Cyber security for small business
What is Cyber Security?
Cybersecurity (cyber security), sometimes known as computer security or information technology security, is the process of protecting computer systems and their networks from various threats.
These threats may include theft, damage or disruption to the software, hardware and information, often by malicious actors such as cybercriminals, hackers, gangs or even state-sponsored cybercrime.
Different types of cyber security
The target of cyber attacks can be any individual or organisation. However, businesses are increasingly in the sights of attackers. Despite the publicity of significant breaches to big Australian companies like Optus, companies of all sizes can expect to face ever more sophisticated cyber-attacks that target every part of their IT infrastructure, looking to exploit weaknesses. Due to a perceived lack of security, small businesses are seeing the most significant growth in cyber attacks.
Cybersecurity covers many technologies and practices, but the main types of cybersecurity include:
Critical Infrastructure
Securing computers, telecommunications and other equipment that controls essential services
Applications Security
The processes, tools and practices aimed at protecting software applications from threats throughout the entire application lifecycle
Network Security
The policies and processes adopted to prevent, detect and monitor unauthorised access or denial of a computer network or network-enabled assets
Cloud Security
A broad set of controls and technologies used to protect virtualised IP, data, applications, infrastructure and services of cloud computing
Cloud Security
A broad set of controls and technologies used to protect virtualised IP, data, applications, infrastructure and services of cloud computing
IoT Security
Security in IoT is the task of securing internet devices and the networks connected to breaches and other cyber threats while continually addressing vulnerabilities to emerging risks.
Why small business need cyber security
The goal of cyber security is to help prevent cyber-attacks.
Small businesses must protect any digital information they create and store, plus any information they collect from your customers. Providing a secure system is critical to protect your business from cybercriminals and maintain customer trust in your business.
A cyber security attack can be devastating for small businesses. With many dependent on cloud-based applications and mobile workforces, the relative lack of security control over these domains make small business prime targets for cybercriminals.
Additionally, most small businesses don’t have the time or resources to dedicate to cyber security. However, there are simple measures that a small business can introduce to help prevent common cyber security incidents.
Some benefits of cyber security include:
End-user protection
Improved confidence in the product for all stakeholders
Protection of data and network
Minimal business disruptions
End-user protection
What cyber security risks & threats affect small business?
Malware
Social Engineering
Criminals are adapting their attack methodologies and taking advantage of the human element – the weakest link of cyber security. This method involves manipulating their victims into revealing sensitive information. An example would be criminals impersonating an IT company and requesting login credentials into a secure database.
Ransomware
Ransomware is a form of malware that encrypts an infected device’s files. The hacker usually demands a ransom payment within a time frame to unlock the files. The threat is that encrypted data will be deleted if demands are not met.
Phishing
Involves contacting targets by email, telephone or text messages and tricking them into revealing sensitive information. Methods can include posing as legitimate institutions or luring their victims into clicking malicious links.
Insider threat
The cost of cybercrime to small business
Cybercrime is a big challenge for small businesses, especially as SMEs struggle to deal with uncertain economic conditions, the ongoing disruption to supply chains from Covid-19 and increasing inflation. These challenges distract many small businesses from taking necessary precautions to protect intellectual property and personal information from cybercriminals. Cybercrime was already a growing threat, but the latest statistics are sobering;
- A cyber attack on small business is reported every 10 minutes in Australia
- Almost one-third of businesses with less than 100 employees do not take any proactive cybersecurity measures
- 87% of small businesses believe they are safe simply because they use some form of antivirus software
- Of those small businesses impacted after the 2017 Ransomware attacks, 22% were unable to continue trading
- Cybercrime costs small businesses over $1B annually
- The average cyber breach costs business over $3.5M according to IBM’s Cost of Data Breach Report and the Australian Cyber Security Centre suggests the cost to SME’s averages over $276,000
Cyber security tips – How to protect small business
The Australian Cyber Security Centre (ACSC) provides a prioritised list of practical actions called “The Essential 8”, which businesses can take to make their business more secure; some of these include:
Cease the usage of unsupported software
Although still useable, unsupported software will no longer receive updates or patches to protect against threats. The software can be compromised, making its users vulnerable to a cyber-attack.
