Going After Small Businesses IT Systems

Small businesses may think they are safe from hackers and cyber attacks. They may think that they are too small to attract attention from hackers. The problem with this line of thinking is that hackers prefer easier targets not bigger targets.

The small business owner needs to accept the fact that they are targeted specifically. However, it is not all bad news. Continue reading our article to find out why small businesses are targets and what they can do to protect themselves.

Getting the right answers will help small businesses owners take the right steps to protect their assets and their customers’ information.

The Reasons Why Small Businesses Are Targets For Hackers

You may not think you are vulnerable or a prized target for hackers. But it is exactly that type of rationale that hackers look for. When the small business owner takes that approach to security, you become the hackers’ target since they know small business owners have a weak defense to infiltrate.       

Here are reasons why small businesses are targets for hackers:

1. Lax Security

Every hacker knows that small businesses do not have the resources available to protect themselves. Unlike the bigger corporations which have a vast amount of resources to build a tough security system, small business owners do not have that luxury.

The security that a small business owner can afford is often weak or non-existent giving the hacker an easy time of getting into the small company’s records and data. The hacker works less but still gets what they want in less time.

2. Personal Information

Just like the bigger corporations, small businesses often store customers or their own personal information on their computers. This information is like striking gold for the hacker as they can use it for identity theft, data selling, and other nefarious schemes.

It is also possible that the hacker will use their theft as a way to extort money out of the small business owner. Because the small business has a weaker or non-existent tech department as well as weaker cybersecurity, the hacker gets this information with little trouble.

3. Untrained Personal

Small businesses just might be naive about cyber attacks and the damage they can cause to them. This is another area where small businesses cannot compete with larger companies. They provide minimal training and often that training does not cover what to do when suspicious e-mails arrive.

Naive or untrained employees can accidentally open an e-mail or go to a website that gives the hacker the opening they need to get into the company’s system. Then the hacker either steals the information or holds it for ransom.

4. Uses Small Businesses As A Back Door To Bigger Fish

Hackers may not get past the cybersecurity large corporations maintain but they can use smaller businesses to get access to those larger companies. They do this by finding small partners of the larger corporations and hacking into their systems. The practice of using smaller companies as stepping stones is often referred to as island hopping. This type of attack leverages trust between the two organizations to gain access to the larger one.

Once they do that, they can find the credentials they need to hack into the larger corporation’s database. Protecting your system helps you be a better partner to those large accounts that help your business survive. When you have weak security, then you are the stepping stone to bigger fish. Because of this many, larger companies are enforcing IT security standards upon their vendors.

5. Easier To Spear Phish

Spear phishing is when individuals are targeted. Emails to targeted individuals are made believable by using published information often found on social media or the company’s website. These targeted emails can look like it is coming from a legitimate source or person when in reality it is not. Once opened, the hacker can install malware onto that person’s computer or steal the log-in data through keystroke data.

Once the hacker has this information, they can get access to bank accounts, payroll systems, and other financial secrets the small business has. This option may take longer but it can be very successful and fruitful when the right unprotected company is targeted.

6. Assuming Cloud solves all your security problems

Smaller businesses tend to leverage the cloud due to a lack of internal infrastructure. While cloud storage can be made secure it isn’t automatically done. Things like password management, encryption, data segregation, and other techniques all still need to be applied even to data in the cloud.

While cloud providers will maintain updates and take other security precautions they are ultimately not responsible for your data. The disadvantage of the cloud is that it is internet accessible and thus easier for attackers worldwide to reach.

It is critical to still back up your data despite it being in the cloud. The cloud vendor may be hacked, could go out of business or they could have a billing depute with their customer that could cause them to delete the data.  

Ways To Protect Your Small Business

Now that you have read the bad news, there are some good news on the horizon. Even if you do not have a lot of financial resources available you can still shore up your defenses and protect your money, customer information, and more.

The following tips should help you become more aware of your weak spots and show you how you can fix them to make it harder for hackers to gain access to your vital information.

1. Admit That You Are A Possible Target

Denial is what the hacker likes to see. It allows them to gain access to your stored data because you refuse to believe you are large enough for a hacker to want to attack. Once you accept the fact that you can be a target, you can do something to stop those attacks.

Have an expert check out your system before you lose any money you cannot afford to lose. A typical ransom for a small business is $10,000 which is devastating for a small business but is a great haul for a hacker and a devastating loss to some smaller companies.

Whether you think you are a target or does not matter. It is if the hacker thinks you are a target that is important.

2. Install The Right Protections

This cannot be stressed enough. Once you beef up your security, you make your finances and data a lot safer. While nothing is foolproof, having a stronger defense may give you the time you need to stop the attack.

