A cybercriminal’s primary goal is to exploit the weaknesses in your digital (and human) business environment to help themselves to your money and information.
It would be nice to think that as a small business, you’d fly under their radar. That, due to the size of your business, the financial returns would be too low to be worthy of their attention.
But sadly, cybercriminals are equally invested in simply wrecking a trail of financial and digital destruction. They’re size and industry agnostic. So, the ball is in your court to stay aware of the dangers posed to your business and take active steps to protect it.
As we emerge from the massive shadow of COVID-19, we’re more reliant on digital communications and transactions than ever before. Which is great, right? A digital business model reduces costs, improves efficiency, and keeps you competitive.
But it also leaves us all more vulnerable to cybercrime. IT support professionals have their work cut out for them today as cybercriminals have a virtual smorgasbord of entry points to your business. These include your computers, digital devices like phones and tablets, individual and business data, websites, emails, files, business software including your financial and customer management applications, and your on-site and cloud servers.
If it’s connected to the internet, it’s potentially a risk.
Some facts you’d probably rather not know…
In their 2020 article on the predicted annual cost of cybercrime by 2025 (which incidentally is $10.5 trillion worldwide), Cybercrime Magazine says that if cybercrime were to be measured as a country, it would be the world’s third-largest economy. Right after the US and China.
Cybercrime Magazine reports that if cybercrime continues on its current growth trajectory of 15% per year, by 2025, the cost will represent the greatest transfer of economic wealth in history. It will be larger than the damage inflicted by all of the natural disasters in a year and be more profitable than the global trade of all major illegal drugs. Combined.
Closer to home, in their 2019-2020 ACSC Annual Cyber Threat Report, the Australian Cyber Security
Centre (ACSC) quoted some equally scary figures. They say that Australians lost more than $634 million to scams
in 2019 alone, and the potential cost of cybercrime locally could be as much as $29 billion annually.
The Threats
Threat 1: Email Viruses
I probably shouldn’t have opened that, right?
Opening an infected email attachment remains one of the most common ways of inviting a virus or ransomware into
your computer system. These attachments can be in the form of documents, PDFs, voicemails, video clips and images.
Now, it’s not likely that your staff are deliberately setting out to put your business in danger when they click on an
infected email or attachment. But due to ignorance, haste, and lack of training, it happens again and again.
Cybercriminals count on human nature to believe what they see in front of them. They use increasingly sophisticated spoofed emails to con the recipient into opening and even sharing them with workmates.
An infected email can do the rounds of your business in just moments, and you can count on at least one person
investigating the attachment.
The goal?
To install malicious software on your computer system to steal data, corrupt or encrypt your files, or hold you to ransom. Viruses can make seemingly harmless changes like altering your desktop wallpaper through to reformatting your hard drive, causing frequent computer crashes, flooding your network with traffic, or rendering your operating system completely useless.
The risk to you?
Where to start? You can lose or expose valuable business and customer information, find yourself locked out of your email solution, overwhelmed with issues that stop your business in its tracks.
How can you protect your business?
It all starts with education. Ask your IT support team to train your entire workforce on how to recognise a dangerous email message and how to remove it. But equally important, you need antivirus software to filter incoming emails and protect your business.
Invest In…
– Training
– Email security (including sandboxing and filtering)
– Endpoint protection (includes anti-virus)
– Firewall
– Secure Web Gateway
Threat 2: Malware
When good software goes bad
You’ve probably heard of malware, your IT support team have probably talked a lot about it. It’s the term for an intentional and malicious software attack on your software using tools including viruses, worms, Trojan horses, ransomware, spyware and more. These nasties get in and do the dirty without you knowing a thing – until it’s too late.
The goal?
To damage your devices and steal your data. Malware can also create a secret backdoor into your system so cybercriminals can rummage around in your system at their leisure, check out what’s happening in your business and
steal your data. All without being detected.
The risks to you?
All or some of your financials, customer information, and supplier data is accessed and copied to someone else’s system. Ready to be ransomed, sold off to competitors, or used to create sophisticated scams. While you may be able to fix your software retrospectively, the damage to your reputation is already done. As with all cyberthreats, the best strategy is prevention.
How can you protect your business?
You need to not only find out if you have malware already in your systems but recover from any malicious activity and
attacks. And then make sure it can’t happen again.
Invest In…
– Email security (including sandboxing and filtering)
– Endpoint protection (includes anti-virus)
– Firewall
– Anti-ransomware
– Managed Threat Detection & Response
Threat 3: Ransomware
Stick ’em up and weep
Ransomware is a part of the malware toolset. Its specific job is to encrypt or lock files so you can’t access them. It’s
basically, a burglar changing all the alarm codes to prevent you from getting back into critical parts of your business, ever.
ACSC say in their report that ransomware has become one of the most significant threats due to the massive impacts it can have on businesses and government agencies.