Regularly installing updates
Updates are designed to correct weaknesses in software and programs. If they are not updated frequently, they will present a vulnerability for hackers to attack your devices.
Use antivirus software
Antivirus software can be used to scan and detect any malicious or infected files on your device.
Promote the usage of strong passwords
‘Password123’ is not a secure password. Secure passwords protect accounts from unauthorised access. Having an easy-to-guess password puts sensitive information at risk. For more critical accounts, two-factor authentication is strongly recommended.
Delete suspicious emails
Avoid clicking on attachments or links from unknown senders. Inexperienced users may be fooled into opening attachments or clicking on links sent by cybercriminals. These malicious attachments or links can contain malware designed to spy on or gain access to the host device.
Frequently back up your data
Many organisations have become victims of data breaches and have their data deleted. Regularly backing up your data on offsite servers minimises the loss of information and business downtime.
Should small business consider cyber insurance?
A cyber insurance policy is an extremely valuable risk minimisation tool for small businesses. Having cyber insurance cover can help protect your business’s reputation and finances and can help minimise any damage or disruption from the cyber-attack.
Cyber insurance responds to claims made by victims of ransomware attacks and includes:
Immediate 24/7 access to incident response services following a suspected cyber incident
Ransom payments and access to specialist ransom negotiators
Costs to repair and restore IT systems and data
Cyber security tools
Cybersecurity consultants use various tools to help business build their cyber resilience. Some of these include:
Web vulnerability scanning tools
Software applications can scan web applications to identify vulnerabilities, including cross-site scripting, SQL injection, and path traversal.
Network intrusion detection
An Intrusion Detection System (IDS) monitors network and system traffic for unusual or suspicious activity and notifies the administrator if a potential threat is detected.
Network security monitoring tools
They are used to analyse network data and detect network-based threats.
Penetration testing
Also known as a “pen test”, penetration testing simulates an attack on a computer system to evaluate how secure that system is.
Packet sniffers
A packet sniffer intercepts, logs, and analyses network traffic and data.
Encryption tools
Encryption protects data by scrambling text so unauthorised users cannot read it.
Antivirus software
This software helps to identify viruses and other harmful malware, including ransomware, adware, spyware and Trojans.
Managed Security Services
Managed Security Services proactively detect, analyse and eliminate cyber threats and vulnerabilities with security actions determined from cuber alerts.
FAQ
Why is cyber security important for small businesses
Cybersecurity is emerging as one of the most critical issues for business and individuals. Effective cybersecurity protects data such as personal identity details, intellectual property and business information against loss and theft from cybercrime.
What is the average cost of a cyber attack for a small business?
The average cyber breach costs business over $3.5M, according to IBM’s Cost of Data Breach Report, and the Australian Cyber Security Centre suggests the cost to SMEs averages over $276,000. Other estimates place the cost per incident for small business at more than $40,000
How do small businesses secure data?
- Cease using unsupported software
- Regularly apply software updates and patches.
- Use strong passwords and change them regularly.
- Install up-to-date antivirus software
- Delete suspicious emails
- Backup data regularly
- Use Multifactor Authentication
- Implement user awareness and training to minimise behavioural risk
Why do hackers target small businesses?
Cybercriminals do not discriminate by size. While the data breach of a large company makes headlines, small businesses are more common targets due to lower perceived cyber resilience. Small businesses must undertake the necessary safeguards to protect their data and people from cyber threats that increasingly target small, vulnerable businesses.
Ahmed Khanji
Ahmed Khanji is the CEO of Gridware, a leading cybersecurity consultancy based in Sydney, Australia...