Here are some key defensive moves to make:

Always update your operating system and third-party software every time new updates become available.

Create a password policy and use it.

Enable and review logging of all key systems.

Use two-factor authentication whenever possible.

Create and maintain an incident response plan so you can act quickly to stop unauthorized access to your systems.

Ensure all systems have anti-virus and/or preferably EDR and MTR.

Have a vulnerability scan performed by a qualified IT security professional yearly or more often if you have sensitive data.

Install firewalls and make sure you keep them updated.

 Encrypt critical data in transit and at rest.

Configure your computers to disallow flash drives unless needed.

Ensure that guests do not connect to the production network. Instead, they should connect to the guest network.

Not are backups are equal. Ensure that your backups are ransomware resistant.

These systems may cost you a little bit of money each month, but it is better to spend it on protection than it is to lose it through cyber theft.

3. Employee Training

This is essential especially when your employees have access to your computer and certain files in your system. It is said that the #1 weakness in a small business is untrained employees.

When the employee does not know what to look for or has the right knowledge to spot a phishing attempt, then they can become unwitting partners in the breach. Employees need to understand that it is their jobs and their personal data that are also vulnerable.

Not that you will fire them over a breach but the possibility that the company can go out of business will terminate their employment. Get the right tools and information to train your employees well. This will protect them as well as your customers.

4. Back-Up Your Data

Backups are a critical and often overlooked aspect of IT security. Not all backups are created equal. Your backups must be designed based on what you are trying to protect.

Ransomware has made a number of backup methodologies obsolete and ineffective. Ransomware attackers specifically target and destroy backups. The bad guys know that this is key to forcing you to pay the ransom. Therefore, it’s critical that you secure your backups and keep them separate from production systems. The backups should use a pull-style methodology vs push.

It’s also important to have off-site backups. Should the local facility be destroyed local backups would be destroyed as well. Your backups can simply be files or a ready-to-run system that constitutes disaster recovery.

Don’t forget that you need to backup your cloud applications and data too. As previously mentioned your cloud vendor controls your data. Should something go wrong with that relationship you will need an off vendor backup to recover.

5. Get Professional Help

If your business is booming and you have little time to spare for cyber protection requirements, consider hiring a professional business that handles cyber protection for small businesses such as CyberVenger.

Along with monitoring and testing your systems, CyberVenger can provide the right training for your employees. It is a win-win situation as you get the protection you need to help your business survive and your employees get the training they need to spot suspicious emails and other schemes.

Small Businesses In Capital Cities Are The Bigger Target

If you have located your business in your state’s capital city, then you have just placed a target on your company’s back. Hackers like to attack those businesses in a capital city due to the possibility of a partnership with government entities.

The different computer systems in a capital city usually have 224% more malware or other infections than computers in other cities around the state. This is so in almost all of the 50 states in the union.

Plus, specific states like New York, Pennsylvania, Utah, Georgia, South Carolina, and West Virginia have seen an increase of malware attacks that were 500%+ higher than other computers in other cities in those states.*

What this tells you is that if you are located in a capital city, you are a bigger target than you may realize. Taking the steps mentioned above is a giant leap to protecting your private and business data from unauthorized hands.

Then it does not matter which state you live in as even the smaller states and their smaller capital cities are popular targets for hackers. Unfortunately, at the moment it is hard to show exactly who or how these companies got the malware that infects their computers.

Cost Of Cyber Attack On the Small Businesses

A critical component of responding to a cyber assault in a constructive manner is determining how it occurred in the first place. Unfortunately, this will necessitate the hiring of professional assistance, which may cost as much as $15,000.

The average amount spent by small and mid-sized enterprises to bring their operations back to normal following a cyber assault was $955,429, according to this study. This was in addition to the average of $879,582 that was taken from the firms that were polled. To the surprise of no one, the expense of resuming normal company operations far outweighs the amount of money actually stolen in a cyber assault.

Consider the fact that cybercrime costs small and medium-sized enterprises more than $2.2 million each year in order to have a general understanding of how much money cyber assaults cost firms. It is possible that these expenditures will arise as a result of a variety of disasters that occur as a result of a cyber assault or vulnerability, including downtime.

Some Final Words

Protecting your small business is vital. It is your livelihood and the way you take care of your family. Don’t adopt the ‘it won’t happen to me attitude’ because that is exactly the attitude hackers are searching for.

Take the right security steps to protect your customers, your employees, and your business. That way you can remain in operation for a long time to come.

If you are interested in learning more about how CyberVenger can help your business with cybersecurity give us a call at (773) 570-9935 or use the contact us page.