The goal?
Typically money. Ransomware attacks are a favourite with the cybercriminals fraternity as they are so lucrative. Once
they’ve locked you out of your business, they demand a sum of money (yes, an actual ransom – usually in a digital
currency like Bitcoin) to decrypt your files.
The risks to you?
Well, your business can be crippled. Some basic ransomware can be ‘unlocked’ if you have the right know-how. But more often than not, ransomware is highly advanced, and you have zero chance of recovering access to your files. And the general recommendation is that you don’t pay the ransom anyway, as you have no guarantee that the criminals will hold up their end of the bargain and decrypt your files. You stand to lose your data and your money. IT support teams can have a hard time recovering a business from a ransomware attack, if they don’t have the right tools available.
How can you protect your business?
Ransomware attacks typically use a Trojan that looks like a regular file attached to an email, and an unsuspecting user happily downloads or opens it. And just like that, the baddies are in. So, educating your people is your first line of defence.
Invest In…
– Training and more training
– Email security (including sandboxing and filtering)
– Endpoint protection (includes anti-virus)
– Firewall
– Anti-ransomware
– Managed Threat Detection & Response
– Two-factor authentication
– Encryption
– Backup and archiving for all business data
– Regular patching of all applications and operating systems
– IT security policies
Threat 4: Phishing
Hey, what was your account password again?
Phishing attacks are emails, texts, and digital messages designed to trick you into believing that they are from someone you trust. For example, it could be your bank telling you they are worried your account has been hacked and asking you to immediately check your account via a handy link they’ve kindly supplied. Or it could be a fake supplier invoice with a link for online payment.
Spear phishing is a phishing attack aimed at a specific individual or businesses.
The goal?
To scam you into willingly offering up your bank account numbers and passwords, personal employee ID numbers, credit card numbers to sell on the dark web, or ransom back to you. Or to install malware on your computers.
The risks to you?
You stand to lose cash, get locked out of your business and financial accounts, and have fraudulent purchases or payments made under your business name.
How can you protect your business?
Like ransomware, phishing attacks look normal. If your people are busy or simply unaware of the threat, they will trust the message they have received and act on it. It’s a good idea to limit the number of people in the business who have access to your email and social media accounts and train them to recognise threats. Your IT support team can help you lock down access to and protect your accounts.
Invest In…
– Phishing training (how to spot a phish)
– Corporate policies (confirmation on how requests should be made)
– Email security
– Endpoint protection
– Managed Threat Detection & Response
– Two-factor authentication
Threat 5: Supply chain attack
Yes, it’s me, your trusted supplier! (Maybe)
Then we have supply chain attacks, aka third-party or value-chain attacks. These attacks gain entrance to your system by using a side-entrance you’ve provided to your suppliers so they can place orders or interact with you. If your supplier doesn’t have strong cybersecurity in place, it can act as a weak link in your own defence line.
The goal?
To damage your business. By gaining entrance to your systems through an identified weakness, cybercriminals will typically attack your manufacturing software and put you out of action.
The risks to you?
You can lose sensitive customer information, experience disruption to your manufacturing process, and end up with a damaged reputation as you can’t deliver goods or services on time, if at all.
How can you protect your business?
Tightening up your own cybersecurity rules is critical. Limit who can access your systems externally and insist that supplier employees each have a unique password. Also, monitor when your systems are being accessed. Is John in Sydney really placing an order at 3 am on a Saturday?
Invest In…
– Integrated cybersecurity strategy
– Appropriate user-based access levels
– Managed Threat Detection & Response
– Server protection
– Firewall
– Two-factor authentication
Other Useful Cybersecurity Information
What should you do if you have a cyber breach?
The Australian Government takes cybersecurity very seriously, regardless of whether you’re a multi-national or a small, local business.
If you experience a cyber breach, you may be legally required to lodge a notification. Failing to do so can land you in hot water – and a lot of it! Fines range from $360,000 for individuals to $1.8million for businesses. Size and
ignorance are not valid excuses. You’re expected to have the right measures in place to identify if you have had a breach, and if you do, understand the ramifications, and take specific steps to notify the right parties.
What official resources are there to help protect your business?
To help you get cybersecurity right, the Australian Government has a dedicated website full of valuable resources, including up-to-date cyber alerts. And they’ve also created an official guideline called The Essential Eight to provide you with a baseline of threats to watch out for and strategies to minimise their impact if the worst happens.
You should also check out US Government’s NIST framework. Together with The Essential Eight, you’ll get a great heads up on protecting your business.
You can also visit Cybrary, an online cybersecurity education platform, sign up for a free account and take some cybersecurity courses. There are videos, certifications and much more
Umm, what does that mean?
