activated when someone clicks on a malicious link on phishing emails or downloads a malicious email attachment. However, this malware could be delivered through security vulnerabilities present in the network/system/web application with no action required from the users. Once activated, this web security threat takes over the system or the entire network, bringing business to a grinding halt.

A lucrative cybersecurity attack type, ransomware attacks are where the attacker encrypts company data to make it inaccessible/unavailable/unusable to the business. The attacker arm-twists the business into paying a huge ransom to unlock the data.

As per data, the average ransom amount demanded is USD 5900. According to another estimate, the ransom amount varies from USD 10,000 – 50,000. However, this is not all. The cost of ransomware attacks also includes the cost of downtime caused which is estimated at 23X greater than the ransom amount. There is the cost of records compromised, attack discovery, forensic audits, containment, recovery, penalties, and brand value erosion.

What makes these attacks even more vicious is that paying the ransom does not guarantee that the data will be released. The attacker could keep increasing the ransom amount. Also, there is no guarantee that all data can be recovered, which only amplifies the damage.

Insider Threats

Insider threats are cybersecurity threats caused from inside the organization. Inside actors include employees, vendors, partners, and suppliers. Insiders could be:

Negligent users who unintentionally threaten the company data/assets through their negligence. For instance, downloading a malicious email attachment without verifying its legitimacy

Malicious insiders who seek to actively harm the business through targeted attacks, exploiting the insider privileges

Disgruntled employees/partners who could intentionally leak passwords, credentials, or other sensitive information

In view of the COVID-19 pandemic, most businesses are working remotely on unsecured networks, shared personal devices, etc. which amplify the risk of insider threats further. To add to this, 22% of small businesses have shifted to remote work without a strong cybersecurity threat prevention plan in place which only increases the risks and costs of insider threats.

The Criticality of Small Business Cybersecurity

While cybersecurity is critical for all kinds of businesses, small business cybersecurity is indispensable. Data suggests that 60% of small businesses shut down within 6 months of a successful cyberattack or data breach! While the Federal Government may get involved in large-scale attacks, such as with Solarwinds or Colonial Pipeline, small businesses do not have the cushioning of technological might, resources, and expertise to recover quickly from attacks.

The Way Forward

Effective and proactive small business cybersecurity enables business continuity, making it a high priority. The dollars spent on robust cybersecurity is an investment for small businesses! To understand the cybersecurity threats facing your business and to protect yourself against the fast-evolving threats, please contact us at [email protected]