Cyber Sense — Act Consumer & Trade Protection

Small business owners are overwhelmingly on the receiving end of cyber attacks. Every second, more than 77 terabytes of internet traffic takes place online — a very busy road that facilitates all aspects of modern life and business. Unfortunately, this road is also beset by highwaymen looking to profit from unsuspecting users.

Over the past few years, the media has shown us headlines spotlighting crippling cyberattacks against major corporations. While each corporate attack resulted in millions of pounds in damage, most stories fail to mention the huge number of data breaches that affect much softer targets: small businesses.

The very nature of cyberattacks means you will often not know when the next strike could occur — but what you can do is take proper precautions to hamper a hacker's attempt at gaining access to your client list, bank details or employee information.

Why Small Businesses are Perceived as a Soft Target

When setting up, small business owners have plenty to think about — tools, vehicle, office or workshop; the list is long. Unfortunately, many new starters omit cybersecurity from that list. They may well have considered CCTV, alarms and other physical security, so why not cybersecurity? Many owners underestimate their risk level: they feel they have nothing worth stealing, or that hackers only focus on larger organisations. It is exactly this assumption that leaves people wide open to attack.

SMEs often fall into a hackers' sweet spot: they have more digital assets to target than an individual consumer, but less security than a larger business. This is exactly what cyber criminals are looking for.

What to Look Out For

Think about the amount of data you hold on your devices. You have your own bank details; you may hold the bank or card details of customers and employees, and their personal contact details. Would these be of value to a hacker? Of course they would. Identities can be cloned and used in damaging ways — and if your information is accessed, the damage to your reputation could be catastrophic. Imagine having to contact all of your clients and staff to tell them their information has been stolen because of your carelessness.

One of the best ways to mitigate against an attack is to understand the methods hackers use. The following is far from exhaustive — cybercrime is constantly evolving — but every business owner should at least be aware of these types of attack.

Malware

An umbrella term — a contraction of "malicious software" — covering any program introduced into a victim's computer with the intention to cause damage or gain unauthorised access. Types of malware include viruses, worms, Trojans, ransomware and spyware. Knowing these terms helps you determine what type of cybersecurity software you need.

Inside Attack

When someone with administrative access — usually from within the organisation — purposely misuses their credentials to access confidential company information. Former employees present a particular threat if they left on bad terms. Revoke all access immediately when an employee leaves, block staff from copying sensitive data, cover data theft in employment contracts, and train staff regularly.

Ransomware

Infects your machine with malware and, as the name suggests, demands a ransom — typically locking you out of your computer and demanding money for access, or threatening to publish private information if you don't pay. Ransomware is one of the fastest-growing types of security breach, and every day UK business owners are paying these ransoms.

Phishing

The most prevalent, most damaging and most widespread threat facing small businesses — accounting for 90% of all breaches businesses face. An attacker pretends to be a trusted contact and entices a user to click a malicious link, download a malicious file, or hand over sensitive information, account details or credentials.

How to Stay Safe

For small businesses looking to give their networks a fighting chance, that generally means installing basic security software. Antivirus software is the most common and will defend against most types of malware. A hardware- or software-based firewall adds a layer of protection by preventing an unauthorised user from accessing a computer or network — and most modern operating systems come with a firewall installed for free.

Steps to Take

The first, and most obvious, is data backup, ensuring that any information compromised or lost during a breach can easily be recovered from an alternate location. Remember that an external drive should be subject to the same security as your other systems. Encryption software protects your sensitive data, and keeping software up to date matters more than you may think: hackers constantly scan for security vulnerabilities, and leaving weaknesses unpatched greatly increases your chances of being targeted.

Training

Educate your employees. Teach them the different ways cybercriminals can infiltrate your systems, how to recognise signs of a breach, and how to stay safe while using your business's devices. Putting security policies in place — and enforcing them — is essential to locking down your system. Protecting the network should be on everyone's mind, since everyone who uses it is a potential endpoint for attackers. Hold regular meetings and seminars on best practice: strong passwords, identifying and reporting suspicious emails, and caution around links and attachments. Your biggest mistake could be assuming your staff already know these things.

Think Before You Click — a fishing hook baited with identity, account, bank and password details — Think before you click — phishing accounts for 90% of all breaches.

« All Advice Next: Cashing in on a Crisis »