Anti-virus. Anti-virus is a software application that helps protect your computer from viruses. It is a standard recommendation for every computer, regardless of whether it’s for business or personal use. Anti-virus software comes equipped with Multi-Device Protection – meaning you can use it to protect your computer and mobile, and tablet from different types of cyber threats. It should include a firewall (more on firewalls below) to add a layer of defence between your computer and the internet, and a virus removal tool to help you if your computer
becomes infected. Modern anti-virus platforms include in-built behaviour and machine learning, so they continue to get smarter over time.
Backup. Backing up your data is a process in which your business data and applications are copied and stored in another location. It’s an insurance measure that ensures you have a copy of your data safely stored away if your systems are breached, or you fall victim to a cyberattack. Backing up can save you from paying out what can be hundreds of thousands of dollars to unlock your files and avoid the financial impact of lost productivity or sales. Check out our downtime calculator to work out the cost of not backing up.
Encryption. Encryption is a form of protecting your data that uses complex codes and keys to encrypt or lock your data, rendering it almost useless unless you have the key to decrypt or unlock it. It provides a secure way of transferring sensitive information and keeping your physical computer safe. If your laptop is stolen and the data is encrypted, it’s almost impossible to lift data from the hard drive. There are tools available to encrypt and send sensitive digital information; for example, Outlook has built-in functionality to help you out. Unfortunately, cybercriminals also use encryption for malicious purposes like running ransomware attacks.
Firewall. A firewall acts as a barrier between your computer and the internet. It helps to keep the data stored on your computer and the data safe. There are many types of firewalls, including physical devices that sit with your router or modem and virtual or cloud-hosted firewall software. Windows and Macs come with in-built firewall functionality, which is a great start, but it’s essential to invest in a business-grade firewall as well.
HTTP vs HTTPS. While surfing the internet, you’ll see http:// or https:// followed by the website address. The ‘s’ in https indicates that the website is secured with a security certificate (called an SSL certificate). This ensures encryption is applied to the communication between you and the website. It helps improve the privacy of the data collected by the website and makes sure that it can be transferred safely. Most websites today collect information from their visitors using cookies. With a security certificate, you know that your data is a little bit safer. This is standard practice in the
world of websites, and we recommend being cautious and suspicious of any websites without https://.
Managed Threat Detection. Also called MTR, managed threat detection proactively hunts down and validates any potential threats and incidents on your network. It can automatically start the required actions to disrupt, contain and neutralise any threats on your behalf.
Multi-Factor Authentication. Multifactor or two-factor authentication means having a password to access an account, and having another method of identifying yourself. You can use an authentication app like Microsoft Authenticator or Google Authenticator, or SMS, or email. It is an effortless way to add an extra layer of protection to your account. Hackers have programs that automatically test thousands of passwords against your accounts. If you have an easy password and don’t have two-factor authentication, their automated bots could access your accounts
Ransomware. Ransomware (sometimes called cryptolocker) consists of a simple virus that, once on your computer or company’s network, encrypts your files, making them useless without an un-encryption key. Getting this key involves transferring large sums of money, usually in Bitcoin or another cryptocurrency, to the perpetrators. There have been some big-name brands affected by ransomware, including Toll, Garmin, Channel9, Fisher & Paykel and Blue Scope. This doesn’t mean that large companies are the prime targets, though. In fact, small businesses are amongst some of the most vulnerable to ransomware attacks. Often small business owners assume they are too small to be a target, which is why many hackers target them.
Sandboxing. A sandbox is an isolated, safe environment, which imitates your entire computer system. Suspicious programs can be run in your sandbox to check out how they behave and understand why they are there, without putting your network at risk.
Secure Web Gateway. A secure web gateway protects your internet-connected devices from infection. It enforces company policies such as stopping employees from visiting blacklisted sites or allowing traffic to or from those sites.
Vulnerability. The term vulnerability refers to all areas of cybersecurity where you might be vulnerable to a cyberattack. It could be a missing security patch or out-of-date software. Or it could be an area of your business that needs more cybersecurity training. Essentially anything flagged as ‘vulnerable’ in your technology suite should be
addressed as a priority.
Some handy cybersecurity tips for businesses
We know that dealing with cybersecurity and cybercrime can be overwhelming. As a small business, you may not have the time or resources needed to give it the attention it needs.
Luckily, there’s a wealth of technology designed with the sole purpose of helping to keep your business safe. Combined with employee training, it can go a long way to make sure that you’re not a cybercrime statistic.
Here are some quick wins you can implement to protect yourself:
– Audit and create a list of all your business applications and their security
features (you can use this template to get the job done)
– Check your insurance to see if you have cybersecurity insurance included
Want to know more about cybersecurity and how you can protect your business? Our team of cybersecurity consultants across Melbourne, Sydney and Brisbane have countless cybersecurity and Microsoft certifications and are ready to help, get in touch to learn more.
