October 12, 2022
Many smaller organizations don’t consider themselves to be a target of cybercriminals. The “we’re too small to be worth it” mindset may be somewhat true for many forms of crime, but unlike most physical security threats, the most common cyberattacks are executed in bulk quickly and easily. Many small victims add up to big payouts.
In fact, cybercrime is now more profitable than the illegal drug trade. What’s worse, many smaller organizations aren’t equipped with the same robust cybersecurity defenses as their enterprise-scale counterparts, and hackers know it.
Fortunately, most attacks can be foiled with some basic cybersecurity awareness and hygiene, if only small businesses invested in them…
The Top Five Common Cybersecurity Threats for Small Businesses
Most big attacks start out small and only take a careless click or two to spring into action. Make sure your staff is trained to watch out for these top five threats:
- PHISHING
- MALWARE
- RANSOMWARE
- WEAK CREDENTIALS
- INSIDERS
I’ll explore each of these in more detail, including ways you can stop these attacks before they do real damage.
Phishing
“Your account has been suspended due to suspicion of fraud. Please verify your account immediately to restore access.”
Would you fall for this? How about an amazing offer that’s too good to be true? Don’t be too sure you wouldn’t get sucked in. Many people think they’re not likely to fall for phishing scams, but 61% of Americans are actually highly susceptible to phishing. Phishing is the root cause of 90% of data breaches, and it often comes in the form of a “helpful” warning from a trusted contact or company. However, in reality, it’s designed to trick recipients into revealing sensitive information or downloading a malicious file.
You can easily avoid being caught in a phishing scheme by following the comprehensive tips listed here. However, we all have careless moments from time to time, and some phishing schemes are more difficult to spot than others. In addition to a healthy dose of skepticism when it comes to offers, warnings, and links, we recommend excellent email protection tools like Barracuda and ongoing security awareness training from KnowBe4, which has a proven track record of reducing your staff’s phishing susceptibility over time.
Malware
Malware is malicious code that can be used to steal or destroy your data or gain entry into your network. Malware can infect your devices through a link or a download or through another infected device.
Antivirus software definitely helps, but it’s not enough. As this software has gotten better at blocking malware, cybercriminals have also learned how to write malicious code into a native scripting language or a computer’s RAM to avoid detection.
Once again, a healthy dose of skepticism goes a long way. Be careful before clicking on any links, apply updates promptly, only use known networks, and monitor your system and network for any unauthorized use.
Ransomware
Ransomware is a form of malware in which a hacker uses malware to encrypt an organization’s data and demand a ransom for unlocking it. Many businesses may be forced to pay to recover their data. However, there’s no guarantee that after paying, you will actually be able to retrieve any of it. On average, victims get back only 65% of their data. And even though attacks against smaller organizations don’t grab headlines, 82% of ransomware attacks target small businesses.
A secure backup and recovery plan can help, but it isn’t enough to stop some modern ransomware schemes. A new form of attack has emerged where instead of just encrypting your data and demanding a ransom for its return, hackers are instead threatening to leak sensitive data online. And just like traditional ransomware attacks, even if you pay, there’s no guarantee your data won’t get leaked. These days, a multilayered cybersecurity posture is needed to prevent ransomware and data breaches.
Weak Credentials
Have you ever used Password1, Iloveyou, 123456, qwerty, or another easily guessed combination as your password? About 24% of Americans have. Don’t be one of them. It’s also important not to reuse passwords, tempting though it may be. That way, even if a hacker gets ahold of one of your passwords, that same password doesn’t open everything else.
Passwords can be frustrating, but a business password management tool can help you ensure that your staff is using strong passwords and make password management much easier. Multi-factor authentication can also reduce the risk of attackers getting into business accounts through a weak password. Just do your homework — some criminals are able to bypass some forms of multifactor authentication.
Insiders
The biggest threat to your organization might not be some unknown cybercriminal. It might be someone that works for you or with you. In fact, 30% of all data breaches in 2020 were the result of insiders. Unfortunately, insider threats are tougher to detect, and they typically do more damage. This isn’t to suggest that your staff is purposely out to do your organization any harm. But in the world of cybersecurity, even simple carelessness can be costly.
One way to protect yourself from insider threats is to adopt zero trust architecture throughout your organization. Basically that just means only making sensitive systems and data accessible by the staff that really needs access to it and constantly verifying a user is who they say they are. It’s also important not to ignore the physical security of your workplace. This blog contains helpful tips on how to protect your workplace from common on-premises threats.
Help With Small Business Cybersecurity
It may not seem like it, but cybersecurity has come a long way, and getting hacked isn’t inevitable with some basic precautions and best practices. Cybercriminals are typically opportunistic and are seeking a quick and easy payout with the least amount of effort. Just like most other security threats, if you don’t make it harder for them to hack you they’re likely to move on to an easier target.
However, I will say this. If you’re still operating without dedicated IT staff, it’s probably not sufficient anymore to rely on that one office person with a few additional computer skills. If adding full-time IT staff is out of your budget, there’s another option: Managed IT can provide enterprise-scale IT and security help without the expense of additional full-time staff.
At Marco, we price our services per user, so small organizations can still easily afford our top US-based staff of 650 certified systems engineers and technical representatives. We can supply all of the expertise and the infrastructure you need to keep your technology up and running and your data safe.
Identifying Your Vulnerability to Top Cyber Threats
Not sure if you need Managed IT? At Marco, we understand that one solution doesn’t work for every organization. We are passionate about doing our part to prevent cybercrime, and we’ve got tons of helpful tools and resources on our website that are free for anyone and everyone to use.
If you’d like to find out if your small to midsize business is already practicing good cybersecurity hygiene, our free Security Checklist can show you what you’re already doing well and highlight areas where you might need to invest in more training and tools to keep your data safe.
