Back in the day, we used to hear about cyber attacks that targeted banks and large corporations, but as time went by and the cybersecurity industry quickly developed, we began to hear less about cyberattacks that targeted large corporations and more about attacks on small businesses. In this article, we discuss the new targets: SMBs.
So what happened?
The cybersecurity industry is evolving very quickly. On the one hand, many companies are trying to develop security products that provide greater protection against cyber attacks. On the other hand, attackers are always trying to come up with new tactics and methods that can bypass security products.
If we look back 20 years ago, we can see that banks and large companies didn’t have all the security products that they have nowadays. Today, however, a large company has access to and can afford to use a variety of security products; they can start with a firewall and then add more security layers such as an IPS (intrusion prevention system), an IDS (intrusion detection system), an EDR (endpoint detection and response), a DLP (data loss prevention system) and many more.
Attackers can’t handle all of those products together, but most of them will try to benefit from any data that they can steal. However, if the amount of time spent in order to hack a bank is greater than the potential benefit that they will earn, there is no reason for them to try to attack the bank. The amount of time it will take them to research the target and develop the right tools in order to evade different security products is not worth it.
Most attackers have limited resources; they cannot research every security product in order to find bugs or dead spots that they can exploit to bypass security.
Why SMBs?
Did you know that 43% of all cyber attacks are directed towards small businesses? This is due to a number of factors, but mainly because a majority of small businesses still refuse to take a proactive approach when it comes to cybersecurity. SMB’s are the perfect target for attackers since they don’t take security seriously. Attackers have a greater chance of breaching an SMB than a large corporation. The most common attacks against SMBs are phishing, social engineering and malware attacks. (Statistics are from the Ponemon Institute.)
Most SMBs have experienced a data breach. Attackers are after valuable data such as credit card information, passwords, email addresses, IDs and more. The root cause of a data breach, according to the Ponemon Institute, is an employee or contractor that is negligent due to a lack of cybersecurity awareness and training.
What should SMBs do in order to reduce the risk?
First of all, SMBs need to understand that cybersecurity is a serious matter that must be handled and managed properly.
Here are 5 steps that SMBs can take to improve their cybersecurity:
Awareness – In an SMB, awareness is the key to reducing risk and preventing threats. Proper cyber education is effective at reducing successful cyber attacks and can be easily implemented by exposing them to cyber threats and raising their cyber threat awareness.
Policy – Creating security policies can be extremely useful. For example, enforce strong password protocols or create a white list execution policy to prevent the execution of different file extensions that are potentially risky.
Antivirus – An antivirus (AV) product can be a lifesaver since a good AV product will be updated frequently and hold information about old and new threats so it can prevent malware from running and harming work stations.
Security Updates – Yes, everyone hates to update the operating system, but those updates are not there to annoy you. They are important and you must take them seriously.
Backups – Make sure you can create backups of your files and data. Backups should be made and managed properly so that in case of a crisis, such as a ransomware infection, you can recover your data and continue working.
We wish your small business a secure 2021!
