By definition, cyber security is the action taken to protect computer-based systems from attack or unauthorized access. Many think cyber security is a problem that only plagues large corporations. We frequently hear about data breaches of big corporations and government entities such as Target, Wendy’s, the U.S. Department of Justice, and the Internal Revenue Service. But what about small businesses? They are small enough to fly under the radar of cyber criminals, right?
The truth is that small businesses are just as much at risk for cyberattacks. The reasons are simple. Small businesses typically have greater financial assets and commercially usable data than an individual, and they tend to have far less security implemented than the large companies. Many small businesses also lack the awareness and training to effectively protect themselves.
In 2016 the Ponemon Institute published the research survey titled “The State of Cybersecurity in Small and Medium-Sized Businesses,” which revealed that 55 percent of participants experienced a cyber-attack in the 12 months prior to the survey. The research went on further to show that half of those attacks resulted in the exposure of customer and employee data to the cyber criminals.
Understanding the cyber threats to small businesses
Understanding the predominant attacks, flaws, and human error exploited by hackers to target small businesses can greatly decrease the likelihood of becoming a victim. Listed below are some of the most prevalent security issues that small businesses face.
1. Web-based attacks, phishing, and social engineering
These attacks can take a wide variety of forms such as finding and exploiting vulnerabilities found in the victim’s’ software, email scams designed to trick the user into divulging critical information or launch attacks such as viruses, ransomware, and system takeovers.
2. Disgruntled and/or negligent employees or contractors
Many data breaches are caused by theft or the malicious distribution of sensitive data by disgruntled employees. Numerous breaches are also caused simply due to negligence or a lack of training of well-meaning, dedicated employees, or contractors.
3. Outdated or inadequate security
Cybercriminals can and will take advantage of vulnerabilities in outdated or inadequate security. These vulnerabilities typically take the form of insecure human practices such as failing to patch software, neglecting regular system backups, failing to build an adequate firewall, or the transfer of infected files.
4. A dedicated computer for banking
Many small businesses fail to use a dedicated system for their banking. Company computers used by employees for social media, web surfing, and email can be open to vulnerabilities which could result in the theft or destruction of banking data.
5. Secure password policy
Many businesses lack a secure password policy. As a result, systems can be breached by brute force methods, exhaustive automated generation of passwords, or by simply guessing passwords based on knowledge which can be acquired through the use of social engineering techniques.
6. Secure network usage policy
Having a policy in place does not guarantee employees will follow it. It does, however, raise the awareness of security and potential threats. An effective policy also promotes a proactive stance for the company should legal issues arise.
7. Budgeting for security
A large number of companies fail to sufficiently budget for security or simply have no budget at all. In many cases, this is due to the belief that they are unlikely to be a target. In other cases, they believe that their current security practices are sufficient. Small businesses must weigh the cost of an adequate security budget against the potential costs of a breach which could be devastating.
Conclusion
The sheer number of attacks that cyber criminals have at their disposal is growing exponentially. Small businesses run the risk of not only losing critical customer and financial data, sales, and productivity, but they also run a substantial risk of losing significant amounts of money. In the worst case scenario, companies may be forced out of business. It is critical that small businesses take all the necessary steps to secure and protect their business data, technologies, and ultimately, their customers.